DATA LOSS DETECTION METHOD FOR HANDLING FUZZINESS IN SENSITIVE KEYWORDS

• US 20110093768A1
• Filed: 10/21/2009
• Published: 04/21/2011
• Est. Priority Date: 10/21/2009
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Panwar, Vikas
• Granted Patent: US 8,533,579 B2
• Time in Patent Office: Days
• US Class Current: 714/809
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload

Abstract

A method and apparatus for handling fuzziness in sensitive keywords from data loss prevention (DLP) policies. In one embodiment, the method includes identifying a keyword included in a DLP policy, generating multiple permutations of the keyword, and adding the multiple permutations to the DLP policy. The method further includes causing information content to be searched for the keyword permutations to detect a violation of the DLP policy in the information content.

Claims

1. A computer-implemented method comprising:

identifying, by a computer system, a keyword included in a data loss prevention (DLP) policy;

generating, by the computer system, a plurality of permutations of the keyword;

adding, by the computer system, the plurality of permutations to the DLP policy; and

causing information content to be searched for the plurality of permutations of the keyword to detect a violation of the DLP policy in the information content.

2. The method of claim 1 further comprising:

creating a record of the DLP policy violation, the record identifying the information content, a detected permutation and a corresponding keyword.

3. The method of claim 1, wherein each of the plurality of permutations of the keyword is a distinct anagram of the keyword.

4. The method of claim 1, wherein generating, by the computer system, a plurality of permutations of the keyword comprises:

receiving user input specifying a maximum number of characters to be used to permute the keyword; and

limiting the number of characters to be permuted to the specified maximum number of characters when generating the plurality of permutations of the keyword.

5. The method of claim 1, wherein generating, by the computer system, a plurality of permutations of the keyword comprises:

receiving user input specifying a number of last characters to be permuted; and

permuting the specified number of last characters of the keyword when generating the plurality of permutations of the keyword.

6. The method of claim 1, wherein generating, by the computer system, a plurality of permutations of the keyword comprises:

receiving user input specifying a maximum number of characters to be used to permute the keyword and user input specifying the number of last characters to be permuted; and

permuting the specified number of last characters of the keyword while limiting the number of characters to be permuted to the specified maximum number of characters, when generating the plurality of permutations of the keyword.

7. The method of claim 1, wherein generating, by the computer system, a plurality of permutations of the keyword comprises:

receiving user input specifying exceptions for keyword permutations; and

removing exceptions from the plurality of permutations prior to adding the plurality of permutations to the DLP policy.

8. The method of claim 1 further comprising:

providing a user interface allowing a user to specify one or more parameters for generating the plurality of permutations of the keyword.

9. The method of claim 1 wherein the information content is any one of data in use, data in motion, and data at rest.

10. A computer system comprising:

a memory to store a data loss prevention (DLP) policy;

a processor, coupled to the memory; and

a policy management system, executed from the memory by the processor, to identify a keyword included in the DLP policy, to generate a plurality of permutations of the keyword, to add the plurality of permutations to the DLP policy, and to cause information content to be searched for the plurality of permutations of the keyword to detect a violation of the DLP policy in the information content.

11. The system of claim 10 further comprising:

a data management system, coupled to the policy management system, to detect the violation of the DLP policy, and to create a record of the DLP policy violation, the record identifying the information content, a detected permutation and a corresponding keyword.

12. The system of claim 10, wherein each of the plurality of permutations of the keyword is a distinct anagram of the keyword.

13. The system of claim 10, wherein the policy management system comprises a user interface to receive user input specifying a maximum number of characters to be used to permute the keyword, wherein the policy management system is to limit the number of characters to be permuted to the specified maximum number of characters when generating the plurality of permutations of the keyword.

14. The system of claim 10, wherein the policy management system comprises a user interface to receive user input specifying a number of last characters to be permuted, wherein the policy management system is to permute the specified number of last characters of the keyword when generating the plurality of permutations of the keyword.

15. The system of claim 10, wherein the policy management system comprises a user interface to receive user input specifying a maximum number of characters to be used to permute the keyword and user input specifying the number of last characters to be permuted, wherein the policy management system is to permute the specified number of last characters of the keyword while limiting the number of characters to be permuted to the specified maximum number of characters, when generating the plurality of permutations of the keyword.

16. The system of claim 10, wherein the policy management system comprises a user interface to receive user input specifying exceptions for keyword permutations, wherein the policy management system is to remove exceptions from the plurality of permutations prior to adding the plurality of permutations to the DLP policy.

17. A computer readable storage medium that provides instructions, which when executed on a processing system cause the processing system to perform a method comprising:

identifying, by a computer system, a keyword included in a data loss prevention (DLP) policy;

generating, by the computer system, a plurality of permutations of the keyword;

adding, by the computer system, the plurality of permutations to the DLP policy; and

causing information content to be searched for the plurality of permutations of the keyword to detect a violation of the DLP policy in the information content.

18. The computer readable storage medium of claim 17, wherein generating, by the computer system, a plurality of permutations of the keyword comprises:

receiving user input specifying a maximum number of characters to be used to permute the keyword; and

limiting the number of characters to be permuted to the specified maximum number of characters when generating the plurality of permutations of the keyword.

19. The computer readable storage medium of claim 17, wherein generating, by the computer system, a plurality of permutations of the keyword comprises:

receiving user input specifying a number of last characters to be permuted; and

permuting the specified number of last characters of the keyword when generating the plurality of permutations of the keyword.

20. The computer readable storage medium of claim 17, wherein generating, by the computer system, a plurality of permutations of the keyword comprises:

receiving user input specifying exceptions for keyword permutations; and

removing exceptions from the plurality of permutations prior to adding the plurality of permutations to the DLP policy.