Method and apparatus for automatically correlating related incidents of policy violations

• US 9,235,629 B1
• Filed: 06/30/2011
• Issued: 01/12/2016
• Est. Priority Date: 03/28/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Jones, Christopher, Desjardins, Daren, Bothwell, Eric, Fontana, Alexander
• Primary Examiner(s): Hasan, Syed
• Application Number:
  US13/174,718
• Time in Patent Office: 1,657 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and apparatus for automatically correlating policy violation incidents. In one embodiment, the method includes receiving user input identifying one of policy violation incidents stored in a data repository, where each policy violation incident is associated with one or more attributes. The method further includes automatically correlating the identified policy violation incident with other policy violation incidents that have in common at least one attribute with the identified policy violation incident, and presenting the resulting correlation information to a user.

Claims

1. A method, comprising:

identifying a plurality of incidents of violations of a policy upon detecting presence of confidential information in a plurality of messages;

storing the plurality of violation incidents of the policy in a data repository, wherein each of the plurality of violation incidents is associated with one or more message attribute values;

receiving a user request to correlate one of the plurality of violation incidents of the policy stored in the data repository to other incidents of the plurality of violation incidents of the policy based on at least one common message attribute value;

in response to the user request, correlating, by a processing device, a requested violation incident with the other incidents of the plurality of violation incidents of the policy based on the at least one common message attribute value of the one or more message attribute values, wherein the correlating comprises searching the data repository using the at least one common message attribute value;

providing, for a user interface, resulting correlation information that identifies, for each of a plurality of time periods, a count of a number of incidents similar to the one of the plurality of violation incidents that occurred during a corresponding time period of the plurality of time periods; and

providing the incidents similar to the one of the plurality of violation incidents that occurred during the corresponding time period of the plurality of time periods in response to a selection associated with the count for the corresponding time period of the plurality of time periods.

2. The method of claim 1, wherein the plurality of policy violation incidents are incidents of storing or transmitting confidential information that violate one or more data loss prevention policies.

3. The method of claim 1, wherein the correlating comprises:

generating a list of the one or more message attribute values of the requested violation incident; and

for each of the one or more message attribute values of the list, generating a count of the number of other violation incidents of the policy that have the at least one message attribute value in common with the requested violation incident.

4. The method of claim 3, further comprising:

receiving user input regarding a request to find similar incidents according to one or more user-identified message attributes of the requested violation incident; and

generating a list of the similar incidents that share a value of the one or more user-identified message attributes with the requested violation incident.

5. The method of claim 1, wherein the plurality of violation incidents has one of a plurality of incident types, each of the plurality of incident types having a corresponding one or more message attributes, the plurality of incident types comprising hypertext transfer protocol (HTTP), instant messaging (IM), simple mail transfer protocol (SMTP), network news transfer protocol (NNTP), unidirectional transmission control protocol (uTCP), file transfer protocol (FTP), and removable media.

6. The method of claim 1, wherein the correlating the requested violation incident comprises correlating the requested violation incident with the other violation incidents of the policy that occurred within a given time period.

7. The method of claim 1, wherein the correlating the requested violation incident comprises correlating the requested violation incident with the other violation incidents of the policy that were detected during a scan session.

8. The method of claim 1, wherein the one or more message attribute values comprise values of one or more of the following:

a message recipient attribute that is representative of an email address of a recipient of the message that triggered the violation incident of the policy;

a recipient address attribute that is representative of a network address of the recipient of the message that triggered the violation incident of the policy;

a message sender attribute that is representative of an email address of a sender of the message that triggered the violation incident of the policy;

a sender address attribute that is representative of a network address of the sender of the message that triggered the violation incident of the policy;

a message subject attribute that is representative of a subject of the message that triggered the policy violation incident of the policy; and

an attachment name attribute that is representative of an attached file of the message that triggered the violation incident of the policy.

9. The method of claim 1, wherein the one or more message attribute values comprise values of one or more of the following:

a policy type attribute that is representative of a policy type of the violation incident of the policy;

a user name attribute that is representative of a user name of a user that triggered the violation incident of the policy;

a host name attribute that is representative of a name of a computer where the violation incident of the policy occurred;

a file server name attribute that is representative of a name of a server where the violation incident of the policy occurred;

a file name attribute that is representative of a name of a file that triggered the violation incident of the policy;

a file owner attribute that is representative of a name of an owner of the file that triggered the violation incident of the policy; and

a database attribute that is representative of a name of a database in which a file or a message that triggered the violation incident of the policy is stored.

