Method and system for anonymizing activity records

1. A method for detecting cyber-threats to a company from activity records logged by the company's computing devices while protecting sensitive company information, the method comprising:

receiving, by an activity monitoring engine, an activity record that documents user activities on a computing device;

generating, by the activity monitoring engine, an anonymization dictionary, wherein generating the anonymization dictionary comprises:

using a statistical method or an artificial intelligence method to detect, in the activity record, a plurality of target entities to be anonymized;

making a determination that a resource is associated with a set of target entities of the plurality of target entities; and

after making the determination:

assigning an anonymized identity to the set of target entities; and

generating an anonymized identifier for each target entity in the set of target entities to obtain a plurality of anonymized identifiers each including the anonymized identity;

replacing, by the activity monitoring engine, the plurality of target entities in the activity record with their anonymized identifiers from the anonymization dictionary to obtain an anonymized activity record;

storing, by the activity monitoring engine, the anonymized activity record; and

analyzing, by the activity monitoring engine, the anonymized activity record to detect cyber-threats to the company or sharing, by the activity monitoring engine, the anonymized activity record with a third-party system to detect cyber-threats to the company.

2. The method of claim 1 , further comprising detecting an additional target entity to be anonymized based on its consistent appearance uniquely with one of the plurality of target entities.

3. The method of claim 1 , wherein making the determination that the resource is associated with the set of target entities comprises using statistical analysis to determine user accounts are associated with the resource when the user accounts access an email account more than the user accounts access other email accounts.

4. The method of claim 1 , wherein making the determination that the resource is associated with the set of target entities comprises using cluster analysis to determine user accounts are associated with the resource based on utilization parameters.

5. The method of claim 1 , wherein:

generating the anonymization dictionary further comprises, for each target entity in the set of target entities, assigning an entity type of the target entity; and

generating the anonymized identifier for each target entity comprises storing the entity type in the anonymized identifier.

6. The method of claim 5 , wherein the entity type is at least one selected from the group consisting of a user name, an email address, a domain name, an IP address, a port number, a host name, a company name, and a partner name.

7. The method of claim 5 , wherein:

for at least two target entities in the set of target entities, the entity type is identical;

a unique instance identifier is assigned to each of the at least two target entities; and

the unique instance identifiers are included in the anonymized identifiers for the at least two target entities.

8. The method of claim 1 , wherein each of the plurality of target entities comprises at least one selected from a group consisting a user name, an email address, a domain name, IP address, a port number, a host name, company name, and a partner name.

9. The method of claim 1 , further comprising:

analyzing the at least one anonymized activity record using a threat detection algorithm.

10. The method of claim 1 , wherein the resource is a user or a company.

11. A method for detecting cyber-threats to a company from activity records logged by the company's computing devices while protecting sensitive company information, the method comprising:

obtaining, by an activity monitoring engine, an activity record including metadata that documents user activities on a computing device;

generating, by the activity monitoring engine, an anonymization dictionary, wherein generating the anonymization dictionary comprises:

using a statistical method or an artificial intelligence method to detect, in the activity record, a plurality of target entities to be anonymized;

assigning an anonymized identity to each unique target entity of the plurality of target entities; and

generating dictionary entries for the plurality of target entities, wherein each dictionary entry comprises a target entity and a corresponding anonymized identifier comprising the anonymized identity for the target entity;

generating, by the activity monitoring engine, an equivalence map, wherein generating the equivalence map comprises:

making a determination that a resource is associated with a set of target entities of the plurality of target entities; and

storing, in the equivalence map, an identity relationship specifying that anonymized identities corresponding to the set of target entities are associated with the resource;

replacing, by the activity monitoring engine, the plurality of target entities in the activity record with their anonymized identifiers from the anonymization dictionary to obtain an anonymized activity record;

storing, by the activity monitoring engine, the anonymized activity record; and

analyzing, by the activity monitoring engine, the anonymized activity record to detect cyber-threats to the company or sharing, by the activity monitoring engine, the anonymized activity record with a third-party system to detect cyber-threats to the company.

12. The method of claim 11 , further comprising detecting an additional target entity to be anonymized based on its consistent appearance uniquely with one of the plurality of target entities.

13. The method of claim 11 , wherein making the determination that the resource is associated with the set of target entities comprises using statistical analysis to determine user accounts are associated with the resource when the user accounts access an email account more than the user accounts access other email accounts.

14. The method of claim 11 , wherein making the determination that the resource is associated with the set of target entities comprises using cluster analysis to determine user accounts are associated with the resource based on utilization parameters.

15. The method of claim 11 , wherein generating the equivalence map is performed prior to or after storing the anonymized activity record.

16. A computer system, comprising:

the anonymization engine programmed to perform the method of claim 1 or 11 ; and

a repository configured to store the anonymized activity record.

17. The system of claim 16 , further comprising:

a threat analysis engine programmed to analyze the anonymized activity record using a threat detection algorithm.