Inferring content sensitivity from partial content matching
View Patent ↗Monitored content is analyzed to determine full and partial matches to previously classified content. Monitored content matching previously classified public content is classified as public, even if the monitored content is also found to match previously classified private content. In other words, public classification “overrides” potentially private classification. Monitored content matching only previously classified private content is classified as private. All remaining otherwise unclassified monitored content is classified as unknown. Monitored content is analyzed with respect to a session. If any content in a session is private, then the session is classified as private. If all content in a session is public, then the session is classified as public. Otherwise, the session is classified as unknown. In a related aspect, a set of policies are searched for a first match in part according to the classification, and a designated action taken if the first match is found.
1. A method comprising:
determining content of a session of observed network data;
determining, at least in part via a processor, if the session content is a subset of a first set of content associated with a first classification, and if so, then classifying the session as being of the first classification; and
performing a first action if the session is classified as being of the first classification, and performing a second action otherwise.
2. The method of claim 1 , further comprising:
if the session is not classified as being of the first classification, then classifying the session as being of a second classification.
3. The method of claim 2 , wherein:
the first classification is a public classification;
the second classification is a private classification;
the first action is no action; and
the second action comprises a flagging action.
4. The method of claim 3 , wherein:
the second action further comprises writing information to a log.
5. A method comprising the steps of:
determining content of a session of observed network data;
determining, at least in part via a processor, if the session content is a subset of a first set of content associated with a first classification, and if so, then classifying the session as being of the first classification;
determining if the session content is a subset of a second set of content associated with a second classification, and if so, then classifying the session as being of a second classification;
if the session is not of the first classification and the session is not of the second classification, then classifying the session as being of a third classification; and
performing a first action if the session is classified as being of the first classification, and performing a second action otherwise.
6. The method of claim 5 , wherein:
the first classification is a public classification;
the second classification is a private classification;
the first action is no action; and
the second action comprises a flagging action.
7. The method of claim 6 , wherein:
the second action further comprises writing information to a log.
8. The method of claim 5 , wherein:
the second action comprises
performing a third action if the session is classified as being of the second classification, and performing a fourth action otherwise.
9. The method of claim 8 , wherein:
the first classification is a public classification;
the second classification is a private classification;
the third classification is an unknown classification;
the first action is no action;
the third action comprises a first flagging action; and
the fourth action comprises a second flagging action.
10. The method of claim 5 , wherein:
the act of determining content of the session of observed network data comprises linguistically analyzing the session of observed network data.
11. The method of claim 10 , wherein:
the act of linguistically analyzing the session of observed network data comprises producing a set of data keys corresponding to the session content.
12. The method of claim 11 , wherein:
the session content is a subset of the first set of content if all of the data keys are present in a first set of keys associated with the first set of content.
13. The method of claim 12 , wherein:
the session content is a subset of the second set of content if all of the data keys are present in a second set of keys associated with the second set of content.
14. The method of claim 13 , wherein:
at least a portion of the first set of keys are present in the second set of keys.
15. The method of claim 10 , wherein:
the act of linguistically analyzing the session of observed network data comprises tokenizing.
16. The method of claim 15 , wherein:
the act of tokenizing comprises
identifying significant words, and
discarding any combination of white space, punctuation, articles, and conjunctions.
17. The method of claim 15 , wherein:
the act of linguistically analyzing the session of observed network data further comprises splitting results of the tokenizing into non-overlapping sections.
18. The method of claim 17 , wherein:
the act of producing a set of data keys comprises computing a hash function for each section, and the data keys comprise results of the hash function computation.
19. The method of claim 15 , wherein:
the act of linguistically analyzing the session of observed network data further comprises splitting results of the tokenizing into overlapping sections.
20. The method of claim 19 , wherein:
the overlapping sections are formed by advancing one token at a time.
21. The method of claim 19 , wherein:
the overlapping sections are formed by advancing more than one token at a time.
22. A method comprising:
dividing a session of observed network data into sections;
classifying, at least in part via a processor, each section selectively as being one of a group of classifications comprising a first and a second classification;
if at least one of the sections is classified as being of the second classification, then classifying the session as being of the second classification;
if none of the sections are classified as being of the second classification, and all of the sections are classified as being of the first classification, then classifying the session as being of the first classification; and
wherein the act of classifying each section comprises
if content of the respective section is a subset of content designated as the first classification, then classifying the respective section as being of the first classification,
if the respective section content is not a subset of content designated as the first classification, and the respective section content is a subset of content designated as the second classification, then classifying the respective section as being of the second classification.
23. The method of claim 22 , wherein:
the group of classifications comprises a third classification;
the act of classifying each section further comprises
if the respective section is not a subset of content designated as the first classification, and the respective section is not a subset of content designated as the second classification, then classifying the respective section as being of the third classification.
24. The method of claim 23 , further comprising:
if none of the sections are classified as being of the first classification, and none of the sections are classified as being of the second classification, then classifying the session as being of the third classification.
25. The method of claim 23 , wherein:
the first classification is a public classification;
the second classification is a private classification; and
the third classification is an unknown classification.
26. The method of claim 22 , further comprising:
performing a first action if the session is classified as being of the first classification, and performing a second action otherwise.
27. The method of claim 26 , wherein:
the first classification is a public classification;
the second classification is a private classification;
the first action is no action; and
the second action comprises a flagging action.
28. The method of claim 27 , wherein:
the second action further comprises writing information to a log.
