Data scrubbing via template generation and matching
View Patent ↗Techniques are described relating to the detection of personal information that may be sent to parties outside of an organization. Techniques may include comparing portions of emails to several file templates to calculate a document exposure score. The document exposure score may indicate an overall similarity based upon the presence of a number of common items such as graphics, words, form fields, etc. When the document exposure score for a particular sent email is greater than a threshold value, the sent email may be re-routed and quarantined instead of being transmitted outside of the organization's local network. A secondary determination may also be performed that identifies personal information when a matching file template is not initially found and, if so, adds a new file template to a template database to improve the performance and accuracy of the system over time.
1. A computer-implemented method of preventing transmission of personal information, the method comprising:
accessing, by one or more processors, a detection rule specifying one or more parameters that specify which portions of sent email messages are to be matched to one or more blank file templates distinct from the sent email messages based on at least one of (i) one or more keywords or (ii) one or more data profiles, to determine whether the sent email messages exceed a minimum document exposure threshold, wherein the portions comprise a subject line, body of content, and an attached file included in the sent email messages, and wherein the one or more blank file templates match a format of a respective known file and excludes personal information included in the respective known file;
detecting, by the one or more processors and in accordance with the one or more parameters specified in the detection rule, whether a sent email exceeds the minimum document exposure threshold when matched to the one or more blank file templates indicating that the sent email addressed to a party contains personal information; and
based on the detecting, when the sent email contains personal information, re-routing, by the one or more processors, the sent email to prevent the sent email from being routed as addressed.
2. The computer-implemented method of claim 1 ,
wherein the detection rule further specifies:
content from the portions of the sent email messages to be matched to content included in the one or more blank file templates;
file properties of an attached file included in sent email messages that, when present, result in the attached file qualifying for comparison to the one or more blank file templates; and
the minimum document exposure threshold between (i) content included in the portions of the sent email messages, and (ii) content included in the one or more blank file templates, which results in the detection of a sent email message containing personal information.
3. The computer-implemented method of claim 2 , further comprising:
comparing the content included in portions of the sent email messages as specified by the detection rule to content included in the one or more blank file templates; and
calculating, for each comparison made between the content included in portions of the sent email messages and content included in the one or more blank file templates, an initial document exposure score,
wherein the initial document exposure score is a scaled percentage that indicates, for a higher percentage value, a greater similarity between the content included in portions of the sent email messages and content included in the one or more blank file templates.
4. The computer-implemented method of claim 2 , further comprising:
comparing the content included in portions of the sent email messages as specified by the detection rule to content included in the one or more blank file templates;
calculating, for each comparison made between the content included in portions of the sent email messages and content included in the one or more blank file templates, an initial document exposure score;
flagging a sent email message from among the sent email messages as a potentially safe sent email message when none of the comparisons between the sent email message and the one or more blank file templates yields an initial document exposure score below the minimum document exposure threshold;
calculating a secondary document exposure score based upon a presence of one or more keywords and form fields associated with credit reports contained in the portions of the potentially safe sent email message; and
when the secondary document exposure score exceeds a detection threshold, re-routing the potentially safe sent email message within a local organization to prevent the potentially safe sent email message from being routed outside of the local organization as addressed.
5. The computer-implemented method of claim 4 , further comprising:
generating, from the portions of the potentially safe sent email message, a new redacted template by removing personal information identified in the content included in portions of the potentially safe sent email message; and
adding the new redacted template to the one or more blank file templates.
6. The computer-implemented method of claim 1 , wherein re-routing the sent email comprises:
re-routing the sent email to an internal server within a local organization where the sent email is stored as part of a quarantine procedure.
7. The computer-implemented method of claim 6 , wherein re-routing the sent email further comprises at least one of:
logging details of the sent email that led to the quarantine procedure; or
upon the sent email being re-routed within the local organization, sending an alert message to the sender of the email notifying the sender of the quarantine status of the sent email or to personnel associated with the local organization.
8. A non-transitory, tangible computer-readable medium storing machine readable instructions that, when executed by a processor, cause the processor to:
access a detection rule specifying one or more parameters that specify which portions of sent email messages are to be matched to one or more blank file templates distinct from the sent email messages based on at least one of (i) one or more keywords or (ii) one or more data profiles, to determine whether the sent email messages exceed a minimum document exposure threshold, wherein the selectable portions comprise a subject line, body of content, and an attached file included in the sent email messages, and wherein the one or more blank file templates match a format of a respective known file and excludes personal information included in the respective known file;
detect, in accordance with the one or more parameters specified in the detection rule, whether a sent email exceeds the minimum document exposure threshold when matched to the one or more blank file templates indicating that the sent email addressed to a party contains personal information; and
based on the detecting, when the sent email contains personal information, re-route the sent email to prevent the sent email from being routed as addressed.
9. The non-transitory, tangible computer-readable medium of claim 8 , wherein the detection rule further specifies:
content from the portions of the sent email messages to be matched to content included in the one or more blank file templates;
file properties of an attached file included in sent email messages that, when present, result in the attached file qualifying for comparison to the one or more blank file templates; and
the minimum document exposure threshold between (i) content included in the portions of the sent email messages, and (ii) content included in the one or more blank file templates, which results in the detection of a sent email message containing personal information.
