Method and apparatus for categorizing documents containing sensitive information

• US 8,799,287 B1
• Filed: 04/06/2010
• Issued: 08/05/2014
• Est. Priority Date: 04/06/2010
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Barile, Ian, Tsibulya, Aleksey
• Primary Examiner(s): Perveen, Rehana
• Assistant Examiner(s): Hershley, Mark E
• Application Number:
  US12/755,299
• Time in Patent Office: 1,582 Days
• Field of Search: 707/690, 707/694, 707/737, 707/738, 707/740
• US Class Current: 707/738
• CPC Class Codes: G06F 16/353 into predefined classes

Abstract

A method and apparatus for determining whether a document is to be protected is described. In one embodiment, a computer system identifies a document to be categorized. The computer system then determines one or more probabilities that the document belongs to one or more of a plurality of predefined categories, the probabilities based on profiles of the predefined categories. The computer system then determines whether the probabilities indicate that the document is to be protected, and, if the document is to be protected, causes the document to be used in data loss detection.

Claims

1. A method comprising:

determining one or more probabilities that a document belongs to one or more of a plurality of predefined categories;

determining whether at least one of the one or more probabilities satisfies a first predetermined threshold;

causing the document to be used in data loss detection when at least one of the one or more probabilities satisfies the first predetermined threshold;

if at least one of the one or more probabilities does not satisfy the first predetermined threshold, determining, by a processor, whether at least one of the one or more probabilities satisfies a second predetermined threshold specific to a source of the document; and

causing the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold.

2. The method of claim 1, wherein causing the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold comprises:

receiving context data pertaining to the document; and

confirming whether the document is to be protected using the context data.

3. The method of claim 2, wherein the context data comprises at least one of sender data, recipient data, document author data, or document viewer data.

4. The method of claim 1, wherein determining one or more probabilities that a document belongs to one or more of a plurality of predefined categories comprises:

identifying a plurality of documents, each document in the plurality of documents being associated with at least one of the plurality of predefined categories; and

creating a profile for each of the plurality of predefined categories using the plurality of documents.

5. The method of claim 1, wherein causing the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold comprises:

determining whether at least one of the one or more probabilities exceeds a threshold accuracy value.

6. The method of claim 1, further comprising:

analyzing dissemination of the document; and

graphically illustrating the dissemination.

7. The method of claim 6, wherein analyzing dissemination of the document comprises:

determining an origin of the document and a timestamp associated with the origin;

identifying entities that accessed the document and timestamps associated with the accesses;

determining whether an originator of the document and the entities that accessed the document are authorized to have access to the document; and

identifying entities that have the ability to access the document.

8. The method of claim 7, wherein graphically illustrating the dissemination comprises:

graphically indicating whether the originator and the entities that accessed the uncategorized document were authorized; and

adding the entities that have the ability to access the document to the illustration of the dissemination.

9. A non-transitory computer readable storage medium that provides instructions, which when executed on a processor cause the processor to perform a method comprising:

determining one or more probabilities that a document belongs to one or more of a plurality of predefined categories;

determining whether at least one of the one or more probabilities satisfies a first predetermined threshold;

causing the document to be used in data loss detection when at least one of the one or more probabilities satisfies the first predetermined threshold;

if at least one of the one or more probabilities does not satisfy the first predetermined threshold, determining, by a the processor, whether at least one of the one or more probabilities satisfies a second predetermined threshold specific to a source of the document; and

causing the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold.

10. The non-transitory computer readable storage medium of claim 9, wherein causing the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold comprises:

receiving context data pertaining to the document; and

confirming whether the document is to be protected using the context data.

11. The non-transitory computer readable storage medium of claim 10, wherein the context data comprises at least one of sender data, recipient data, document author data, or document viewer data.

12. The non-transitory computer readable storage medium of claim 9, wherein determining one or more probabilities that a document belongs to one or more of a plurality of predefined categories, comprises:

identifying a plurality of documents, each document in the plurality of documents being associated with at least one of the plurality of predefined categories; and

creating a profile for each of the plurality of predefined categories using the plurality of documents.

13. The non-transitory computer readable storage medium of claim 9, wherein causing the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold comprises:

determining whether at least one of the one or more probabilities exceeds a threshold accuracy value.

14. The non-transitory computer readable storage medium of claim 9, wherein the method further comprises:

analyzing dissemination of the document; and

graphically illustrating the dissemination.

15. A system, comprising:

a memory; and

a processor coupled with the memory to determine one or more probabilities that a document belongs to one or more of a plurality of predefined categories,

determine whether at least one of the one or more probabilities satisfies a first predetermined threshold,

cause the document to be used in data loss detection when at least one of the one or more probabilities satisfies the first predetermined threshold,

if at least one of the one or more probabilities does not satisfy the first predetermined threshold, determine whether at least one of the one or more probabilities satisfies a second predetermined threshold specific to a source of the document, and

cause the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold.

16. The system of claim 15, wherein the processor is to cause the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold by:

receiving context data pertaining to the document; and

confirming whether the document is to be protected using the context data.

17. The system of claim 16, wherein the context data comprises at least one of sender data, recipient data, document author data, or document viewer data.

18. The system of claim 15, wherein the processor is to determine one or more probabilities that a document belongs to one or more of a plurality of predefined categories by:

identifying a plurality of categorized documents, each document in the plurality of documents being associated with at least one of the plurality of predefined categories; and

creating a profile for each of the plurality of predefined categories using the plurality of documents.

19. The system of claim 15, wherein the processor is to cause the document to be used in data loss detection when at least one of the one or more probabilities satisfies the second predetermined threshold by:

determining whether at least one of the one or more probabilities exceeds a threshold accuracy value.

20. The system of claim 15, wherein the processor is further to:

analyze dissemination of the document; and

graphically illustrate the dissemination.