System and method for data mining and security policy management

• US 9,313,232 B2
• Filed: 12/19/2014
• Issued: 04/12/2016
• Est. Priority Date: 03/25/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Ahuja, Ratinder, Lakhani, Faizel
• Primary Examiner(s): PHILLIPS, III, ALBERT M
• Application Number:
  US14/576,781
• Publication Number:
  US 20150106875A1
• Time in Patent Office: 480 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2465 Query processing support for facilitating data mining operations in structured databases
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method is provided in one example and includes generating a query for a database for information stored in the database. The information relates to data discovered through a capture system. The method further includes generating an Online Analytical Processing (OLAP) element to represent information received from the query. A rule based on the OLAP element is generated and the rule affects data management for one or more documents that satisfy the rule. In more specific embodiments, the method further includes generating a capture rule that defines items the capture system should capture. The method also includes generating a discovery rule that defines objects the capture system should register. In still other embodiments, the method includes developing a policy based on the rule, where the policy identifies how one or more documents are permitted to traverse a network.

Claims

1. One or more non-transitory machine-readable storage media that includes code for execution and when executed by a processor is operable to perform operations comprising:

receiving a plurality of parameters based, at least in part, on metadata information obtained from data mining one or more databases, at least one database containing tags associated with objects, wherein the data mining is to apply one or more filters to the tags of the at least one database to obtain at least a portion of the metadata information;

creating a rule associated with at least some of the parameters; and

incorporating the rule into a security policy to be used by a capture system, wherein the security policy is to control network communications captured by the capture system.

2. The one or more non-transitory machine-readable storage media of claim 1, the operations further comprising:

generating a capture rule for capturing items intended to be propagated as part of the network communications; and

generating a discovery rule for objects to be registered for future rule creations.

3. The one or more non-transitory machine-readable storage media of claim 1, the operations further comprising:

refining the security policy based on the rule, wherein the security policy identifies how one or more documents are permitted to traverse a network.

4. The one or more non-transitory machine-readable storage media of claim 1, wherein the rule includes an action to be performed on one or more objects identified by the plurality of parameters.

5. The one or more non-transitory machine-readable storage media of claim 1, wherein the tags include one or more tags of a plurality of tags in the database, the one or more tags to be selected from the plurality of tags based, at least in part, on a date range.

6. The one or more non-transitory machine-readable storage media of claim 1, wherein the metadata information includes at least one Online Analytical Processing (OLAP) element.

7. The one or more non-transitory machine-readable storage media of claim 1, wherein the rule includes at least one of one or more communication parameters, one or more content types, one or more concepts, one or more signatures, and one or more words.

8. The one or more non-transitory machine-readable storage media of claim 1, the operations further comprising:

running the rule against one or more databases to determine if the rule provides a targeted result.

9. The one or more non-transitory machine-readable storage media of claim 1, the operations further comprising:

applying the one or more filters to one or more elements of the tags.

10. The one or more non-transitory machine-readable storage media of claim 1, wherein the one or more filters are associated with a group of characteristics, the group consisting of:

a) a communication parameter;

b) a content type;

c) a concept;

d) a fingerprint; and

e) a plurality of words.

11. An administration system, comprising:

a processor;

a memory; and

logic, at least a portion of which is implemented in hardware, the logic configured to;

receive a plurality of parameters based, at least in part, on metadata information obtained from data mining one or more databases, at least one database containing tags associated with objects, wherein the data mining is to apply one or more filters to the tags of the at least one database to obtain at least a portion of the metadata information;

create a rule associated with at least some of the parameters; and

incorporate the rule into a security policy to be used by a capture system, wherein the security policy is to control network communications captured by the capture system.

12. The administration system of claim 11, wherein the logic is further configured to:

generate a capture rule for capturing items intended to be propagated as part of the network communications; and

generate a discovery rule for objects to be registered for future rule creations.

13. The administration system of claim 11, wherein the logic is to receive the plurality of parameters from a client device.

14. The administration system of claim 13, wherein the administration system is integrated with the client device.

15. The administration system of claim 11, wherein the administration system is integrated with the capture system.

16. The administration system of claim 11, wherein the logic is further configured to:

apply the one or more filters to one or more elements of the tags.

17. A method, comprising:

receiving a plurality of parameters based, at least in part, on metadata information obtained from data mining one or more databases, at least one database containing tags associated with objects, wherein the data mining is to apply one or more filters to the tags of the at least one database to obtain at least a portion of the metadata information;

creating a rule associated with at least some of the parameters; and

incorporating the rule into a security policy to be used by a capture system, wherein the security policy controls network communications captured by the capture system.

18. The method of claim 17, further comprising:

generating a capture rule for capturing items intended to be propagated as part of the network communications; and

generating a discovery rule for objects to be registered for future rule creations.

19. The method of claim 17, wherein the tags include one or more tags of a plurality of tags in the database, the one or more tags to be selected from the plurality of tags based, at least in part, on a date range.

20. The method of claim 17, wherein the rule includes at least one of:

one or more communication parameters, one or more content types, one or more concepts, one or more signatures, and one or more words.