Detection of sensitive personal information in a storage device
A method, system and computer program product for detecting sensitive personal information in a storage device. A block delta list containing a list of changed blocks in the storage device is processed. After identifying the changed blocks from the block delta list, a search is performed on those identified changed blocks for sensitive personal information using a character scanning technique. After identifying a changed block deemed to contain sensitive personal information, the changed block is translated from the block level to the file level using a hierarchical reverse mapping technique. By only analyzing the changed blocks to determine if they contain sensitive personal information, a lesser quantity of blocks needs to be processed in order to detect sensitive personal information in the storage device in near real-time. In this manner, sensitive personal information is detected in the storage device using fewer computing resources in a shorter amount of time.
1. A computer program product for detecting sensitive personal information in a storage device, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code comprising the programming instructions for:
conducting an initial scan of blocks in a storage device;
identifying any changed blocks in said storage device, wherein a block is a contiguous set of bits or bytes that forms an identifiable unit of data, wherein a changed block is said block with an identifiable unit of data that has changed over a period of time, wherein said block is changed due to a storing of sensitive information;
adding said identified changed blocks to a block delta list, wherein said block delta list is a list of changed blocks in said storage device, wherein said block delta list includes deltas associated with said changed blocks that indicate differences in said changed blocks from a first point of time to a second point of time;
processing said block delta list;
identifying changed blocks from said block delta list;
searching said identified changed blocks for sensitive personal information using a character scanning technique comprising a convolutional neural network, a recurrent neural network or a regular expression;
identifying a changed block deemed to contain said sensitive personal information; and
translating said identified changed block from a block level to a file level using a hierarchical reverse mapping technique, wherein said hierarchical reverse mapping technique uses block level translations and file system inode translations.
2. The computer program product as recited in claim 1 , wherein said identified changed block is translated from said block level to said file level using said hierarchical reverse mapping technique in response to said sensitive personal information being located in a middle of said identified changed block, wherein said block level translations comprise attributes and location of a block, wherein said file system inode translations comprise attributes and block locations of a file's data.
3. The computer program product as recited in claim 1 , wherein the program code further comprises the programming instructions for:
searching blocks in said storage device to locate one or more adjacent blocks to said identified changed block in response to said sensitive personal information being located at an edge of said identified changed block.
4. The computer program product as recited in claim 3 , wherein the program code further comprises the programming instructions for:
combining said one or more adjacent blocks to said identified changed block to form a new single block.
5. The computer program product as recited in claim 4 , wherein the program code further comprises the programming instructions for:
determining whether said sensitive personal information is located in a middle of said new single block.
6. The computer program product as recited in claim 1 , wherein the program code further comprises the programming instructions for:
queuing said block delta list in a queue.
7. The computer program product as recited in claim 2 , wherein said attributes of said block level translations and said attributes of said file system inode translations comprise metadata indicating a time of a last change, access or modification, wherein said block level translations and said file system inode translations are used to translate said identified changed block from said block level to said file level.
8. A system, comprising:
a memory unit for storing a computer program for detecting sensitive personal information in a storage device; and
a processor coupled to the memory unit, wherein the processor is configured to execute the program instructions of the computer program comprising:
conducting an initial scan of blocks in a storage device;
identifying any changed blocks in said storage device, wherein a block is a contiguous set of bits or bytes that forms an identifiable unit of data, wherein a changed block is said block with an identifiable unit of data that has changed over a period of time, wherein said block is changed due to a storing of sensitive information;
adding said identified changed blocks to a block delta list, wherein said block delta list is a list of changed blocks in said storage device, wherein said block delta list includes deltas associated with said changed blocks that indicate differences in said changed blocks from a first point of time to a second point of time;
processing said block delta list;
identifying changed blocks from said block delta list;
searching said identified changed blocks for sensitive personal information using a character scanning technique comprising a convolutional neural network, a recurrent neural network or a regular expression;
identifying a changed block deemed to contain said sensitive personal information; and
translating said identified changed block from a block level to a file level using a hierarchical reverse mapping technique, wherein said hierarchical reverse mapping technique uses block level translations and file system inode translations.
9. The system as recited in claim 8 , wherein said identified changed block is translated from said block level to said file level using said hierarchical reverse mapping technique in response to said sensitive personal information being located in a middle of said identified changed block, wherein said block level translations comprise attributes and location of a block, wherein said file system inode translations comprise attributes and block locations of a file's data.
10. The system as recited in claim 8 , wherein the program instructions of the computer program further comprise:
searching blocks in said storage device to locate one or more adjacent blocks to said identified changed block in response to said sensitive personal information being located at an edge of said identified changed block.
11. The system as recited in claim 10 , wherein the program instructions of the computer program further comprise:
combining said one or more adjacent blocks to said identified changed block to form a new single block.
12. The system as recited in claim 11 , wherein the program instructions of the computer program further comprise:
determining whether said sensitive personal information is located in a middle of said new single block.
13. The system as recited in claim 8 , wherein the program instructions of the computer program further comprise:
queuing said block delta list in a queue.
14. The system as recited in claim 9 , wherein said attributes of said block level translations and said attributes of said file system inode translations comprise metadata indicating a time of a last change, access or modification, wherein said block level translations and said file system inode translations are used to translate said identified changed block from said block level to said file level.