Granted Patent B1

US 9,552,272 · App. 13/194,741 · Granted Jan 24, 2017

Abstract

Claims (78)

1. A method comprising:

intercepting, by a processing device executing a first application, a method call of a log message originating from a second application at runtime, the log message containing information to be stored in a log data, the method call being derived from application source code of the second application;

determining whether the log message is a simple message or a composite message, wherein a composite message contains a plurality of objects;

when the message is a simple message, identifying, after intercepting the method call, sensitive information in the log message without tagging the sensitive information as sensitive, the identifying comprising:

finding in the log message a set of data comprising a format that matches a sensitive data pattern,

validating the found set of data to eliminate false positives, and

determining that the found set of data does not contain data in a format that matches any of a plurality of exceptional case data patterns;

when the message is a composite message, performing a recursive algorithm to examine each of the objects of the composite message, wherein the performing comprises:

determining whether the object contains a set of data comprising a format that matches a sensitive data pattern,

when the set of data is determined to comprise the format that matches a sensitive data pattern, validating the determined set of data to eliminate false positives, and

determining that the set of data does not contain data in a format that matches any of a plurality of exceptional case data patterns;

modifying the log message to protect the sensitive information; and

causing the modified log message to be logged in the log data.

2. The method of claim 1 , wherein the sensitive information comprises one or more of a credit card number, a social security number, an account number, an employee number, a customer or patient number, an IP address, a driver license number, a license plate number, a password, a telephone number, a name, a username, or a birthdate.

3. The method of claim 1 , wherein identifying sensitive information in the log message comprises:

storing a plurality of sensitive data patterns for sensitive information and the plurality of exceptional case data patterns for exceptional cases;

finding in the log message one or more sets of data comprising the format that matches any of the plurality of sensitive data patterns;

validating at least one found set of data is not the false positive by using one or more sensitive data validators; and

determining that the at least one validated set of data does not contain data in a format that matches any of the plurality of exceptional case data patterns.

4. The method of claim 1 , wherein modifying the log message to protect the sensitive information comprises at least one of removing the sensitive information, masking the sensitive information, or redacting the sensitive information to create the protected information.

5. The method of claim 1 , wherein the modified log message comprises a line number of application source code that generated the log message at runtime.

6. The method of claim 1 , wherein the log message is a composite message comprising at least one computer programming class object and at least one simple message comprising a string.

7. The method of claim 6 , wherein:

modifying the log message to protect the sensitive information comprises at least one of removing the sensitive information, masking the sensitive information, or redacting the sensitive information to create the protected information; and

creating at least one new class object to be logged in the log data, the new class object comprising a new log message having the protected information.

8. A system comprising:

a memory; and

a hardware processing device, coupled with the memory, the hardware processing device to:

intercept, by the hardware processing device executing a first application, a method call of a log message originating from a second application at runtime, the log message containing information to be stored in a log data, the method call being derived from application source code of the second application;

determine whether the log message is a simple message or a composite message, wherein a composite message contains a plurality of objects;

when the message is a simple message, identify, after intercepting the method call, sensitive information in the log message without tagging the sensitive information as sensitive, the identifying comprising:

finding in the log message a set of data comprising a format that matches a sensitive data pattern, and

validating the found set of data to eliminate false positives, and

determining that the found set of data does not contain data in a format that matches any of a plurality of exceptional case data patterns;

when the message is a composite message, perform a recursive algorithm to examine each of the objects of the composite message, wherein performing comprises:

determining whether the object contains a set of data comprising a format that matches a sensitive data pattern,

when the set of data is determined to comprise the format that matches a sensitive data pattern, validating the determined set of data to eliminate false positives, and

determining that the set of data does not contain data in a format that matches any of a plurality of exceptional case data patterns;

modify the log message to protect the sensitive information; and

cause the modified log message to be logged in the log data.

