System and method for data mining and security policy management

• US 8,918,359 B2
• Filed: 05/16/2013
• Issued: 12/23/2014
• Est. Priority Date: 03/25/2009
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Ahuja, Ratinder, Lakhani, Faizel
• Primary Examiner(s): PHILLIPS, III, ALBERT M
• Application Number:
  US13/896,210
• Publication Number:
  US 20130254838A1
• Time in Patent Office: 586 Days
• Field of Search: 707/607
• US Class Current: 707/607
• CPC Class Codes: G06F 16/2465 Query processing support for facilitating data mining operations in structured databases
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method is provided in one example and includes generating a query for a database for information stored in the database. The information relates to data discovered through a capture system. The method further includes generating an Online Analytical Processing (OLAP) element to represent information received from the query. A rule based on the OLAP element is generated and the rule affects data management for one or more documents that satisfy the rule. In more specific embodiments, the method further includes generating a capture rule that defines items the capture system should capture. The method also includes generating a discovery rule that defines objects the capture system should register. In still other embodiments, the method includes developing a policy based on the rule, where the policy identifies how one or more documents are permitted to traverse a network.

Claims

1. A method, comprising:

communicating a plurality of parameters from a client device, wherein the plurality of parameters are based, at least in part, on metadata information obtained from data mining one or more databases, at least one database including tags associated with objects, wherein the data mining includes applying one or more filters to the tags of the at least one database to obtain at least a portion of the metadata information, wherein the one or more filters are applied to one or more elements, respectively, of the tags;

creating a rule associated with at least some of the parameters; and

incorporating the rule into a security policy to be used by the client device and one or more additional client devices, wherein the security policy controls network communications involving the client device and the one or more additional client devices.

2. The method of claim 1, further comprising:

generating a capture rule for capturing items intended to be propagated as part of the network communications; and

generating a discovery rule for objects to be registered for future rule creations.

3. The method of claim 1, further comprising:

refining the security policy based on the rule, wherein the security policy identifies how one or more documents are permitted to traverse a network.

4. The method of claim 1, wherein the rule includes an action to be performed on one or more objects identified by the plurality of parameters.

5. The method of claim 1, wherein the plurality of parameters are based, in part, on textual information.

6. The method of claim 1, wherein the metadata information includes at least one Online Analytical Processing (OLAP) element.

7. The method of claim 1, wherein the one or more filters are associated with a group of characteristics, the group consisting of:

a) a communication parameter;

b) a content type;

c) a concept;

d) a fingerprint; and

e) a plurality of words.

8. The method of claim 1, further comprising:

updating, by the client device, one or more parameters for a new rule; and

storing the new rule in a database to be accessed by the additional client devices.

9. The method of claim 1, further comprising:

running the rule against one or more databases to determine if the rule provides a targeted result.

10. The method of claim 1, further comprising:

identifying at least one pattern from the metadata information, wherein the at least one pattern is used in formulating the rule.

11. A client device, comprising:

a processor; and

a memory, wherein the client device is configured for;

communicating a plurality of parameters from a client device, wherein the plurality of parameters are based, at least in part, on metadata information to be obtained from data mining one or more databases, at least one database including tags associated with objects, wherein the data mining includes applying one or more filters to the tags of the at least one database to obtain at least a portion of the metadata information, wherein the one or more filters are applied to one or more elements, respectively, of the tags;

creating a rule associated with at least some of the parameters; and

incorporating the rule into a security policy to be used by the client device and one or more additional client devices, wherein the security policy is to control network communications involving the client device and the one or more additional client devices.

12. The client device of claim 11, wherein the client device is further configured for:

generating a capture rule for capturing items intended to be propagated as part of the network communications; and

generating a discovery rule for objects to be registered for future rule creations.

13. The client device of claim 11, wherein the client device is further configured for:

refining the security policy based on the rule, wherein the security policy identifies how one or more documents are permitted to traverse a network.

14. The client device of claim 11, wherein the rule includes an action to be performed on one or more objects identified by the plurality of parameters.

15. The client device of claim 11, wherein the plurality of parameters are based, in part, on textual information.

16. One or more non-transitory tangible media that includes code for execution and when executed by a processor operable to perform operations comprising:

communicating a plurality of parameters from a client device, wherein the plurality of parameters are based, at least in part, on metadata information to be obtained from data mining one or more databases, at least one database including tags associated with objects, wherein the data mining includes applying one or more filters to the tags of the at least one database to obtain at least a portion of the metadata information, wherein the one or more filters are applied to one or more elements, respectively, of the tags;

creating a rule associated with at least some of the parameters; and

incorporating the rule into a security policy to be used by the client device and one or more additional client devices, wherein the security policy is to control network communications involving the client device and the one or more additional client devices.

17. The media of claim 16, the operations further comprising:

generating a capture rule for capturing items intended to be propagated as part of the network communications; and

generating a discovery rule for objects to be registered for future rule creations.

18. The media of claim 16, the operations further comprising:

refining the security policy based on the rule, wherein the security policy identifies how one or more documents are permitted to traverse a network.

19. The media of claim 16, wherein the rule includes an action to be performed on one or more objects identified by the plurality of parameters.

20. The media of claim 16, wherein the plurality of parameters are based, in part, on textual information.