Method and apparatus for generating privacy profiles

• US 9,536,108 B2
• Filed: 10/23/2012
• Issued: 01/03/2017
• Est. Priority Date: 10/23/2012
• Status: Active Grant

• Current Assignee: Acoustic, L.P.
• Original Assignee: International Business Machines Corporation
• Inventors: Powell, Travis Spence, Caspi, Nadav, Wenig, Robert I., Herda, Wolf, Dietrich, Gerard
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): VU, PHY ANH TRAN
• Application Number:
  US13/658,155
• Publication Number:
  US 20140115712A1
• Time in Patent Office: 1,533 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A privacy processing system may use privacy rules to filter sensitive personal information from web session data. The privacy processing system may generate privacy profiles or privacy metadata that identifies how often the privacy rules are called, how often the privacy rules successfully complete actions, and the processing time required to execute the privacy rules. The privacy profiles may be used to detect irregularities in the privacy filtering process that may be associated with a variety of privacy filtering and web session problems.

Claims

1. A method, comprising:

generating, by a processing device, privacy metrics associated with filtering information from web session data;

generating, by the processing device, a privacy profile from the privacy metrics, wherein generating the privacy profile comprises;

identifying rules used for filtering the information from the web session data;

identifying the privacy metrics associated with the rules;

periodically aggregating together the privacy metrics associated with the rules over an aggregation period; and

generating averages for the privacy metrics aggregated together over the aggregation period; and

using, by the processing device, the privacy profile to identify irregularities with the filtering of the information from the web session data;

wherein generating the privacy metrics comprises identifying a number of times the rules are called while filtering the information or a percentage of times the rules filter the information from the web session data.

2. The method of claim 1, wherein filtering the information from the web session data comprises applying the rules to the web session data.

3. The method of claim 2, wherein generating the privacy metrics consists of identifying a number of times the rules are called while filtering the information.

4. The method of claim 2, wherein generating the privacy metrics consists of identifying a percentage of times the rules filter the information from the web session data.

5. The method of claim 2, wherein generating the privacy metrics comprises identifying processing times required to complete the rules.

6. The method of claim 1, further comprising:

identifying a threshold for the privacy profile; and

generating a notice when privacy metrics associated with additional filtering of information exceed the threshold.

7. The method of claim 6, wherein the threshold comprises a standard deviation of the privacy profile.

8. The method of claim 1, wherein the information comprises at least one of:

a social security number;

a password;

a credit card number;

medical information;

or

bank account information.

9. The method of claim 1, further comprising identifying the privacy metrics associated with individual web sessions.

10. The method of claim 1, further comprising identifying the privacy metrics associated with individual web pages of web sessions.

11. The method of claim 1, further comprising identifying the privacy metrics associated with different web browsers used in web sessions generating the web session data.

12. The method of claim 1, further comprising:

identifying a first Document Object Model (DOM) in the web session data associated with the identified irregularities;

identifying a second DOM in the web session data not having irregularities with the filtering; and

identifying differences between the first DOM with the second DOM.

13. An apparatus, comprising:

a processor; and

a memory, wherein the memory stores executable instructions, which when executed by the processor, cause the processor to

apply privacy rules to web session data, wherein the privacy rules comprise tests and actions;

identify statistics for the privacy rules applied to the web session data wherein the statistics identify a number of times the tests are called and a number of times the actions are applied to the web session data, or amounts of time required by the processing device to apply the privacy rules to the web session data;

use the statistics to generate privacy profiles for the privacy rules, wherein the privacy profiles indicate expected operational characteristics of the privacy rules; and

identify applications of the privacy rules having operational characteristics that deviate from the expected operational characteristics indicated by the privacy profiles.

14. The apparatus of claim 13 wherein the privacy rules are configured to remove personal information from the web session data.

15. The apparatus of claim 13, wherein:

the statistics identify a number of times the tests are called and a number of times the actions are applied to the web session data.

16. The apparatus of claim 13, wherein the statistics identify amounts of time required by the processing device to apply the privacy rules to the web session data.

17. The apparatus of claim 13, wherein the executable instructions, which when executed by the processor, further cause the processor to:

identify web sessions and web pages where the privacy rules are applied in the web session data; and

generate the statistics for the web sessions and web pages.

18. The apparatus of claim 13, wherein the executable instructions, which when executed by the processor further cause the processor to:

identify web browsers associated with the web session data; and

generate the statistics for the web browsers.

19. The apparatus of claim 13, wherein the executable instructions, which when executed by the processor further cause the processor to identify thresholds for the privacy profiles, wherein the identified applications have operational characteristics that exceed the thresholds.

20. The apparatus of claim 13, wherein the executable instructions, which when executed by the processor, further cause the processor to select the privacy rules from a plurality of privacy rules for filtering private information from the web session data based on web pages included in the web session data.

21. An apparatus, comprising:

a privacy processor configured to;

receive web session data captured during web sessions;

filter, based on rules used for filtering information from the web session data, at least some personal information from the web session data;

generate privacy metrics associated with filtering the personal information from the web session data wherein generating the privacy metrics comprises identifying a number of times the rules are called while filtering the personal information or a percentage of times the rules filter the personal information from the web session data; and

generate privacy profiles from the privacy metrics, wherein generating the privacy profile comprises;

aggregating the privacy metrics over an aggregation period; and

averaging the privacy metrics to generate operational characteristics of the filtering over the aggregation period; and

a memory device configured to store the filtered web session data.

22. The apparatus of claim 21, wherein the privacy processor is further configured to apply rules that filter the personal information from the web session data.

23. The apparatus of claim 22, wherein the privacy processor is further configured to:

compare new privacy metrics for the rules applied to new web session data with the privacy profiles; and

identify the new privacy metrics that are outside of thresholds for the privacy profiles.

24. The apparatus of claim 21, wherein the privacy processor is configured to:

use the rules to filter the personal information from the web session data;

identify a number of times the rules are called while filtering the personal information;

identify the number of times the rules filter the personal information; and

identify an amount of time required by the privacy processor to execute the rules.