Personal identifiable information (PII) theft detection and remediation system and method
View Patent ↗Malicious code detected on a host computer system is remediated. Further, upon a determination that the user's personal identifiable information (PII) was previously exposed to the malicious code, the user is notified that the user may be a victim of theft of the user's personal identifiable information. The notification contains sufficient information for the user to take proactive steps to reduce the consequences of the personal identifiable information theft such as to contact the user's credit card company to prevent or minimize any loss associated with the personal identifiable information theft.
1. A computer-implemented method comprising:
receiving configuration information from a user, the configuration information indicating specific personal identifiable information to be protected, the specific personal identifiable information being of the user;
determining that transmitted network content includes personal identifiable information included within the specific information previously received as configuration information from the user, the personal identifiable information within the transmitted network content being transmitted personal identifiable information, the transmitted personal identifiable information being formed of a critical portion and a noncritical portion, wherein the critical portion is a minimum amount of information necessary to identify the specific information previously received;
creating a transaction record that identifies the critical portion of the transmitted personal identifiable information and that identifies at least one of a time that the personal identifiable information was transmitted and an application responsible for transmitting the personal identifiable information;
storing the transaction record and discarding the noncritical portion of the transmitted personal identifiable information;
detecting malicious code, wherein the malicious code is present on a host computer system responsible for transmitting the personal identifiable information, wherein detecting malicious code comprises determining whether the malicious code is of a type that steals personal information;
determining, as a result of determining that the malicious code is of a type that steals personal information, that the critical portion of the transmitted personal identifiable information was exposed to the malicious code by querying the transaction record, wherein the determination is made by at least one of:
determining if the time that the personal identifiable information was transmitted falls within a possible infection time period of when the host computer system may have been infected with the malicious code; and
determining if the malicious code is the application identified by the transaction record as being responsible for transmitting the personal identifiable information; and
providing, as a result of determining that the malicious code is of a type that steals personal information, a personal identifiable information (PII) theft notification to the user, on the host computing system.
2. The computer-implemented method of claim 1 further comprising remediating the malicious code.
3. The computer-implemented method of claim 1 wherein determining that transmitted network content includes personal identifiable information comprises monitoring received network content for a personal identifiable information request.
4. The computer-implemented method of claim 3 wherein determining that transmitted network content includes personal identifiable information comprises determining that the transmitted network content is transmitted in response to the personal identifiable information request.
5. The computer-implemented method of claim 1 wherein determining that transmitted network content includes personal identifiable information comprises determining that a format of the transmitted network content matches a format of the personal identifiable information.
6. The computer-implemented method of claim 1 wherein determining that transmitted network content includes personal identifiable information comprises determining that the transmitted network content matches stored personal identifiable information input by a user.
7. The computer-implemented method of claim 1 wherein the personal identifiable information comprises one or more of a user's name, an account number, a password, a credit card number, a social security number, and a bank account number.
8. A computer-program product comprising a tangible, non-transitory computer readable storage medium containing computer program code comprising a personal identifiable information theft detection and remediation application comprising:
a personal identifiable information (PII) content analysis engine for receiving configuration information from a user, the configuration information indicating specific personal identifiable information to be protected, the specific personal identifiable information being of the user, the content analysis engine further for determining that transmitted network content includes personal identifiable information included within the specific information previously received as configuration information from the user, the personal identifiable information within the transmitted network content being transmitted personal identifiable information, the transmitted personal identifiable information being formed of a critical portion and a noncritical portion, wherein the critical portion is a minimum amount of information necessary to identify the specific information previously received;
a personal identifiable information (PIO logger for creating a transaction record that identifies the critical portion of the transmitted personal identifiable information and that identifies at least one of a time that the personal identifiable information was transmitted and an application responsible for transmitting the personal identifiable information;
a transaction record store for storing the transaction record and discarding the noncritical portion of the transmitted personal identifiable information;
a malicious code identification and remediation component for detecting malicious code, wherein the malicious code is present on a host computer system responsible for the transmission of the personal identifiable information, wherein detecting malicious code comprises determining whether the malicious code is of a type that steals personal information;
a personal identifiable information (PIO theft remediation engine and user interface for determining, as a result of determining that the malicious code is of a type that steals personal information, that the critical portion of the transmitted personal identifiable information was exposed to the malicious code by querying the transaction record store, wherein the determination is made by at least one of:
determining if the time that the personal identifiable information was transmitted falls within a possible infection time period of when the host computer system may have been infected with the malicious code; and
determining if the malicious code is the application identified by the transaction record as being responsible for transmitting the personal identifiable information; and
wherein the PII theft remediation engine and user interface is further for providing, as a result of determining that the malicious code is of a type that steals personal information, a personal identifiable information (PIO theft notification to the user, on the host computing system.
9. The computer-program product of claim 8 wherein said personal identifiable information theft detection and remediation application further comprises:
a received network content monitoring component for monitoring received network content for a personal identifiable information request.
10. The computer-program product of claim 8 wherein the personal identifiable information theft detection and remediation application further comprises:
a personal identifiable information (PII) vault for storing a user's personal identifiable information.