Secure information classification

• US 8,751,424 B1
• Filed: 12/15/2011
• Issued: 06/10/2014
• Est. Priority Date: 12/15/2011
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Wojcik, Richard H., Xue, Ping, Poteet, Stephen R., Harrison, Philip
• Primary Examiner(s): Chaki, Kakali
• Assistant Examiner(s): Wu, Fuming
• Application Number:
  US13/327,046
• Time in Patent Office: 908 Days
• Field of Search: None
• US Class Current: 706/20
• CPC Class Codes: G06F 16/353 into predefined classes
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In one embodiment a method to create a system to manage documents with sensitive or classified content comprises extracting a list of text features enabling interaction with the user developing the system to create a rule-based classifier based on the list of text features and one or more synonymous features, applying the rule-based classifier to one or more selected documents to tag a set of documents with the sensitive or classified information they contain, training a statistical text classifier using the tagged documents generated as a training set, applying the trained statistical text classifier to the training set, and reapplying the refined rule-based classifier to the one or more documents to tag a set of documents with the sensitive or classified information they contain. Other embodiments may be described.

Claims

1. A method for using a system to manage documents sensitive or classified content with a predetermined classifier threshold, comprising:

(a) extracting, from a security policy guide or other informal set of rules, a list of text features;

(b) enabling interaction with a user configuring the system to create a rule-based classifier based on the list of text features and one or more synonymous features that capture sensitive or classified information in the security policy guide or the other informal set of rules;

(c) applying the rule-based classifier to one or more selected documents to tag a set of documents with the sensitive or classified information they contain to generate tagged documents;

(d) training a statistical text classifier using the tagged documents generated in (c) as a training set;

(e) applying the statistical text classifier to the training set to suggest additional documents that should be tagged and to generate additional text features for detecting the sensitive or classified information;

(f) providing the additional documents and the additional text features to a user interface for review and comparison by the user to update the training set and the list of text features and the one or more synonymous features;

(g) refining the rule-based classifier based on the training set, the list of text features, and the one or more synonymous features generated in (f); and

(h) repeating operations (b) through (g) until a classification scheme satisfies the predetermined classifier threshold.

2. The method of claim 1, further comprising:

applying the rule-based classifier to one or more selected documents to tag a set of documents with the sensitive or classified information they contain so that it creates training set for the statistical classifier.

3. The method of claim 1, further comprising:

extracting, from the security policy guide or other informal set of rules, the one or more synonymous features, wherein the text features are words and phrases, and the one or more synonymous features are one or more synonyms of those words and phrases.

4. The method of claim 1, wherein the rule-based classifier is further based on extracted words and phrases, and the one or more synonyms of those words and phrases automatically identified using additional lexical resources.

5. The method of claim 1, further comprising:

extracting, from the security policy guide, one or more words which are associated with a specific classification; and

automatically expanding extracted words and phrases by identifying the one or more synonyms using additional resources.

6. The method of claim 1, further comprising:

extracting, from the security policy guide, one or more words which are associated with a specific classification; and

automatically associating a first document with the specific classification when the one or more words are located in the first document.

7. A computer-based system for using the system to manage document classification with a predetermined classifier threshold, the system comprising:

a non-transitory memory module;

a computer-based processing device coupled to memory; and

logic instruction stored in the non-transitory memory module which, when executed by the processing device, configures the processing device to;

(a) extract, from a security policy guide or other informal set of rules, a list of text features;

(b) enable interaction with a user to configure the system to create a rule-based classifier based on the list of text features and one or more synonymous features that capture sensitive or classified information in the security policy guide or the other informal set of rules;

(c) apply the rule-based classifier to one or more selected documents to tag a set of documents with the sensitive or classified information they contain to generate tagged documents;

(d) train a statistical text classifier using the tagged documents generated in (c) as a training set;

(e) apply the statistical text classifier to the training set to suggest additional documents that should be tagged and to generate additional text features for detecting the sensitive or classified information;

(f) provide the additional documents and the additional text features to a user interface for review and comparison by the user to update the training set and the list of text features and the one or more synonymous features;

(g) refine the rule-based classifier based on the training set and the list of text features and the one or more synonymous features generated in (f); and

(h) repeat operations (b) through (g) until a classification scheme satisfies the predetermined classifier threshold.

8. The computer-based system of claim 7, wherein the rule-based classifier is a Boolean rule classifier.

9. The computer-based system of claim 7, wherein the statistical text classifier is a Naï

ve Bayesian Classifier, or a Support Vector Machine (SVM).

10. The computer-based system of claim 7, further comprising logic instructions which, when executed by the processing device, configures the processing device to:

extract, from the security policy guide, one or more words which are associated with a specific classification; and

automatically associate a first document with the specific classification when the one or more words are located in the first document.

11. A computer program product comprising logic instruction stored in a non-transitory memory module which, when executed by a processing device, configures the processing device to manage document classification in a document classification system with a predetermined classifier threshold by performing operations comprising:

(a) extracting, from a security policy guide or other informal set of rules, a list of text features;

(b) enabling interaction with a user to configure the document classification system to create a rule-based classifier based on the list of text features and one or more synonymous features that capture sensitive or classified information in the security policy guide or the other informal set of rules;

(c) applying the rule-based classifier to one or more selected documents to tag a set of documents with the sensitive or classified information they contain to generate tagged documents;

(d) training a statistical text classifier using the tagged documents generated in (c) as a training set;

(e) applying the statistical text classifier to the training set to suggest additional documents that should be tagged and to generate additional text features for detecting the sensitive or classified information;

(f) providing the additional documents and the additional text features to a user interface for review and comparison by the user to update the training set and the list of text features and the one or more synonymous features;

(g) refining the rule-based classifier based on the training set and the list of text features and the one or more synonymous features generated in (f); and

(h) repeating operations (b) through (g) until a classification scheme satisfies the predetermined classifier threshold.

12. The computer program product of claim 11, further comprising logic instruction which, when executed by the processing device, configure the processing device to:

extract, from the security policy guide, one or more words which are associated with a specific classification; and

automatically associate a first document with the specific classification when the one or more words are located in the first document.