System and method for concept building

• US 8,850,591 B2
• Filed: 01/13/2009
• Issued: 09/30/2014
• Est. Priority Date: 01/13/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Ahuja, Ratinder Paul Singh, Deninger, William, Lakhani, Faizel, Christner, Joel
• Primary Examiner(s): KINSAUL, DANIEL W
• Application Number:
  US12/352,720
• Publication Number:
  US 20130246371A1
• Time in Patent Office: 2,086 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 16/31 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method is provided in one example embodiment and it includes identifying a root term and determining one or more other terms belonging to a group associated with the root term. The method also includes selecting one or more of the terms from the group and generating a concept based on the selected terms from the group, wherein the concept is applied to a rule that affects data management for one or more documents that satisfy the rule. In more specific embodiments, the root term is identified via a search or via an incident list. In other embodiments, a collection of meaningful terms is provided to assist in determining the other terms for the group, the collection of meaningful terms being generated based on the root term. The concept can be used to automatically mark one or more documents that relate to the concept.

Claims

1. A method, comprising:

identifying a root term from at least one of search results, one or more incident lists, or user-provided input;

determining one or more other terms belonging to a group associated with the root term;

selecting one or more of the terms from the group;

converting the selected terms to regular expressions that are mapped to attributes according to an attribute map, wherein the attributes are associated with a concept;

indexing a document using tags stored in a tag database, wherein if a predetermined number of the regular expressions occur in the document, the tags are associated with corresponding attributes by setting a field or position in an index in the tags where each corresponding attribute has a separate field in the tag indicating whether the attribute is present in the document, and wherein the tags include a pointer to a storage location where the document is stored;

applying a concept based on the selected terms to a rule provided as part of a security policy that controls whether the document is permitted to be sent to a next destination as part of network traffic, wherein the rule is applied to the tags; and

quarantining at least some of the network traffic based on the rule.

2. The method of claim 1, wherein a collection of meaningful terms is provided to assist in determining the other terms for the group, the collection of meaningful terms being generated based on the root term.

3. The method of claim 1, wherein the determining of the other terms includes identifying parameters associated with distance and frequency associated with the other terms.

4. The method of claim 1,

wherein the regular expressions are to be placed in the group.

5. The method of claim 4, wherein if any of the regular expressions appear in a group of documents, then a presence of the concept associated with the expressions is marked in those documents.

6. The method of claim 1, wherein the concept is used to automatically mark one or more documents that relate to the concept.

7. The method of claim 1, wherein a search can be performed on a keyword and the keyword becomes the root term, wherein the keyword can be characterized using Boolean connectors.

8. The method of claim 1, wherein identifying the root term includes performing single keyword or multiple keyword searches.

9. The method of claim 1, wherein determining the other terms belonging to the group includes factoring in a proximity parameter associated with one or more of the other terms, and wherein the proximity parameter can be used to identify a distance from expressions or terms and the root term.

10. An apparatus, comprising:

a processor; and

a memory, wherein the apparatus is configured to;

capture packets as part of providing a firewall function in a network environment;

identify a root term from at least one of search results, one or more incident lists, or user-provided input, and determine one or more other terms belonging to a group associated with the root term, wherein one or more of the terms from the group are selected;

convert the selected terms to regular expressions that are mapped to attributes according to an attribute map, wherein the attributes are associated with a concept;

index a document using tags stored in a tag database, wherein if a predetermined number of the regular expressions occur in the document, the tags are associated with corresponding attributes by setting a field or position in an index in the tags where each corresponding attribute has a separate field in the tag indicating whether the attribute is present in the document, and wherein the tags include a pointer to a storage location where the document is stored;

apply a concept based on the selected terms from the group to a rule provided as part of a security policy that controls whether the document is permitted to be sent to a next destination as part of network traffic, wherein the rule is applied to the tags; and

quarantine at least some of the network traffic based on the rule.

11. The apparatus of claim 10, wherein the apparatus is a network appliance that is coupled to a network and a database.

12. The apparatus of claim 10, wherein a collection of meaningful terms is provided to assist in determining the other terms for the group, the collection of meaningful terms being generated based on the root term.

13. The apparatus of claim 10, wherein the determining of the other terms includes identifying parameters associated with distance and frequency associated with the other terms.

14. The apparatus claim 13, wherein if any expressions appear in a group of documents, then a presence of the concept associated with the expressions is marked in those documents.

15. The apparatus of claim 10, wherein the concept is used to automatically mark one or more documents that relate to the concept, and wherein a search can be performed on a keyword and the keyword becomes the root term, wherein the keyword can be characterized using Boolean connectors.

16. Logic encoded in non-transitory media for execution and when executed by a processor operable to:

identify a root term from at least one of search results, one or more incident lists, or user-provided input;

determine one or more other terms belonging to a group associated with the root term;

select one or more of the terms from the group;

convert the selected terms to regular expressions that are mapped to attributes according to an attribute map, wherein the attributes are associated with a concept;

index a document using tags stored in a tag database, wherein if a predetermined number of the regular expressions occur in the document, the tags are associated with corresponding attributes by setting a field or position in an index in the tags where each corresponding attribute has a separate field in the tag indicating whether the attribute is present in the document, and wherein the tags include a pointer to a storage location where the document is stored;

apply a concept based on the selected terms to a rule provided as part of a security policy that controls whether the document is permitted to be sent to a next destination as part of network traffic, wherein the rule is applied to the tags to determine if any of the selected terms occur in the document; and

quarantine at least some of the network traffic based on the rule.

17. The logic of claim 16, wherein a collection of meaningful terms is provided to assist in determining the other terms for the group, the collection of meaningful terms being generated based on the root term.

18. The logic of claim 16, wherein the determining of the other terms includes identifying parameters associated with distance and frequency associated with the other terms.

19. The logic of claim 16,

wherein the regular expressions are to be placed in the group.

20. The logic of claim 19, wherein if any of the regular expressions appear in a group of documents, then a presence of the concept associated with the expressions is marked in those documents.

21. The logic of claim 16, wherein the concept is used to automatically mark one or more documents that relate to the concept.

22. The logic of claim 16, wherein a search can be performed on a keyword and the keyword becomes the root term, wherein the keyword can be characterized using Boolean connectors.

23. The logic of claim 16, wherein identifying the root term includes performing single keyword or multiple keyword searches.

24. The logic of claim 16, wherein determining the other terms belonging to the group includes factoring in a proximity parameter associated with one or more of the other terms, and wherein the proximity parameter can be used to identify a distance from expressions or terms and the root term.