10. The method of claim 1, wherein the correlating the requested violation incident comprises:

for each of the at least one message attribute value of the requested violation incident,

performing a lookup operation to determine an attribute table name, an attribute column name, and a comparator operator;

reading the message attribute values corresponding to the particular message attribute;

constructing a query using the attribute table name, the attribute column name, the comparator operator, and the read attribute value for the particular message attribute;

performing a search within the incident data repository for other violation incidents of the policy using the constructed query; and

generating a count of the number of number of other violation incidents of the policy returned from the particular search.

11. The method of claim 1, further comprising:

displaying a table comprising the time-axis to represent a given time period and another axis to represent the one or more message attribute values of the requested violation incident; and

for each message attribute value of the table, displaying a count of the number of similar violation incidents of the plurality of stored violation incidents of the policy that occurred within the given time period and that share a similar message attribute value with a relevant message attribute value of the requested violation incident.

12. The method of claim 11, further comprising:

providing links for each of the counts;

for each of the links, providing a list of the similar violation incidents of the plurality of stored violation incidents of the policy that occurred within the given time period and that share the similar message attribute value with the particular message attribute value of the requested violation incident when the link is selected by the user.

13. An apparatus comprising:

a memory to store a plurality of violation incidents of a policy, wherein each of the plurality of violation incidents is associated with one or more message attributes values; and

a processing device, coupled to the memory, to;

identify the plurality of violation incidents of the policy upon detecting presence of confidential information in a plurality of messages;

receive a user request to correlate one of the plurality of violation incidents of the policy stored in the data repository to other incidents of the plurality of violation incidents of the policy based on at least one common message attribute value;

correlate a requested violation incident with the other incidents of the plurality of violation incidents of the policy based on the at least one common message attribute value of the one or more message attribute values, wherein the correlating comprises searching the data repository using the at least one common message attribute value; and

provide, for a user interface, resulting correlation information that identifies, for each of a plurality of time periods, a count of a number of incidents similar to the one of the plurality of violation incidents that occurred during a corresponding time period of the plurality of time periods; and

provide the incidents similar to the one of the plurality of violation incidents that occurred during the corresponding time period of the plurality of time periods in response to a selection associated with the count for the corresponding time period of the plurality of time periods.

14. The apparatus of claim 13, further comprising an incident data repository to store the plurality of policy violation incidents.

15. The apparatus of claim 13, wherein the user interface is further to display a list of the one or more message attribute values of the identified policy violation incident, and to display, for each of the one or more message attribute values, a count of the number of other policy violation incidents that have in common a message attribute with the identified policy violation incident, generated by the correlation engine.

16. The apparatus of claim 15, wherein the user interface is to provide a link for each of the counts, wherein the correlation engine is configured to generate a list of the other violation incidents of the policy corresponding to the count when the link for the particular count is activated.

17. The apparatus of claim 13, wherein the processing device is further to receive from the user through the user interface a request to find similar incidents according to one or more user-identified message attributes of the requested violation incident, and generate a list of the similar incidents that share a value of the one or more user-identified message attributes with the requested violation incident.

18. A non-transitory computer-readable storage medium having instructions stored thereon that when executed by a processing device cause the processing device to perform operations comprising:

receiving a user request to correlate one of a plurality of violation incidents of a policy stored in a data repository to other incidents of the plurality of violation incidents of the policy based on at least one common message attribute value, the user request comprising a plurality of common message attribute values associated with the incident to be correlated;

in response to the user request, correlating a requested violation incident with the other incidents of the plurality of violation incidents of the policy based on the at least one common message attribute value of the one or more message attribute values, wherein the correlating comprises searching the data repository using the at least one common message attribute value;

providing, for a user interface, resulting correlation information that identifies, for each of a plurality of time periods, a count of a number of incidents similar to the one of the plurality of violation incidents that occurred during a corresponding time period of the plurality of time periods; and

providing the incidents similar to the one of the plurality of violation incidents that occurred during the corresponding time period of the plurality of time periods in response to a selection associated with the count for the corresponding time period of the plurality of time periods.

19. The non-transitory computer-readable storage medium of claim 18, wherein the plurality of policy violation incidents are incidents of storing or transmitting confidential information that violate one or more data loss prevention policies.