Attributes of captured objects in a capture system

• US 8,463,800 B2
• Filed: 03/27/2012
• Issued: 06/11/2013
• Est. Priority Date: 10/19/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, de la Iglesia, Erik
• Primary Examiner(s): Wu, Yicun
• Application Number:
  US13/431,678
• Publication Number:
  US 20120191722A1
• Time in Patent Office: 441 Days
• Field of Search: 707/736, 707/755, 709/223, 709/224, 706/47, 706/48
• US Class Current: 707/755
• CPC Class Codes: G06F 16/38 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Regular expressions used for searching for patterns in captured objects can be grouped into attributes. Such attributes can be associated with captured objects using tags stored in a database. In one embodiment, the present invention includes capturing an object being transmitted over a network, and determining that a regular expression appears in the object, the regular expression belonging to a group of one or more regular expressions associated with an attribute. If a regular expression associated with the attribute is found in the object, then an attribute field of a tag containing metadata related to the captured object is set to indicate the presence of the attribute in the captured object. The presence of the attribute in the captured object can now be determined from the tag, which can be stored in a database.

Claims

1. A method to be executed by a processor in an electronic environment, comprising:

generating an attribute index for an object in a network environment;

inserting the attribute index into a tag associated with the object, wherein the attribute index indicates the presence, in the object, of a portion of a set of attributes;

storing the tag with a plurality of other tags, wherein each tag includes a corresponding attribute index and is associated with a corresponding object;

receiving a search query comprising search attributes, wherein the search attributes are included in another portion of the set of attributes;

conducting a first search of the attribute index of each of the stored tags for the search attributes; and

eliminating a portion of the objects from the first search, wherein the portion of the objects do not include the search attributes.

2. The method of claim 1, wherein the generating the attribute index comprises:

extracting a text content in the object;

conducting a second search of the text content for an attribute in the set of attributes;

setting an index bit corresponding to the attribute in the attribute index if the attribute is found in the text content, wherein the attribute index includes a plurality of index bits corresponding to attributes in the set of attributes; and

repeating the second search and the setting the index bit for all attributes in the set of attributes.

3. The method of claim 2, wherein each attribute in the set of attributes is associated with one or more distinct regular expressions, and wherein if one of the regular expressions associated with the attribute is found in the text content, eliminating the other regular expressions associated with the attribute from the second search.

4. The method of claim 3, wherein text content is extracted and provided to a parser to identify the regular expressions in the object.

5. The method of claim 4, wherein the parser accesses a regular expression table that includes a list of configured regular expressions of interest for search querying and wherein the regular expression table associates each of the regular expressions it contains with at least one attribute in the set of attributes.

6. The method of claim 2, wherein the index bit corresponding to the attribute is determined from an attribute table containing a mapping of attributes to index bits.

7. The method of claim 1, wherein the object is either a Word document, an e-mail, a spreadsheet, or a PDF having text that can represent a pattern expressed as a regular expression.

8. The method of claim 1, wherein the set of attributes include:

a credit card number, a credit card number attribute, a phone number attribute, an email addresses attribute, a bank routing number attribute, a social security number attribute, a confidentiality marker attribute, a web site attribute, an executive officers list attribute, a medical condition attribute, a medical diagnoses attribute, a confidential project name attribute, and a salary or compensation attribute.

9. The method of claim 1, further comprising:

determining a content type of the object; and

inserting the content type into a content field associated with the tag.

10. An apparatus, comprising:

a processor;

a memory for storing data and configured to be accessed by the processor, wherein the memory and the processor co-operate such that the apparatus is configured for;

generating an attribute index for an object in a network environment;

inserting the attribute index into a tag associated with the object, wherein the attribute index indicates the presence, in the object, of a portion of a set of attributes;

storing the tag with a plurality of other tags, wherein each tag includes a corresponding attribute index and is associated with a corresponding object;

receiving a search query comprising search attributes, wherein the search attributes are included in another portion of the set of attributes;

conducting a first search of the attribute index of each of the stored tags for the search attributes; and

eliminating a portion of the objects from the first search, wherein the portion of the objects do not include the search attributes.

11. The apparatus of claim 10, wherein the generating the attribute index comprises:

extracting a text content in the object;

conducting a second search of the text content for an attribute in the set of attributes;

setting an index bit corresponding to the attribute in the attribute index if the attribute is found in the text content, wherein the attribute index includes a plurality of index bits corresponding to attributes in the set of attributes; and

repeating the second search and the setting the index bit for all attributes in the set of attributes.

12. The apparatus of claim 10, wherein the set of attributes include:

a credit card number, a credit card number attribute, a phone number attribute, an email addresses attribute, a bank routing number attribute, a social security number attribute, a confidentiality marker attribute, a web site attribute, an executive officers list attribute, a medical condition attribute, a medical diagnoses attribute, a confidential project name attribute, and a salary or compensation attribute.

13. Logic encoded in one or more non-transitory tangible media that includes code for execution and when executed by a processor operable to perform operations comprising:

generating an attribute index for an object in a network environment;

inserting the attribute index into a tag associated with the object, wherein the attribute index indicates the presence, in the object, of a portion of a set of attributes;

storing the tag with a plurality of other tags, wherein each tag includes a corresponding attribute index and is associated with a corresponding object;

receiving a search query comprising search attributes, wherein the search attributes are included in another portion of the set of attributes;

conducting a first search of the attribute index of each of the stored tags for the search attributes; and

eliminating a portion of the objects from the first search, wherein the portion of the objects do not include the search attributes.

14. The logic of claim 13, wherein the generating the attribute index comprises:

extracting a text content in the object;

conducting a second search of the text content for an attribute in the set of attributes;

setting an index bit corresponding to the attribute in the attribute index if the attribute is found in the text content, wherein the attribute index includes a plurality of index bits corresponding to attributes in the set of attributes; and

repeating the second search and the setting the index bit for all attributes in the set of attributes.

15. The logic of claim 14, wherein each attribute in the set of attributes is associated with one or more distinct regular expressions, and wherein if one of the regular expressions associated with the attribute is found in the text content, eliminating the other regular expressions associated with the attribute from the second search.

16. The logic of claim 15, wherein text content is extracted and provided to a parser to identify the regular expressions in the object.

17. The logic of claim 16, wherein the parser accesses a regular expression table that includes a list of configured regular expressions of interest for search querying and wherein the regular expression table associates each of the regular expressions it contains with at least one attribute in the set of attributes.

18. The logic of claim 14, wherein the index bit corresponding to the attribute is determined from an attribute table containing a mapping of attributes to index bits.

19. The logic of claim 13, wherein the object is a Word document, an e-mail, a spreadsheet, or a PDF having text that can represent a pattern expressed as a regular expression.

20. The logic of claim 13, wherein the set of attributes include:

a credit card number, a credit card number attribute, a phone number attribute, an email addresses attribute, a bank routing number attribute, a social security number attribute, a confidentiality marker attribute, a web site attribute, an executive officers list attribute, a medical condition attribute, a medical diagnoses attribute, a confidential project name attribute, and a salary or compensation attribute.