METHOD AND APPARATUS FOR GENERATING PRIVACY PROFILES

• US 20140115712A1
• Filed: 10/23/2012
• Published: 04/24/2014
• Est. Priority Date: 10/23/2012
• Status: Active Grant

• Current Assignee: Acoustic, L.P.
• Original Assignee: International Business Machines Corporation
• Inventors: Powell, Travis Spence, Caspi, Nadav, Wenig, Robert I., Herda, Wolf, Dietrich, Gerard
• Granted Patent: US 9,536,108 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A privacy processing system may use privacy rules to filter sensitive personal information from web session data. The privacy processing system may generate privacy profiles or privacy metadata that identifies how often the privacy rules are called, how often the privacy rules successfully complete actions, and the processing time required to execute the privacy rules. The privacy profiles may be used to detect irregularities in the privacy filtering process that may be associated with a variety of privacy filtering and web session problems.

Claims

1. A method, comprising:

generating, by a processing device, privacy metrics associated with filtering information from web session data;

generating, by the processing device, a privacy profile from the privacy metrics; and

using, by the processing device, the privacy profile to identify irregularities with the filtering of the information from the web session data.

2. The method of claim 1, wherein filtering the information from the web session data comprises applying privacy rules to the web session data.

3. The method of claim 2, wherein generating the privacy metrics comprises identifying a number of times the privacy rules are called while filtering the information.

4. The method of claim 2, wherein generating the privacy metrics comprises identifying a percentage of times the privacy rules filter the information from the web session data.

5. The method of claim 2, wherein generating the privacy metrics comprises identifying processing times required to complete the privacy rules.

6. The method of claim 1, wherein filtering the information from the web session data comprises at least one of removing, replacing, blocking, or encrypting the information.

7. The method of claim 1, further comprising:

identifying a threshold for the privacy profile; and

generating a notice when the privacy metrics exceed the threshold.

8. The method of claim 7, wherein the threshold comprises a standard deviation of the privacy profile.

9. The method of claim 1, wherein generating the privacy profile comprises:

identifying rules used for filtering the information from the web session data;

identifying the privacy metrics associated with the rules; and

periodically aggregating together the privacy metrics associated with the rules over an aggregation period; and

generating averages for the privacy metrics aggregated together over the aggregation period.

10. The method of claim 1, wherein the information comprises at least one of:

a social security number;

a password;

a credit card number;

medical information;

or

bank account information.

11. The method of claim 1, further comprising identifying the privacy metrics associated with individual web sessions.

12. The method of claim 1, further comprising identifying the privacy metrics associated with individual web pages of web sessions.

13. The method of claim 1, further comprising identifying the privacy metrics associated with different web browsers used in web sessions generating the web session data.

14. The method of claim 1, further comprising:

identifying a first Document Object Model (DOM) in the web session data associated with the identified irregularities;

identifying a second DOM in the web session data not having irregularities with the filtering; and

identifying differences between the first DOM with the second DOM.

15. An apparatus, comprising:

a processing device configured to;

apply privacy rules to web session data;

identify statistics for the privacy rules applied to the web session data; and

use the statistics to generate privacy profiles for the privacy rules applied to the web session data.

16. The apparatus of claim 15 wherein the privacy rules are configured to remove personal information from the web session data.

17. The apparatus of claim 15, wherein:

the privacy rules comprise tests and actions; and

the statistics identify the number of times the tests are called and the number of times the actions are applied to the web session data.

18. The apparatus of claim 15, wherein the statistics identify amounts of time required by the processing device to apply the privacy rules to the web session data.

19. The apparatus of claim 15, wherein the processing device is further configured to:

identify web sessions and web pages where the privacy rules are applied in the web session data; and

generate the statistics for the web sessions and web pages.

20. The apparatus of claim 15, wherein the processing device is further configured to:

identify web browsers associated with the web session data; and

generate the statistics for the web browsers.

21. The apparatus of claim 15, wherein the processing device is further configured to:

identify thresholds for the privacy profiles;

compare new statistics for the privacy rules with the thresholds for the privacy profiles; and

identify the new statistics that exceed the thresholds.

22. An apparatus, comprising:

a monitoring system configured to captured web session data during web sessions; and

a privacy processing system configured to;

filter at least some personal information from the web session data;

generate privacy metrics associated with filtering the personal information from the web session data; and

generate privacy profiles from the privacy metrics.

23. The apparatus of claim 22, wherein the privacy processing system comprises:

a privacy rule parser module configured to apply rules that filter the personal information from the web session data; and

a privacy profiler configured to aggregate the privacy metrics to generate the privacy profiles.

24. The apparatus of claim 22, wherein the privacy processing system further comprises a privacy event processor module configured to:

compare new privacy metrics for the rules applied to new web session data with the privacy profiles; and

identify the new privacy metrics that are outside of thresholds for the privacy profiles.

25. The apparatus of claim 22, wherein the privacy processing system is configured to:

use privacy rules to filter the personal information from the web session data;

identify a number of times the privacy rules are called while filtering the personal information;

identify the number of times the privacy rules filter the personal information; and

identify an amount of time required by the privacy processing system to execute the privacy rules.