Determining events by analyzing stored electronic communications

• US 9,686,163 B2
• Filed: 03/03/2015
• Issued: 06/20/2017
• Est. Priority Date: 10/14/2011
• Status: Active Grant

• Current Assignee: Mimecast Services Limited (Mimecast Limited)
• Original Assignee: Mimecast North America, Inc. (Mimecast Limited)
• Inventors: Borenstein, Nathaniel S.
• Primary Examiner(s): Miah, Razu A
• Application Number:
  US14/636,308
• Publication Number:
  US 20150180747A1
• Time in Patent Office: 840 Days
• Field of Search: 709203
• CPC Class Codes: G06Q 10/0637 Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Among other things, an aspect includes a data storage system associated with a provider entity and storing data on behalf of a client entity, the data being accessible from the data storage system by the client entity, a data interface enabling access by the provider entity to the data of the data storage system, and an analysis engine maintained by the provider entity to, at times determined by the analysis engine, access the data using the data interface, analyze the data, and generate results of the analysis for use by the client entity.

Claims

1. A method performed by one or more processors comprising:

at a provider entity;

storing a body of data on a data storage system on behalf of a client entity, the body of data being accessible from the data storage system by the client entity;

receiving, from the client entity, additions to the body of data over a period of time;

receiving configuration data representing events of interest to be identified at the provider entity, the configuration data based on a configuration established by a user associated with a client entity, the configuration established in a user interface available to users of the client entity;

analyzing the body of data stored over the period of time, including;

dividing the period of time into discrete intervals;

at each of the discrete intervals;

identifying, in the body of data, electronic communications stored over the period of time up to a subject interval, at least some of the electronic communications each including data identifying a sender or a receiver, the sender or receiver being an individual associated with the client entity;

identifying one or more elements of data that occur in one or more of the electronic communications and meet a threshold frequency of occurrence, and

comparing the elements of data identified at the subject interval to one or more elements of data occurring in electronic communications identified at multiple previous discrete intervals prior to the subject interval; and

based on the analysis, determining that one of the events of interest represented by the configuration data has occurred, and, in response to the determination,

generating results of the analysis for use by the client entity, the results indicating a characteristic of at least one of the individuals associated with the client entity, the characteristic being related to at least one of the elements of data identified in the analysis, and the characteristic being related to the event of interest represented by the configuration data that has been determined to have occurred.

2. The method of claim 1 in which the data is accessible from the data storage system by the client entity on a network shared with entities other than the client entity and the provider entity.

3. The method of claim 1 comprising:

receiving, from the client entity, data of distinct data systems associated with the client entity

processing the data from the distinct data systems for storage on the data storage system; and

enabling access by the client entity to the processed data and by an analysis engine associated with the data storage system.

4. The method of claim 3 in which the access by the client entity to the processed data is enabled by a single interface to the data.

5. The method of claim 3 in which the data storage system comprises a plurality of coordinated physical computer systems.

6. The method of claim 1 comprising:

receiving, from the client entity, data of a plurality of data systems;

processing the data for use by applications executing on the data storage system and for analysis by an analysis mechanism associated with the data storage system; and

enabling access by the client entity to the applications.

7. The method of claim 1 comprising:

receiving, from the client entity, data of distinct data systems associated with the client entity;

processing the data from the distinct data systems for storage on the data storage system and for use by applications executing on the data storage system; and

enabling access by the client entity to the processed data and the applications, and

enabling access by an analysis engine associated with the data storage system to the processed data.

8. The method of claim 1 in which at least some of the elements of data include words and phrases.

9. The method of claim 1 in which at least one of the events of interest comprises an information security event.

10. The method of claim 1 in which the analysis comprises an identification of patterns in the data.

11. The method of claim 1 in which analyzing the body of data at discrete intervals of the period of time comprises:

identifying a pattern of behavior that occurs in one or more of the electronic communications, and

comparing the identified pattern of behavior to one or more rules set by the client entity in the configuration data.

12. The method of claim 1, comprising:

formulating a search key based on information related to the electronic communications from the individual; and

finding, among the data, other electronic communications the information of which matches the search key;

in which generating results of the analysis for use by the client entity comprises generating results of the finding to the individual, the results indicating the pertinence of other electronic communications to the individual'"'"'s own electronic communications.

13. The method of claim 1 in which the discrete intervals each correspond to one or more measures of time.

14. The method of claim 1 in which the threshold frequency of occurrence is determined based on previous occurrences of the words or phrases.

15. The method of claim 1 wherein the events of interest includes a priority event specified by the user, and the method further comprising sending the results of the analysis to the user in response to determining that the priority event has occurred.

