Monitoring communications

• US 8,832,049 B2
• Filed: 07/09/2010
• Issued: 09/09/2014
• Est. Priority Date: 07/09/2010
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Gillette, Zachary Lynn, Sorensen, Amanda
• Primary Examiner(s): BURKE, JEFF A
• Application Number:
  US12/833,505
• Publication Number:
  US 20120011159A1
• Time in Patent Office: 1,523 Days
• Field of Search: 707/694, 726/1, 726/3, 726 26- 27
• US Class Current: 707/694
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Methods, computer readable media, and apparatuses for monitoring communications are presented. A communication that includes non-public information may be identified. Subsequently, it may be determined whether the communication meets at least one outlier condition. In response to determining that the communication meets the at least one outlier condition, the communication may be submitted for review.

Claims

1. A method, comprising:

identifying, by a computing device, a communication that includes non-public information;

identifying, by the computing device, a sender of the communication;

evaluating, by the computing device, the amount of non-public information included in the communication;

determining, by the computing device, whether the amount of non-public information included in the communication exceeds a predetermined threshold corresponding to the sender;

in response to determining whether the amount of non-public information included in the communication exceeds the predetermined threshold, determining, by the computing device, whether the communication meets at least one outlier condition that, when met, represents a risk of unauthorized dissemination of the non-public information;

in response to determining that the communication meets the at least one outlier condition, submitting, by the computing device, the communication for review; and

based on a result of the review of the communication, automatically updating the predetermined threshold.

2. The method of claim 1, wherein determining whether the communication meets at least one outlier condition includes determining whether the communication was sent from a user with privileged access to one or more databases in which non-public information is stored.

3. The method of claim 1, wherein determining whether the communication meets at least one outlier condition includes evaluating the time at which the communication was sent.

4. The method of claim 1, wherein determining whether the communication meets at least one outlier condition includes comparing a first username associated with the sender of the communication with a second username associated with a recipient of the communication.

5. The method of claim 4, wherein determining whether the communication meets at least one outlier condition further includes determining a probability that the first username and the second username belong to a single entity.

6. The method of claim 1, wherein determining whether the communication meets at least one outlier condition includes evaluating a domain associated with a recipient of the communication.

7. The method of claim 1, wherein determining whether the communication meets at least one outlier condition includes evaluating a subject line associated with the communication.

8. The method of claim 1, wherein determining whether the communication meets at least one outlier condition includes determining that the amount of non-public information included in the communication exceeds the predetermined threshold corresponding to the sender.

9. The method of claim 1, wherein the result of the review of the communication is that the communication is a legitimate communication and the predetermined threshold is automatically increased.

10. An apparatus, comprising:

at least one processor; and

at least one memory storing computer-executable instructions that, when executed by the at least one processor, cause the apparatus to;

identify a communication that includes non-public information;

identify a sender of the communication;

evaluate the amount of non-public information included in the communication;

determine whether the amount of non-public information included in the communication exceeds a predetermined threshold corresponding to the sender;

in response to determining whether the amount of non-public information included in the communication exceeds the predetermined threshold, determine whether the communication meets at least one outlier condition that, when met, represents a risk of unauthorized dissemination of the non-public information;

in response to determining that the communication meets the at least one outlier condition, submit the communication for review; and

based on a result of the review of the communication, automatically update the predetermined threshold.

11. The apparatus of claim 10, wherein determining whether the communication meets at least one outlier condition includes determining whether the communication was sent from a user with privileged access to one or more databases in which non-public information is stored.

12. The apparatus of claim 10, wherein determining whether the communication meets at least one outlier condition includes evaluating the time at which the communication was sent.

13. The apparatus of claim 10, wherein determining whether the communication meets at least one outlier condition includes comparing a first username associated with the sender of the communication with a second username associated with a recipient of the communication.

14. The apparatus of claim 10, wherein determining whether the communication meets at least one outlier condition includes evaluating a domain associated with a recipient of the communication.

15. The apparatus of claim 10, wherein determining whether the communication meets at least one outlier condition includes evaluating a subject line associated with the communication.

16. At least one non-transitory computer-readable medium storing computer-executable instructions that, when executed by at least one processor, cause the at least one processor to:

identify a communication that includes non-public information;

identify a sender of the communication;

evaluate the amount of non-public information included in the communication;

determine whether the amount of non-public information included in the communication exceeds a predetermined threshold corresponding to the sender;

in response to determining whether the amount of non-public information included in the communication exceeds the predetermined threshold, determine whether the communication meets at least one outlier condition that, when met, represents a risk of unauthorized dissemination of the non-public information;

in response to determining that the communication meets the at least one outlier condition, submit the communication for review; and

based on a result of the review of the communication, automatically update the predetermined threshold.

17. The at least one non-transitory computer-readable medium of claim 16, wherein determining whether the communication meets at least one outlier condition includes determining whether the communication was sent from a user with privileged access to one or more databases in which non-public information is stored.

18. The at least one non-transitory computer-readable medium of claim 16, wherein determining whether the communication meets at least one outlier condition includes evaluating the time at which the communication was sent.

19. The at least one non-transitory computer-readable medium of claim 16, wherein determining whether the communication meets at least one outlier condition includes comparing a first username associated with the sender of the communication with a second username associated with a recipient of the communication.

20. The at least one non-transitory computer-readable medium of claim 16, wherein determining whether the communication meets at least one outlier condition includes evaluating a domain associated with a recipient of the communication.

21. The at least one non-transitory computer-readable medium of claim 16, wherein determining whether the communication meets at least one outlier condition includes evaluating a subject line associated with the communication.