System, apparatus and method for anonymizing data prior to threat detection analysis
A computerized method involves obfuscating one or more segments of data that is part of a flow prior to analysis of the flow for malware. Each of the one or more obfuscated data corresponds to one or more anonymized data. Thereafter, an identifier is generated for each of the one or more anonymized data, and each identifier is substituted for its corresponding anonymized data. The anonymized data and its corresponding identifiers are separately maintained from the stored flow.
1. A method comprising:
generating a flow identifier for a flow;
identifying one or more personally identifiable information (PII) segments in the flow;
generating a data identifier for each of the one or more PII segments of data;
storing each data identifier for a corresponding PII segment of data separately from a corresponding flow;
substituting each data identifier for a corresponding PII segment of data as part of the flow;
associating the data identifiers with the flow identifiers, wherein the one or more PII segments of data and the corresponding data identifiers are stored separately from the flow;
determining whether recovery of the one or more PII segments of data is desired;
anonymizing the PII segments of data, wherein the anonymizing comprises encrypting PII segments of data for which recovery is desired with a first keying material, and hashing PII segments of data for which recovery is not desired; and
responsive to changing an obfuscation scheme, decrypting the encrypted PII segments of data with the first keying material and reencrypting the decrypted PII segments of data with a second keying material without altering the corresponding data identifiers or the flow.
2. The method of claim 1 , comprising:
generating a second identifier for each of the one or more anonymized PII segments of data; and
storing the one or more anonymized PII segments of data and the corresponding second identifiers separately from the flow.
3. The method of claim 2 , wherein the generating of the second identifier for each of the anonymized PII segments of data comprises generating a hash result for each of the anonymized PII segments of data.
4. The method of claim 1 , wherein the storing each identifier separately from the corresponding flow comprises storing the identifier in a first region of memory and the flow in a second region of the memory.
5. A non-transitory machine-readable storage medium comprising instructions, that when executed by a processor, causes the processor to:
generate a data identifier for personally identifiable information (PII) segments of data in a flow;
substitute each data identifier for a corresponding PII segment of data as part of the flow;
associate the data identifiers with a flow identifier of the corresponding flow;
determine whether recovery of the one or more PII segments of data is desired;
anonymize the PII segments of data, wherein the anonymizing comprises encrypting PII segments of data for which recovery is desired with a first keying material, and hashing PII segments of data for which recovery is not desired; and
decrypt the encrypted PII segments of data with the first keying material and reencrypting the decrypted PII segments of data with a second keying material without altering the corresponding data identifiers or the flow.
6. The non-transitory machine-readable storage medium of claim 5 , comprising instructions, that when executed by the processor, causes the processor to:
store each identifier for a corresponding PII segment of data separately from the corresponding flow.
7. The non-transitory machine-readable storage medium of claim 6 , wherein the storing each identifier separately from the corresponding flow comprises storing the identifier in a first region of memory and the flow in a second region of the memory.
8. The non-transitory machine-readable storage medium of claim 5 , comprising instructions, that when executed by the processor, causes the processor to:
generate a second identifier for each of the one or more anonymized PII segments of data; and
store the anonymized PII segments of data and the corresponding second identifier separately from the flow.
9. The non-transitory machine-readable storage medium of claim 8 , wherein the generating of the second identifier for each of the anonymized PII segments of data comprises generating a hash result for each of the anonymized PII segments of data.
10. A method comprising:
generating a data identifier for personally identifiable information (PII) segments of data in a flow;
substituting each data identifier for a corresponding PII segment of data as part of the flow;
associating the data identifiers with a flow identifier of the corresponding flow;
determining whether recovery of the one or more PII segments of data is desired;
anonymizing the PII segments of data, wherein the anonymizing comprises encrypting PII segments of data for which recovery is desired with a first keying material, and hashing PII segments of data for which recovery is not desired; and
responsive to changing an obfuscation scheme, decrypting the encrypted PII segments of data with the first keying material and reencrypting the decrypted PII segments of data with a second keying material without altering the corresponding data identifiers or the flow.
11. The method of claim 10 , comprising storing each identifier for a corresponding PII segment of data separately from the corresponding flow.
12. The method of claim 11 , wherein the storing each identifier separately from the corresponding flow comprises storing the identifier in a first region of memory and the flow in a second region of the memory.
13. The method of claim 10 , comprising:
generating a second identifier for each of the one or more anonymized PII segments of data; and
storing the anonymized PII segments of data and the corresponding second identifier separately from the flow.
14. The method of claim 13 , wherein the generating of the second identifier for each of the anonymized PII segments of data comprises generating a hash result for each of the anonymized PII segments of data.