16. An apparatus comprising:

a data storage system associated with a provider entity and storing a body of data on behalf of a client entity, the body of data being accessible from the data storage system by the client entity;

a data interface enabling access by the provider entity to the data of the data storage system;

one or more processors configured for;

receiving, from the client entity, additions to the body of data over a period of time;

receiving configuration data representing events of interest to be identified at the provider entity, the configuration data based on a configuration established by a user associated with a client entity, the configuration established in a user interface available to users of the client entity; and

an analysis engine comprising a processor and memory maintained by the provider entity and configured for dividing the period of time into discrete intervals determined by the analysis engine;

accessing the data using the data interface;

analyzing the body of data stored over the period of time, including;

at each of the discrete intervals;

identifying, in the body of data, electronic communications stored over the period of time up to a subject interval, at least some of the electronic communications each including data identifying a sender or a receiver, the sender or receiver being an individual associated with the client entity;

identifying one or more elements of data that occur in one or more of the electronic communications and meet a threshold frequency of occurrence, and

comparing the elements of data identified at the subject interval to one or more elements of data occurring in electronic communications identified at multiple previous discrete intervals prior to the subject interval; and

based on the analysis, determining that one of the events of interest represented by the configuration data has occurred, and, in response to the determination,

generating results of the analysis for use by the client entity, the results indicating a characteristic of at least one of the individuals associated with the client entity, the characteristic being related to at least one of the elements of data identified in the analysis, and the characteristic being related to the event of interest represented by the configuration data that has been determined to have occurred.

17. The apparatus of claim 16 in which the data is accessible from the data storage system by the client entity on a network shared with entities other than the client entity and the provider entity.

18. The apparatus of claim 16 comprising:

receiving, from the client entity, data of distinct data systems associated with the client entity;

processing the data from the distinct data systems for storage on the data storage system; and

enabling access by the client entity to the processed data and by an analysis engine associated with the data storage system.

19. The apparatus of claim 18 in which the access by the client entity to the processed data is enabled by a single interface to the data.

20. The apparatus of claim 18 in which the data storage system comprises a plurality of coordinated physical computer systems.

21. The apparatus of claim 16 comprising:

receiving, from the client entity, data of a plurality of data systems;

processing the data for use by applications executing on the data storage system and for analysis by an analysis mechanism associated with the data storage system; and

enabling access by the client entity to the applications.

22. The apparatus of claim 16 comprising:

receiving, from the client entity, data of distinct data systems associated with the client entity;

processing the data from the distinct data systems for storage on the data storage system and for use by applications executing on the data storage system; and

enabling access by the client entity to the processed data and the applications, and

enabling access by an analysis engine associated with the data storage system to the processed data.

23. The apparatus of claim 16 in which at least some of the elements of data include words and phrases.

24. The apparatus of claim 16 in which at least one of the events of interest comprises an information security event.

25. The apparatus of claim 16 in which the analysis comprises an identification of patterns in the data.

26. The apparatus of claim 16 in which analyzing the body of data at discrete intervals of the period of time comprises:

identifying a pattern of behavior that occurs in one or more of the electronic communications, and

comparing the identified pattern of behavior to one or more rules set by the client entity in the configuration data.

27. The apparatus of claim 16, comprising:

finding, among the data, other electronic communications the information of which matches the search key;

in which generating results of the analysis for use by the client entity comprises generating results of the finding to the individual, the results indicating the pertinence of other electronic communications to the individual'"'"'s own electronic communications.

28. The apparatus of claim 16 in which the discrete intervals each correspond to one or more measures of time.

29. The apparatus of claim 16 in which the threshold frequency of occurrence is determined based on previous occurrences of the words or phrases.

30. The apparatus of claim 16, comprising:

a software interface maintained by a provider entity and providing access to the provider entity to data stored by a data storage system on behalf of a client entity,

wherein the extent of the access is tailored to applications that access and analyze the data at times determined by the provider entity.

31. The apparatus of claim 16 in which the events of interest includes a priority event specified by the user, and the apparatus further comprising sending the results of the analysis to the user in response to determining that the priority event has occurred.

32. A computer-readable storage device having instructions stored thereon that, when executed by a computer system at a provider entity, instruct the computer system to carry out operations including:

storing a body of data on a data storage system on behalf of a client entity, the body of data being accessible from the data storage system by the client entity;

receiving, from the client entity, additions to the body of data over a period of time;

receiving configuration data representing events of interest to be identified at the provider entity, the configuration data based on a configuration established by a user associated with a client entity, the configuration established in a user interface available to users of the client entity;

analyzing the body of data stored over the period of time, including;

dividing the period of time into discrete intervals;

at each of the discrete intervals;

identifying, in the body of data, electronic communications stored over the period of time up to a subject interval, at least some of the electronic communications each including data identifying a sender or a receiver, the sender or receiver being an individual associated with the client entity;

identifying one or more elements of data that occur in one or more of the electronic communications and meet a threshold frequency of occurrence, and

comparing the elements of data identified at the subject interval to one or more elements of data occurring in electronic communications identified at multiple previous discrete intervals prior to the subject interval; and

based on the analysis, determining that one of the events of interest represented by the configuration data has occurred, and, in response to the determination,

generating results of the analysis for use by the client entity, the results indicating a characteristic of at least one of the individuals associated with the client entity,

the characteristic being related to at least one of the elements of data that occur in the one or more of the electronic communications.