System and method for data mining and security policy management

• US 8,447,722 B1
• Filed: 03/25/2009
• Issued: 05/21/2013
• Est. Priority Date: 03/25/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Ahuja, Ratinder Paul Singh, Lakhani, Faizel
• Primary Examiner(s): PHILLIPS, III, ALBERT M
• Application Number:
  US12/410,875
• Time in Patent Office: 1,518 Days
• Field of Search: 707/600, 707/607
• US Class Current: 707/607
• CPC Class Codes: G06F 16/2465 Query processing support for facilitating data mining operations in structured databases
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method is provided in one example and includes generating a query for a database for information stored in the database. The information relates to data discovered through a capture system. The method further includes generating an Online Analytical Processing (OLAP) element to represent information received from the query. A rule based on the OLAP element is generated and the rule affects data management for one or more documents that satisfy the rule. In more specific embodiments, the method further includes generating a capture rule that defines items the capture system should capture. The method also includes generating a discovery rule that defines objects the capture system should register. In still other embodiments, the method includes developing a policy based on the rule, where the policy identifies how one or more documents are permitted to traverse a network.

Claims

1. A method, comprising:

filtering information contained in a plurality of tags stored in a database, the filtering based on one or more specified elements of a tag, wherein the information relates to objects discovered through a capture system, and wherein each object is associated with one of the tags, wherein each of the one or more specified elements includes one of a communication parameter, a content type, a concept, a word, and a signature;

generating an Online Analytical Processing (OLAP) element to represent the filtered information;

receiving as input one or more parameters based, at least in part, on the OLAP element, wherein each of the one or more parameters includes one of a communication parameter, a content type, a concept, a word, and a signature; and

generating a rule from the one or more parameters, wherein the rule includes an action to be performed on one or more objects identified by the one or more parameters, the one or more objects sought to be propagated through e-mail in a network environment.

2. The method of claim 1, further comprising:

generating a capture rule that defines items the capture system should capture; and

generating a discovery rule that defines objects the capture system should register.

3. The method of claim 1, further comprising:

developing a policy based on the rule, wherein the policy identifies how one or more documents are permitted to traverse a network.

4. The method of claim 3, wherein the capture system applies and enforces the policy that is based on the rule, and wherein enforcement of the policy includes prohibiting at least one of the documents from being transmitted over the network.

5. The method of claim 1, further comprising:

capturing a packet stream;

recreating a flow from the packet stream;

analyzing the flow to create at least one tag and at least one object from the flow; and

storing the at least one tag in a tag database and the at least one object in an object database.

6. The method of claim 1, wherein the filtering is part of one or more data mining activities.

7. The method of claim 1, further comprising:

updating one or more parameters for a rule or a policy; and

storing the updates in a database to be accessed by the capture system.

8. The method of claim 1, further comprising:

applying one or more filters in conjunction with one or more data mining activities before the OLAP element is generated.

9. An apparatus, comprising:

a capture system that includes a processor and the memory, the apparatus being configured to;

filter information contained in a plurality of tags stored in a database, the filtering based on one or more specified elements of a tag, wherein the information relates to objects discovered through a capture system, and wherein each object is associated with one of the tags, wherein each of the one or more specified elements includes one of a communication parameter, a content type, a concept, a word, and a signature,

generate an Online Analytical Processing (OLAP) element to represent the filtered information, and

receive one or more parameters based, at least in part, on the OLAP element, wherein each of the one or more parameters includes one of a communication parameter, a content type, a concept, a word, and a signature, wherein a rule is generated from the one or more parameters, and wherein the rule includes an action to be performed on one or more objects identified by the one or more parameters, the one or more objects sought to be propagated through e-mail in a network environment.

10. The apparatus of claim 9, wherein a policy is developed based on the rule, and wherein the policy identifies how one or more documents are permitted to traverse a network.

11. The apparatus of claim 10, wherein the capture system applies and enforces the policy that is based on the rule, and wherein enforcement of the policy includes prohibiting at least one of the documents from being transmitted over the network.

12. The apparatus of claim 9, wherein the capture system captures a packet stream, recreates a flow from the packet stream, analyzes the flow to create at least one tag and at least one object from the flow, and stores the at least one tag in a tag database and the at least one object in an object database.

13. The apparatus of claim 9, wherein the filtering is part of one or more data mining activities.

14. Logic encoded in non-transitory media for execution and when executed by a processor operable to:

filter information contained in a plurality of tags stored in a database, the filtering based on one or more specified elements of a tag, wherein the information relates to objects discovered through a capture system, and wherein each object is associated with one of the tags, wherein each of the one or more specified elements includes one of a communication parameter, a content type, a concept, a word, and a signature;

generate an Online Analytical Processing (OLAP) element to represent the filtered information;

receiving as input one or more parameters based, at least in part, on the OLAP element, wherein each of the one or more parameters includes one of a communication parameter, a content type, a concept, a word, and a signature; and

generate a rule from the one or more parameters, wherein the rule includes an action to be performed on one or more objects identified by the one or more parameters, the one or more objects that satisfy the rule.

15. The logic of claim 14, wherein the code is further operable to:

generate a capture rule that defines items the capture system should capture; and

generate a discovery rule that defines objects the capture system should register.

16. The logic of claim 14, wherein the code is further operable to:

develop a policy based on the rule, wherein the policy identifies how one or more documents are permitted to traverse a network.

17. The logic of claim 16, wherein the capture system applies and enforces the policy that is based on the rule, and wherein enforcement of the policy includes prohibiting at least one of the documents from being transmitted over the network.

18. The logic of claim 14, wherein the code is further operable to:

capture a packet stream;

recreate a flow from the packet stream;

analyze the flow to create at least one tag and at least one object from the flow; and

store the at least one tag in a tag database and the at least one object in an object database.

19. The logic of claim 14, wherein the filtering is part of one or more data mining activities.

20. The logic of claim 14, wherein the code is further operable to:

update one or more parameters for a rule or a policy; and

store the updates in a database to be accessed by the capture system.

21. The logic of claim 14, wherein the code is further operable to:

apply one or more filters in conjunction with one or more data mining activities before the OLAP element is generated.