10. The non-transitory, tangible computer-readable medium of claim 9 , further storing machine readable instructions that, when executed by a processor, cause the processor to:
compare the content included in portions of the sent email messages as specified by the detection rule to content included in the one or more blank file templates; and
calculate, for each comparison made between the content included in portions of the sent email messages and content included in the one or more blank file templates, an initial document exposure score,
wherein the initial document exposure score is a scaled percentage that indicates, for a higher percentage value, a greater similarity between the content included in portions of the sent email messages and content included in the one or more blank file templates.
11. The non-transitory, tangible computer-readable medium of claim 9 , further storing machine readable instructions that, when executed by a processor, cause the processor to:
compare the content included in portions of the sent email messages as specified by the detection rule to content included in the one or more blank file templates;
calculate, for each comparison made between the content included in portions of the sent email messages and content included in the one or more blank file templates, an initial document exposure score;
flag a sent email message from among the sent email messages as a potentially safe sent email message when none of the comparisons between the sent email message and the one or more blank file templates yields an initial document exposure score below the minimum document exposure threshold;
calculate a secondary document exposure score based upon a presence of one or more keywords and form fields associated with credit reports contained in the portions of the potentially safe sent email message; and
when the secondary document exposure score exceeds a detection threshold, re-route the potentially safe sent email message within a local organization to prevent the potentially safe sent email message from being routed outside of the local organization as addressed.
12. The non-transitory, tangible computer-readable medium of claim 11 , further storing machine readable instructions that, when executed by a processor, cause the processor to:
generate, from the portions of the potentially safe sent email message, a new redacted template by removing personal information identified in the content included in portions of the potentially safe sent email message; and
add the new redacted template to the one or more blank file templates.
13. The non-transitory, tangible computer-readable medium of claim 8 , wherein the instructions re-route the sent email further include instructions that, when executed by the processor, cause the processor to:
re-route the sent email to an internal server within a local organization where the sent email is stored as part of a quarantine procedure.
14. The non-transitory, tangible computer-readable medium of claim 13 , wherein the instructions re-route the sent email further include instructions that, when executed by the processor, cause the processor to:
log details of the sent email that led to the quarantine procedure; or
upon the sent email being re-routed within the local organization, send an alert message to the sender of the email notifying the sender of the quarantine status of the sent email or to personnel associated with the local organization.
15. A data loss prevention engine, comprising:
a memory unit configured to store one or more blank file templates; and
a processor configured to:
access a detection rule specifying one or more parameters that specify which portions of sent email messages are to be matched to the one or more blank file templates distinct from the sent email messages based on at least one of (i) one or more keywords or (ii) one or more data profiles, to determine whether the sent email messages exceed a minimum document exposure threshold, wherein the portions comprise a subject line, body of content, and an attached file included in the sent email messages, and wherein the one or more blank file templates match a format of a respective known file and excludes personal information included in the respective known file;
detect, in accordance with the one or more parameters specified in the detection rule, whether a sent email exceeds the minimum document exposure threshold when matched to the one or more blank file templates indicating that the sent email addressed to a party contains personal information; and
based on the detecting, when the sent email contains personal information, re-route the sent email to prevent the sent email from being routed as addressed.
16. The data loss prevention engine of claim 15 , wherein the detection rule further specifies:
content from the portions of the sent email messages to be matched to content included in the one or more blank file templates;
file properties of an attached file included in sent email messages that, when present, result in the attached file qualifying for comparison to the one or more blank file templates; and
the minimum document exposure threshold between (i) content included in the portions of the sent email messages, and (ii) content included in the one or more blank file templates, which results in the detection of a sent email message containing personal information.
17. The data loss prevention engine of claim 16 , wherein the processor is further configured to:
compare the content included in portions of the sent email messages as specified by the detection rule to content included in the one or more blank file templates; and
calculate, for each comparison made between the content included in portions of the sent email messages and content included in the one or more blank file templates, an initial document exposure score,
wherein the initial document exposure score is a scaled percentage that indicates, for a higher percentage value, a greater similarity between the content included in portions of the sent email messages and content included in the one or more blank file templates.
18. The data loss prevention engine of claim 16 , wherein the processor is further configured to:
compare the content included in portions of the sent email messages as specified by the detection rule to content included in the one or more blank file templates;
calculate, for each comparison made between the content included in portions of the sent email messages and content included in the one or more blank file templates, an initial document exposure score;
flag a sent email message from among the sent email messages as a potentially safe sent email message when none of the comparisons between the sent email message and the one or more blank file templates yields an initial document exposure score below the minimum document exposure threshold;
calculate a secondary document exposure score based upon a presence of one or more keywords and form fields associated with credit reports contained in the portions of the potentially safe sent email message; and
when the secondary document exposure score exceeds a detection threshold, re-route the potentially safe sent email message within a local organization to prevent the potentially safe sent email message from being routed outside of the local organization as addressed.
19. The data loss prevention engine of claim 18 , wherein the processor is further configured to:
generate, from the portions of the potentially safe sent email message, a new redacted template by removing personal information identified in the content included in portions of the potentially safe sent email message; and
add the new redacted template to the one or more blank file templates.
20. The data loss prevention engine of claim 15 , wherein the processor is further configured to:
re-route the sent email to an internal server within a local organization where the sent email is stored as part of a quarantine procedure, and
at least one of:
log details of the sent email that led to the quarantine procedure; or
upon the sent email being re-routed within the local organization, send an alert message to the sender of the email notifying the sender of the quarantine status of the sent email or to personnel associated with the local organization.