9. The system of claim 8 , wherein the sensitive information comprises one or more of a credit card number, a social security number, an account number, an employee number, a customer or patient number, an IP address, a driver license number, a license plate number, a password, a telephone number, a name, a username, or a birthdate.

10. The system of claim 8 , wherein identifying sensitive information in the log message comprises:

storing a plurality of sensitive data patterns for sensitive information and the plurality of exceptional case data patterns for exceptional cases;

finding in the log message one or more sets of data comprising the format that matches any of the plurality of sensitive data patterns;

validating at least one found set of data is not the false positive by using one or more sensitive data validators; and

determining that the at least one validated set of data does not contain data in a format that matches any of the plurality of exceptional case data patterns.

11. The system of claim 8 , wherein the hardware processing device is to modify the log message to protect the sensitive information by:

at least one of removing the sensitive information, masking the sensitive information, or redacting the sensitive information to create the protected information.

12. The system of claim 8 , wherein the modified log message comprises a line number of application source code that generated the log message at runtime.

13. The system of claim 8 , wherein the log message is a composite message comprising at least one computer programming class object and at least one simple message comprising a string.

14. The system of claim 13 , wherein the hardware processing device is to modify the log message to protect the sensitive information by:

at least one of removing the sensitive information, masking the sensitive information, or redacting the sensitive information to create the protected information; and

creating at least one new class object to be logged in the log data, the new class object comprising a new log message having the protected information.

15. A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

intercepting, by the processing device executing a first application, a method call of a log message originating from a second application at runtime, the log message containing information to be stored in a log data, the method call being derived from application source code of the second application;

determining whether the log message is a simple message or a composite message, wherein a composite message contains a plurality of objects;

when the message is a simple message, identifying, after intercepting the method call, sensitive information in the log message without tagging the sensitive information as sensitive, the identifying comprising:

finding in the log message a set of data comprising a format that matches a sensitive data pattern,

validating the found set of data to eliminate false positives, and

determining that the found set of data does not contain data in a format that matches any of a plurality of exceptional case data patterns;

when the message is a composite message, performing a recursive algorithm to examine each of the objects of the composite message, wherein performing comprises:

determining whether the object contains a set of data comprising a format that matches a sensitive data pattern,

when the set of data is determined to comprise the format that matches a sensitive data pattern, validating the determined set of data to eliminate false positives, and

determining that the set of data does not contain data in a format that matches any of a plurality of exceptional case data patterns;

modifying the log message to protect the sensitive information; and

causing the modified log message to be logged in the log data.

16. The non-transitory computer readable storage medium of claim 15 , wherein the sensitive information comprises one or more of a credit card number, a social security number, an account number, an employee number, a customer or patient number, an IP address, a driver license number, a license plate number, a password, a telephone number, a name, a username, or a birthdate.

17. The non-transitory computer readable storage medium of claim 15 , wherein identifying sensitive information in the log message comprises:

storing a plurality of sensitive data patterns for sensitive information and the plurality of exceptional case data patterns for exceptional cases;

finding in the log message one or more sets of data comprising the format that matches any of the plurality of sensitive data patterns;

validating at least one found set of data is not the false positive by using one or more sensitive data validators; and

determining that the at least one validated set of data does not contain data in a format that matches any of the plurality of exceptional case data patterns.

18. The non-transitory computer readable storage medium of claim 15 , wherein modifying the log message to protect the sensitive information comprises:

at least one of removing the sensitive information, masking the sensitive information, or redacting the sensitive information to create the protected information.

19. The non-transitory computer readable storage medium of claim 15 , wherein the modified log message comprises a line number of application source code that generated the log message at runtime.

20. The non-transitory computer readable storage medium of claim 19 , wherein modifying the log message to protect the sensitive information comprises:

at least one of removing the sensitive information, masking the sensitive information, or redacting the sensitive information to create the protected information; and

creating at least one new class object to be logged in the log data, the new class object comprising a new log message having the protected information.

Assignments (11)