Method and apparatus for detecting unauthorized bulk forwarding of sensitive data over a network
First Claim
1. A method for automatically detecting bulk forwarding of email from a first network environment, comprising:
- determining an arrival rate for internal emails received from within said first network environment into one or more user accounts within said first network environment;
determining a sending rate for external emails sent from said one or more user accounts to a second network environment; and
detecting said bulk forwarding of email from a given one of said user accounts by comparing said arrival rate for said internal emails and said sending rate for said external emails.
0 Assignments
0 Petitions
Accused Products
Abstract
Methods and apparatus are provided for detecting unauthorized bulk forwarding of sensitive data over a network. A bulk forwarding of email from a first network environment is automatically detected by determining an arrival rate for internal emails received from within the first network environment into one or more user accounts; determining a sending rate for external emails sent from the one or more user accounts to a second network environment; and detecting the bulk forwarding of email from a given user account by comparing the arrival rate for internal emails and the sending rate for external emails. The bulk forwarding of email from a given user account can be detected by determining whether statistical models of the arrival rate for internal emails and of the sending rate for external emails are correlated in time.
-
Citations
9 Claims
-
1. A method for automatically detecting bulk forwarding of email from a first network environment, comprising:
-
determining an arrival rate for internal emails received from within said first network environment into one or more user accounts within said first network environment; determining a sending rate for external emails sent from said one or more user accounts to a second network environment; and detecting said bulk forwarding of email from a given one of said user accounts by comparing said arrival rate for said internal emails and said sending rate for said external emails. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
Specification