SYSTEMS AND METHODS FOR FILE CLUSTERING, MULTI-DRIVE FORENSIC ANALYSIS AND DATA PROTECTION

• US 20160132521A1
• Filed: 11/07/2014
• Published: 05/12/2016
• Est. Priority Date: 11/07/2014
• Status: Active Grant

• Current Assignee: Semandex Networks, Inc.
• Original Assignee: Semandex Networks, Inc.
• Inventors: REININGER, Daniel J., MAKWANA, Dhananjay D., KULBERDA, Raymond William, LARSON, Eric Heath, HEARN, Timothy P.
• Granted Patent: US 9,792,289 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/152 using file content signatures, e.g. hash values
• CPC Class Codes: G06F 16/156 Query results presentation
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs

Abstract

A system and method for file clustering, multi-drive forensic analysis and protection of sensitive data. Multiple memory devices can store files. A module can extract characteristics from the stored files, identify similarities between the files based on the extracted characteristics and generate file clusters based on the identified similarities. A visual representation of the file clusters, which can be generated to show the identified similarities among the files, can be displayed by a user interface module.

Claims

1. A system comprising:

a plurality of memory devices having files stored thereon;

at least one module configured to receive the files stored on the plurality of memory devices and extract characteristics of the files stored on the plurality of memory devices;

a clustering module configured to;

receive the extracted characteristics;

identify similarities between the files stored on the plurality of memory devices based on the extracted characteristics;

generate file clusters based on the identified similarities between the files stored on the plurality of memory devices

generate a visual representations of the file clusters showing the identified similarities among the files stored on the plurality of memory devices; and

a user interface module for displaying the visual representation.

2. The system of claim 1 further including a tagging module configured to tag files based on the identified similar characteristics and further configured to tag clusters based on the file tags.

3. The system of claim 2 wherein the user interface module is configured to allow users to filter the visual representation of the file clusters based on at least one of the file tags and cluster tags.

4. The system of claim 1 wherein the characteristics include one or more of the following:

content hashes, keywords, regular expressions, and metadata.

5. The user interface module of claim 1 further configured to display a visual representation of the file clusters where a memory device appears as a node and an edge links a node to another node to illustrate the identified similar characteristics between files on the memory devices.

7. The system of claim 5 wherein the edges having a thickness representing a degree of similarity between the similar files stored on the memory devices.

8. The system of claim 7 wherein the degree of similarity between the similar files stored on the plurality of memory devices represents a number of similar files.

9. The system of claim 1 wherein the extracted characteristics comprise at least one content hash and wherein the clustering module is further configured to perform hashing functions iteratively on the files to identify a set of possible similar files thereby reducing the number of false positives.

10. The system of claim 9 wherein the clustering module configured to perform hashing functions iteratively on the files to identify a set of possible similar files is further configured to generate a term vector for each one of the set of possible similar files, wherein the term vector includes an array of terms within a file and a corresponding frequency of each term in the array in the file.

11. The system of claim 10 wherein the clustering module is further configured to perform a pairwise comparison of the term vectors for each one of the set of possible similar files.

12. The system of claim 1 wherein the number of extracted characteristics is adjustable.

13. The system of claim 1 wherein the files comprises at least one of text, images or video.

14. The system of claim 1 wherein the clustering module is further configured to identify similarities among files stored on the plurality of memory devices.

15. The system of claim 1 wherein the clustering module is further configured to identify similarities among the plurality of memory devices by identifying similarities among the files stored on the plurality of memory devices.

16. The system of claim 1 wherein the clustering module is further configured to identify similarities among files stored on one of the plurality of memory devices and a remainder of the plurality of memory devices.

17. The system of claim 1 wherein the clustering module is further configured to rank file clusters based on one or more of a score assigned to the files or at least one attribute of the files of the file clusters.

18. The system of claim 1 further comprises a master processor and a plurality of worker processors, wherein the module extracting characteristics and the clustering module being distributed on the plurality of worker processors, wherein the master processor allocates processing tasks to the plurality of worker processors.

19. The system of claim 1 wherein one of the extracted characteristics being geo-references and wherein the clustering module is further configured to generate file clusters based on the geo-references.

6. A system comprising:

a plurality of memory devices having files stored thereon;

a memory storing a reference set of files including one or more sensitivity designations based on one or more characteristics of the reference set of files; and

a processor configured to;

identify and cluster the plurality of files stored on the plurality of memory devices based on the one or more characteristics between the plurality of files and one or more files from the reference set of files,

tag the plurality of files stored on the plurality of memory devices with the same sensitivity designation as one or more of the files from the reference set,

generate a visual representation of the files stored on the plurality of memory devices showing the sensitivity designations of the files and which one of the plurality of memory devices the files are stored; and

a user interface module for displaying the visual representation.

20. The system of claim 6 wherein each file in a cluster inherits the tag of the cluster.

21. The system of claim 6 wherein sensitivity designations are based on at least one of sensitive keyword lists, regular expressions, file similarity, and content analytics.

22. The system of claim 6 wherein the processor is further configured to tag based on clustering against a reference dataset of documents with assigned sensitivity tags.

23. The system of claim 6 wherein the processor is further configured to update the visual representation when new files are added.