29. A method comprising:
dividing a session of observed network data into sections;
classifying, at least in part via a processor, each section selectively as being one of a first, second, and third classification;
combining the classification of each of the sections into an overall session classification; and
wherein the act of classifying each section comprises
if content of the respective section is a subset of content designated as the first classification, then classifying the respective section as being of the first classification,
if the respective section content is not a subset of content designated as the first classification, and the respective section content is a subset of content designated as the second classification, then classifying the respective section as being of the second classification, and
if the respective section is not classified as being of the first classification and the respective section is not classified as being of the second classification, then classifying the respective section as being of the third classification.
30. The method of claim 29 , wherein:
the act of combining the classification of each of the sections comprises
if at least one of the sections is classified as being of the second classification, then classifying the session as being of the second classification;
if none of the sections are classified as being of the second classification, and all of the sections are classified as being of the first classification, then classifying the session as being of the first classification; and
if none of the sections are classified as being of the second classification, and at least one of the sections is not classified as being of the first classification, then classifying the session as being of the third classification.
31. The method of claim 30 , wherein:
the first classification is a public classification;
the second classification is a private classification; and
the third classification is an unknown classification.
32. A content appliance comprising:
a processor adapted to execute software;
a network interface coupled to the processor; and
wherein the software comprises functions enabling
observing a session of network traffic via the network interface,
analyzing content of the observed session of network traffic to determine if it is a subset of a first set of content associated with a first classification, and if so, then classifying the observed session content as being of the first classification, and otherwise classifying the observed session content as being of a second classification, and
performing a first action if the observed session content is classified as being of the first classification, and performing a second action otherwise.
33. The content appliance of claim 32 , wherein:
the first classification is a public classification;
the second classification is a private classification;
the first action is no action; and
the second action comprises a flagging action.
34. The content appliance of claim 33 , wherein:
the second action further comprises writing information to a log.
35. The content appliance of claim 32 , further comprising:
a hardware accelerator adapted to improve performance; and
wherein the analyzing content of the observed session of network traffic is accelerated by use of the hardware accelerator.
36. The content appliance of claim 32 , wherein:
the analyzing content of the observed session of network traffic comprises linguistically analyzing the observed session of network traffic.
37. The content appliance of claim 36 , wherein:
the linguistically analyzing the observed session of network traffic comprises producing a set of traffic keys corresponding to the observed session content.
38. The content appliance of claim 37 , wherein:
the observed session content is a subset of the first set of content if all of the traffic keys are present in a first set of keys associated with the first content.
39. The content appliance of claim 38 , further comprising:
storage coupled to the processor; and
wherein the first set of keys are stored in the storage.
40. The content appliance of claim 37 , wherein:
the producing a set of traffic keys comprises tokenizing the observed session of network traffic.
41. The content appliance of claim 40 , wherein:
the tokenizing the observed session of network traffic comprises
identifying significant words, and
discarding any combination of white space, punctuation, articles, and conjunctions.
42. The content appliance of claim 40 , wherein:
the producing a set of traffic keys further comprises splitting results of the tokenizing into non-overlapping sections.
43. The content appliance of claim 42 , wherein:
the producing a set of traffic keys further comprises computing a hash function for each section, and the traffic keys include results of the hash function computation.
44. A content appliance comprising:
a processor adapted to execute software;
a network interface coupled to the processor; and
wherein the software comprises functions enabling
observing a session of network traffic via the network interface,
analyzing content of the observed session of network traffic to determine if it is a subset of a first set of content associated with a first classification, and if so, then classifying the observed session content as being of the first classification, and
performing a first action if the observed session content is classified as being of the first classification, and performing a second action otherwise.
45. The content appliance of claim 44 , wherein:
the software further comprises functions enabling
analyzing, if the observed session content is not classified as being of the first classification, the observed session content to determine if it is a subset of a second set of content associated with a second classification, and if so, then classifying the observed session content as being of the second classification.
46. The content appliance of claim 45 , wherein:
the software further comprises functions enabling
classifying the observed session content as being of a third classification, if it is not classified as being of the first classification and if it is not classified as being of the second classification.
47. The content appliance of claim 46 , wherein:
the first classification is a public classification;
the second classification is a private classification;
the first action is no action; and
the second action comprises a flagging action.
48. The content appliance of claim 47 , wherein:
the second action further comprises writing information to a log.
49. The content appliance of claim 47 , wherein:
the second action comprises
performing a third action if the observed session content is classified as being of the second classification, and performing a fourth action otherwise.
50. The content appliance of claim 49 , wherein:
the first classification is a public classification;
the second classification is a private classification;
the third classification is an unknown classification;
the first action is no action;
the third action comprises a first flagging action; and
the fourth action comprises a second flagging action.
51. The content appliance of claim 44 , wherein:
the analyzing content of the observed session of network traffic comprises linguistically analyzing the observed session of network traffic.
52. The content appliance of claim 51 , wherein:
the linguistically analyzing the observed session of network traffic comprises producing a set of traffic keys corresponding to the observed session content.
53. The content appliance of claim 52 , wherein:
the observed session content is a subset of the first set of content if all of the traffic keys are present in a first set of keys associated with the first content.
54. The content appliance of claim 53 , wherein:
the observed session content is a subset of the second set of content if all of the traffic keys are present in a second set of keys associated with the second content.
55. The content appliance of claim 54 , wherein:
at least a portion of the first set of keys are present in the second set of keys.