Detecting personally identifiable information (PII) in telemetry data
In some examples, a computing device may determine that an event occurred and determine event data associated with the event. A first machine learning classifier may be used to determine that the event data includes personally identifiable information (PII) and a second machine learning classifier may be used to remove the PII from the event data to create modified event data. The PII may include one or more of a username, a password, at least a portion of a legal name, a password, at least a portion of an address, at least a portion of a social security number, or at least a portion of an account number associated with a financial institution. The modified event data may be stored in a device data file that includes data associated with the computing device. In some cases, the computing device may send the device data file to a server.
1. A method comprising:
determining, by a computing device, that an event occurred on the computing device;
determining, by the computing device, event data associated with the event;
determining, using a first machine learning classifier being executed by the computing device, that the event data includes personally identifiable information;
removing, using a second machine learning classifier being executed by the computing device, the personally identifiable information from the event data to create modified event data;
storing the modified event data in a device data file that includes data associated with the computing device; and
sending, by the computing device, the device data file to a server.
2. The method of claim 1 , wherein the event comprises one of:
input provided by a user;
a software application installation log;
a software application created log;
an operating system log; or
an operating system memory dump.
3. The method of claim 1 , wherein removing the personally identifiable information from the event data to create the modified event data comprises:
substituting a first pre-determined character for each alphabetic character in the personally identifiable information; and
substituting a second pre-determined character for each numeric character in the personally identifiable information.
4. The method of claim 1 , wherein removing the personally identifiable information from the event data to create the modified event data comprises:
identifying a type of the personally identifiable information; and
substituting one or more keywords describing the type.
5. The method of claim 4 , wherein the type comprises one of:
a username;
a password;
at least a portion of a legal name;
at least a portion of an address;
at least a portion of a social security number; or
at least a portion of an account number associated with a financial institution.
6. The method of claim 1 , wherein:
the first machine learning classifier comprises a Naïve Bayes classifier.
7. The method of claim 1 , wherein:
the second machine learning classifier comprises a Decision Trees classifier.
8. A computing device comprising:
one or more processors; and
one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:
determining that an event occurred on the computing device;
determining event data associated with the event;
determining, using a first machine learning classifier being executed by the computing device, that the event data includes personally identifiable information;
removing, using a second machine learning classifier being executed by the computing device, the personally identifiable information from the event data to create modified event data;
storing the modified event data in a device data file that includes data associated with the computing device; and
sending the device data file to a server.
9. The computing device of claim 8 , the operations further comprising:
determining that a second event occurred on the computing device;
determining second event data associated with the second event;
determining, using the first machine learning classifier, that the second event data includes the personally identifiable information;
removing, using the second machine learning classifier, the personally identifiable information from the second event data to create modified second event data;
storing the modified second event data in the device data file; and
determining that the modified second event data is not to be sent to the server.
10. The computing device of claim 9 , wherein determining that the modified second event data is not to be sent to the server comprises:
determining that a network connection between the computing device and the server is unavailable.
11. The computing device of claim 9 , wherein determining that the modified second event data is not to be sent to the server comprises:
receiving a first instruction from the server to temporarily stop sending the device data file to the server.
12. The computing device of claim 8 , the operations further comprising:
receiving a second instruction from the server to resume sending the device data file to the server.
13. The computing device of claim 8 , wherein removing the personally identifiable information from the event data to create the modified event data comprises:
substituting a first pre-determined character for each alphabetic character in the personally identifiable information; and
substituting a second pre-determined character for each numeric character in the personally identifiable information.
14. One or more non-transitory computer readable media storing instructions executable by one or more processors of a computing device to perform operations comprising:
determining that an event occurred on the computing device;
determining event data associated with the event;
determining, using a first machine learning classifier being executed by the computing device, that the event data includes personally identifiable information;
removing, using a second machine learning classifier being executed by the computing device, the personally identifiable information from the event data to create modified event data;
storing the modified event data in a device data file that includes data associated with the computing device; and
sending the device data file from the computing device to a server.
15. The one or more non-transitory computer readable media of claim 14 , wherein the event comprises one of:
input provided by a user;
a software application installation log;
a software application created log;
an operating system log; or
an operating system memory dump.
16. The one or more non-transitory computer readable media of claim 14 , wherein removing the personally identifiable information from the event data to create the modified event data comprises:
substituting a pre-determined character for each alphanumeric character in the personally identifiable information.
17. The one or more non-transitory computer readable media of claim 14 , wherein removing the personally identifiable information from the event data to create the modified event data comprises:
identifying a type of the personally identifiable information; and
substituting one or more keywords describing the type.
18. The one or more non-transitory computer readable media of claim 17 , wherein the type comprises one of:
a username;
a password;
at least a portion of a legal name;
a password;
at least a portion of an address;
at least a portion of a social security number; or
at least a portion of an account number associated with a financial institution.
19. The one or more non-transitory computer readable media of claim 14 , wherein determining that the modified second event data is not to be sent to the server comprises:
determining that a network connection between the computing device and the server is unavailable.
20. The one or more non-transitory computer readable media of claim 14 , wherein determining that the modified second event data is not to be sent to the server comprises:
receiving an instruction from the server to temporarily stop sending the device data file to the server.