Non-sensitive-passage database for cut-and-paste attack detection systems
One embodiment provides a system that detects sensitive passages. During operation, the system receives a document and disassembles the document into a plurality of passages. For a respective passage, the system performs a search through a non-sensitive-passage database to determine whether the passage is a known non-sensitive passage. If so, the system marks the passage as non-sensitive, and if not, the system determines whether the passage triggers a cut-and-paste attack detection. If so, the system forwards the passage to an administrator and allows the administrator to determine whether the passage is non-sensitive and, further, to add the passage to the non-sensitive-passage database responsive to the administrator determining the passage to be non-sensitive.
1. A computer-executable method for detecting sensitive passages, comprising:
receiving, by a computer, a document;
disassembling the document into a plurality of passages;
performing a search for a respective passage through a non-sensitive-passage database to determine whether the passage is a known non-sensitive passage;
responsive to determining the passage to be a known non-sensitive passage, marking the passage as non-sensitive;
determining whether a combination of two non-sensitive passages in the plurality of passages is sensitive; and
responsive to the combination being sensitive, blocking the release of one of the two non-sensitive passages if the other one is previously released.
2. The method of claim 1 , further comprising:
adding the passage to a sensitive-passage database responsive to determining the passage to be sensitive.
3. The method of claim 1 , wherein determining whether the combination of two non-sensitive passages is sensitive comprises:
performing searches through a corpus based on the combination of the two passages and determining hit counts returned for each passage and for the combination; and
determining whether the combination of the two passages is sensitive based on the hit count for the combination and the hit counts for the individual passages.
4. The method of claim 1 , wherein the non-sensitive-passage database comprises contents from a public domain.
5. The method of claim 4 , wherein the public domain comprises company-related external web pages, marketing brochures, and news reports.
6. The method of claim 1 , further comprising:
responsive to determining that the passage is not known to be non-sensitive:
determining that the passage triggers a cut-and-paste attack detection;
forwarding the passage to an administrator to determine whether the passage is non-sensitive based on a feedback from the administrator; and
responsive to determining the passage to be non-sensitive based on the feedback, adding the passage to the non-sensitive-passage database.
7. The method of claim 6 , further comprising releasing the document in response to the passages triggering the cut-and-paste attack detections being determined to be non-sensitive.
8. The method of claim 6 , wherein determining whether the passage triggers the cut-and-paste attack comprises:
fingerprinting the passage; and
comparing the passage's fingerprint with stored fingerprints of a set of training documents.
9. A computer-readable non-transitory storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:
receiving a document;
disassembling the document into a plurality of passages;
performing a search for a respective passage through a non-sensitive-passage database to determine whether the passage is a known non-sensitive passage;
responsive to determining the passage to be a known non-sensitive passage, marking the passage as non-sensitive;
determining whether a combination of two non-sensitive passages in the plurality of passages is sensitive; and
responsive to the combination being sensitive, blocking the release of one of the two non-sensitive passages if the other one is previously released.
10. The computer-readable storage medium of claim 9 , wherein the method further comprises: adding the passage to a sensitive-passage database responsive to determining the passage to be sensitive.
11. The computer-readable storage medium of claim 9 , wherein determining whether the combination of two non-sensitive passages is sensitive comprises:
performing searches through a corpus based on the combination of the two passages and determining hit counts returned for each passage and for the combination; and
determining whether the combination of the two passages is sensitive based on the hit count for the combination and the hit counts for the individual passages.
12. The computer-readable storage medium of claim 9 , wherein the non-sensitive-passage database comprises contents from a public domain.
13. The computer-readable storage medium of claim 12 , wherein the public domain comprises company-related external web pages, marketing brochures, and news reports.
14. The computer-readable storage medium of claim 9 , wherein the method further comprises:
responsive to determining that the passage is not known to be non-sensitive:
determining that the passage triggers a cut-and-paste attack detection;
forwarding the passage to an administrator to determine whether the passage is non-sensitive based on a feedback from the administrator; and
responsive to determining the passage to be non-sensitive based on the feedback, adding the passage to the non-sensitive-passage database.
15. The computer-readable storage medium of claim 14 , wherein the method further comprises releasing the document in response to the passages triggering the cut-and-paste attack detections being determined to be non-sensitive.
16. The computer-readable storage medium of claim 14 , wherein determining whether the passage triggers the cut-and-paste attack comprises:
fingerprinting the passage; and
comparing the passage's fingerprint with stored fingerprints of a set of training documents.
17. A system for detecting sensitive passages, comprising:
a receiving mechanism configured to receive a document;
a disassembling mechanism configured to disassemble the document into a plurality of passages;
a non-sensitive-passage database;
a searching mechanism configured to perform a search through a non-sensitive-passage database to determine whether a passage in the plurality of passages is a known non-sensitive passage;
a marking mechanism configured to mark the passage as non-sensitive responsive to determining the passage to be a known non-sensitive passage;
a detection mechanism configured to detect whether the passage triggers a cut-and-paste attack detection;
a determination mechanism configured to determine whether a combination of two non-sensitive passages in the plurality of passages is sensitive; and
a blocking mechanism configured to block the release of one of the two non-sensitive passages if the other one is previously released responsive to the combination being sensitive.
18. The system of claim 17 , further comprising:
a sensitive-passage database, wherein a passage is added to the sensitive-passage database responsive to determining the passage to be sensitive.
19. The system of claim 17 , wherein determining whether the combination of two non-sensitive passages is sensitive comprises:
performing searches through a corpus based on the combination of the two passages and determining hit counts returned for each passage and for the combination; and
determining whether the combination of the two passages is sensitive based on the hit count for the combination and the hit counts for the individual passages.
20. The system of claim 17 , wherein the non-sensitive-passage database comprises contents from a public domain.
21. The system of claim 20 , wherein the public domain comprises company-related external web pages, marketing brochures, and news reports.
22. The system of claim 17 , further comprising:
a detection mechanism configured to detect whether the passage triggers a cut-and-paste attack detection;
a forwarding mechanism configured to forward the passage to an administrator to determine whether the passage is non-sensitive based on a feedback from the administrator responsive to determining that the passage is not known to be non-sensitive; and
an addition mechanism configured to add the passage to the non-sensitive-passage database responsive to determining the passage to be non-sensitive based on the feedback.
23. The system of claim 22 , further comprising a mechanism configured to release the document in response to the passages triggering the cut-and-paste attack detections being determined to be non-sensitive.
24. The system of claim 22 , wherein detecting whether the passage triggers the cut-and-paste attack comprises:
fingerprinting the passage; and
comparing the passage's fingerprint with stored fingerprints of a set of training documents.