Identification of protected content in e-mail messages
View Patent ↗A method of controlling distribution of content in a message sent by a message sender comprises receiving an indication from the message sender that the message is to be protected, identifying content in the message to be protected, adding the identified content to a database of protected content, and determining whether subsequently received content in a subsequently received message is associated with the identified content. A system for controlling distribution of content in a message sent by a message sender comprises a processor configured to receive an indication from the message sender that the message is to be protected, identify content in the message to be protected, add the identified content to a database of protected content, and determine whether subsequently received content in a subsequently received message is associated with the identified content.
1. A method of controlling distribution of messages by identifying protected content in the body of e-mail messages, the method comprising:
maintaining a database stored in memory, the database comprising content previously identified by a user as protected content, the protected content being associated with permission information specified by the user, the permission information specifying other users that have been authorized to access the protected content and other users that have been authorized to redistribute the protected content, wherein the protected content is not allowed outside of a private network absent an indication that both a sender and an intended recipient have been authorized to access and/or redistribute the content;
intercepting an e-mail message addressed to at least one recipient by a sender; and
executing instructions stored in memory, wherein execution of the instructions by a processor:
extracts content from the body of the intercepted e-mail message,
compares the extracted content to the protected content stored in the database in order to identify similarity between at least a portion of the extracted content and the protected content stored in the database, wherein the identified similar portion is not identical to the protected content, and wherein the comparison uses one or more detection techniques to identify the similar portion of extracted content and the one or more detection techniques include determining that the portion of extracted content is more likely to match protected content when misplaced non-alphabetic characters are present in the portion of the extracted content than when misplaced alphabetic characters are present in the portion of extracted content,
determines that the extracted content includes protected content based on the identified similarity to protected content stored in the database,
determines that the sender is authorized to redistribute the protected content and the at least one recipient is authorized to access the protected content as specified by the permission information associated with the protected content, and
allows the message to be transmitted outside of a private network behind a security appliance based on the determination that the content extracted from the body of the e-mail message includes protected content and the determination that the sender is authorized to redistribute the protected content and the at least one recipient is authorized to access the protected content.
2. The method of claim 1 , wherein the determination indicates that the sender is authorized to redistribute the message and the at least one recipient is authorized to access the protected content and wherein processing the message includes sending the e-mail message to the at least one recipient.
3. The method of claim 1 , wherein the determination indicates that the sender is unauthorized to redistribute the protected content and wherein processing the message includes blocking the sender from sending the message.
4. The method of claim 1 , wherein the determination indicates that at least one recipient is unauthorized to access the message and wherein processing the message includes blocking the recipient from receiving the message.
5. The method of claim 1 , further comprising receiving information from the sender designating at least some of the extracted content as protected content, wherein determining whether the extracted content includes protected content is further based on the sender designation.
6. The method of claim 5 , wherein the received information further comprises a list of recipients authorized to receive the protected content and wherein determining whether the at least one recipient is authorized to communicate the extracted content is based on the list of recipients.
7. The method of claim 5 , wherein the received information further comprises a list of recipients authorized to forward the protected content, and the method further comprises allowing or blocking the at least one recipient from forwarding the extracted content based on the list of recipients.
8. The method of claim 5 , further comprising adding the content designated as protected by the sender to the database of protected content.
9. The method of claim 8 , further comprising generating at least one signature based on the designated content and adding the at least one signature to the database of protected content.
10. The method of claim 1 , wherein the similarity of the extracted content to the protected content is determined by comparing at least one signature based on the extracted content to signatures based on protected content stored in the database of protected content.
11. The method of claim 1 , wherein the similarity of the extracted content to the protected content is determined by:
identifying one or more text strings from the extracted content of the e-mail message;
preprocessing the one or more text strings to obtain at least one substring; and
determining whether the at least one substring is a match or a mutation of content stored in the database of protected content.
12. The method of claim 11 , further comprising adding the determined mutation to the database of protected content.
13. The method of claim 11 , wherein the mutation comprises a semantic similarity to protected content.
14. The method of claim 11 , wherein preprocessing the one or more text strings comprises eliminating safe words from the extracted content.
15. The method of claim 11 , further comprising determining that the extracted content is protected based on the determination of whether the at least one substring is a match or a mutation of content stored in the database of protected content.
16. The method of claim 1 , wherein the similarity of the extracted content to the protected content is determined by lexicographical distancing.
17. The method of claim 16 , wherein lexicographical distancing comprises:
determining an edit distance indicating mutations between the extracted content and content stored in the database of protected content;
generating a score for the edit distance based on numbers and probabilities of the indicated mutations;
comparing the edit distance to a predetermined threshold defined by a user; and
determining that the extracted content is protected when the generated score meets the predetermined threshold.
18. The method of claim 17 , wherein determining an edit distance further comprises identifying mutations based on substitution of protected content with one or more tokens.
19. The method of claim 17 , wherein generating the score comprises weighting unexpected mutations differently than expected mutations.
20. A non-transitory computer-readable storage medium, having embodied thereon a program, the program being executable by a processor to perform a method for identifying protected content in the body of e-mail messages, the method comprising:
maintaining a database comprising content previously identified by a user as protected content, the protected content being associated with permission information specified by the user, the permission information specifying other users that have been authorized to access the protected content and other users that have been authorized to redistribute the protected content, wherein the protected content is not allowed outside of a private network absent an indication that both a sender and an intended recipient have been authorized to access and/or redistribute the content;
intercepting an e-mail message addressed to at least one recipient by a sender;
extracting content from the body of the intercepted e-mail message;
comparing the extracted content to the protected content stored in the database in order to identify similarity between at least a portion of the extracted content and the protected content stored in the database, wherein the identified similar portion is not identical to the protected content, and wherein the comparison uses one or more detection techniques to identify the similar portion of extracted content and the one or more detection techniques include determining that the portion of extracted content is more likely to match protected content when misplaced non-alphabetic characters are present in the portion of the extracted content than when misplaced alphabetic characters are present in the portion of extracted content;
determining that the extracted content includes protected content based on the identified similarity to protected content stored in the database;
determining that the sender is authorized to redistribute the protected content and the at least one recipient is authorized to access the protected content as specified by the permission information associated with the protected content; and
allowing the message to be transmitted outside of a private network behind a security appliance based on the determination that the content extracted from the body of the e-mail message includes protected content and the determination that the sender is authorized to redistribute the protected content and the at least one recipient is authorized to access the protected content.