Filtering data transfers

• US 10,565,367 B2
• Filed: 11/14/2017
• Issued: 02/18/2020
• Est. Priority Date: 07/30/2008
• Status: Active Grant

• Current Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Original Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Inventors: Fleming, Samuel, Weeks, Richard T
• Primary Examiner(s): Sigmond, Bennett M
• Assistant Examiner(s): Anderson, Scott C
• Application Number:
  US15/812,774
• Publication Number:
  US 20180082055A1
• Time in Patent Office: 826 Days
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability

Abstract

Techniques for selectively filtering data are discussed herein. For example, a request to include data in an electronic message or a request to copy the data to a portable storage device may be received. If the data is sensitive data, the techniques may determine a software application that was opened or closed prior to receiving the request, or information that was accessed prior to receiving the request. The techniques may determine if including the data in the electronic message or copying the data to the portable storage device poses a security risk. If a security risk is identified, a task may be performed, such as alerting a network administrator, providing a notification to a user regarding the data, or preventing copying or transmission of the data.

Claims

1. A content filtering system comprising:

one or more processors; and

memory communicatively coupled to the one or more processors and storing an operating system, the operating system including a security agent that, when executed by the one or more processors, cause the one or more processors to perform acts comprising;

detecting that data is being added to an electronic message;

comparing the data to predetermined data that is classified as sensitive data to determine that the data is sensitive;

determining at least one of a software application that was opened prior to adding the data to the electronic message, a software application that was closed prior to adding the data to the electronic message, or information that was accessed prior to adding the data to the electronic message;

based at least in part on determining that the data is sensitive and the determining at least one of the software application that was opened prior to adding the data to the electronic message, the software application that was closed prior to adding the data to the electronic message, or the information that was accessed prior to adding the data to the electronic message, determining that transmitting the data in the electronic message poses a security risk; and

based at least in part on the determining that transmitting the data in the electronic message poses the security risk, preventing the electronic message from being transmitted over a network.

2. The content filtering system of claim 1, wherein the acts further comprise:

monitoring key strokes from a keyboard;

wherein the detecting is based at least in part on the monitoring.

3. The content filtering system of claim 1, wherein the acts further comprise:

monitoring mouse commands from a mouse;

wherein the detecting is based at least in part on the monitoring.

4. The content filtering system of claim 1, wherein the acts further comprise:

monitoring installation of one or more hardware devices;

wherein the determining that transmitting the data in the electronic message poses the security risk is based at least in part on the monitoring.

5. The content filtering system of claim 1, wherein the acts further comprise:

based at least in part on the determining that transmitting the data in the electronic message poses the security risk, alerting a network administrator.

6. The content filtering system of claim 1, wherein the acts further comprise:

logging user interaction data of a user operating a client computer device, the user interaction data indicating at least one of access to local or network software applications, access to network files or databases, file activity, copying files, deleting files, screen captures, clipboard activity, or web browsing;

wherein the determining that transmitting the data in the electronic message poses the security risk is based at least in part on the logging.

7. The content filtering system of claim 1, wherein the electronic message comprises at least one of an email or an instant message.

8. The content filtering system of claim 1, wherein the security agent is configured to intercept function calls or messages for a plurality of applications.

9. The content filtering system of claim 1, wherein the system comprises a cellular phone.

10. The content filtering system of claim 1, wherein the data comprises a number associated with an account.

11. A system comprising:

one or more processors; and

memory that stores instructions that, when executed by the one or more processors, cause the one or more processors to perform acts comprising;

receiving a request to copy data to a portable storage device;

comparing the data to predetermined data that is classified as sensitive data to determine that the data is sensitive;

determining at least one of a software application that was opened prior to receiving the request to copy the data to the portable storage device, a software application that was closed prior to receiving the request to copy the data to the portable storage device, or information that was accessed prior to receiving the request to copy the data to the portable storage device;

based at least in part on determining that the data is sensitive and the determining at least one of the software application that was opened prior to receiving the request to copy the data to the portable storage device, the software application that was closed prior to receiving the request to copy the data to the portable storage device, or the information that was accessed prior to receiving the request to copy the data to the portable storage device, determining that copying the data to the portable storage device poses a security risk; and

based at least in part on the determining that copying the data to the portable storage device poses the security risk, performing an action.

12. The system of claim 11, wherein the action comprises alerting a network administrator, providing a notification to a user that the data should not be copied to the portable storage device, or preventing copying of the data to the portable storage device.

13. The system of claim 11, wherein the acts further comprise:

monitoring at least one of key strokes from a keyboard or mouse commands from a mouse;

wherein the determining that copying the data to the portable storage device poses the security risk is based at least in part on the monitoring.

14. The system of claim 11, wherein the data comprises data of a screen capture.

15. The system of claim 11, wherein the determining at least one of the software application that was opened prior to receiving the request to copy the data to the portable storage device, the software application that was closed prior to receiving the request to copy the data to the portable storage device, or the information that was accessed prior to receiving the request to copy the data to the portable storage device comprises determining the software application that was opened prior to receiving the request to copy the data to the portable storage device, the acts further comprising:

determining that the software application is listed on a predetermined list of blocked applications;

wherein the determining that copying the data to the portable storage device poses the security risk is based at least in part on the determining that the software application is listed on the predetermined list of blocked applications.

16. The system of claim 11, wherein the portable storage device is communicatively coupled to the system.

17. The system of claim 11, wherein the instructions are part of a security agent that hooks into an operating system, the security agent being configured to monitor input/output data for a plurality of applications.

18. A method comprising:

detecting, by a computing device, at least one of a request to include data in an electronic message or a request to copy the data to a portable storage device;

determining, by the computing device, that the data is sensitive data;

determining, by the computing device, at least one of a software application that was opened prior to the detecting, a software application that was closed prior to the detecting, or information that was accessed prior to the detecting;

based at least in part on the determining that the data is sensitive data and the determining at least one of the software application that was opened prior to the detecting, the software application that was closed prior to the detecting, or information that was accessed prior to the detecting, determining a security risk; and

based at least in part on the determining the security risk, performing, by the computing device, an action.

19. The method of claim 18, wherein the action comprises alerting a network administrator, providing a notification to a user regarding the data, or preventing copying or transmission of the data.

20. The method of claim 18, wherein the method is performed by a security agent that is implemented on the computing device, the security agent hooking into an operating system.