SYSTEM AND METHOD FOR LEARNING SEMANTIC ROLES OF INFORMATION ELEMENTS
Rules are automatically learned via machine-learning techniques to deduce the semantic roles of extracted information elements, as well as, compute the respective levels of certainty that the semantic roles are indeed as deduced. Such a process is referred to herein as “tagging” the information elements. The tagged information elements are then associated, in a database, with their respective deduced semantic roles and levels of certainty. The machine-learning techniques provided herein include supervised, unsupervised, and semi-supervised techniques. Embodiments described herein may be applied to data leakage prevention, cyber security, quality-of-service analysis, lawful interception, or any other relevant application.
1 . A system, comprising:
a network interface; and
one or more processors, configured to:
using training data that include information elements, automatically learn a rule that relates to a semantic role of at least a subset of the information elements,
subsequently, extract, from communication exchanged over a computer network and received via the network interface, an information element whose semantic role is uncertain, and
using the rule, deduce the semantic role of the extracted information element.
2 . The system according to claim 1 , wherein the processors are further configured to store the extracted information element, in a database, in a manner that indicates the deduced semantic role of the extracted information element.
3 . The system according to claim 1 , wherein the processors are configured to compute, using the rule, a level of certainty that the semantic role of the extracted information element is as deduced.
4 . The system according to claim 3 , wherein the processors are further configured to store the extracted information element, in a database, in association with the level of certainty.
5 . The system according to claim 1 , wherein the processors are configured to deduce the semantic role of the extracted information element by deducing that the extracted information element is a location of a particular device.
6 . The system according to claim 1 , wherein the information elements included in the training data include ground truth information elements whose respective semantic roles are certain, and wherein the processors are configured to use the training data by using the ground truth information elements.
7 . The system according to claim 6 , wherein the subset of the information elements includes uncertain training information elements whose respective semantic roles are uncertain, and wherein the processors are configured to automatically learn the rule by:
for each uncertain training information element of the uncertain training information elements:
selecting a corresponding one of the ground truth information elements that (i) is of the same type as the uncertain training information element, and (ii) was associated with a particular entity at a time that is within a particular threshold of a time at which the uncertain training information element was associated with the entity, and
ascertaining whether a value of the corresponding one of the ground truth information elements is sufficiently close to a value of the uncertain training information element; and
learning the rule, based on the ascertaining for all of the uncertain training information elements.
8 . The system according to claim 6 , wherein the information elements included in the training data were extracted from communication exchanged in accordance with a particular application protocol, and wherein the processors are configured to learn the rule by at least partly learning the particular application protocol.
9 . The system according to claim 1 , wherein the processors are configured to automatically learn the rule by ascertaining that respective values of the information elements in the subset are sufficiently close to each other.
10 . A method, comprising:
using training data that include information elements, automatically learning a rule that relates to a semantic role of at least a subset of the information elements;
subsequently, extracting, from communication exchanged over a computer network, an information element whose semantic role is uncertain; and
using the rule, deducing the semantic role of the extracted information element.
11 . The method according to claim 10 , further comprising storing the extracted information element, in a database, in a manner that indicates the deduced semantic role of the extracted information element.
12 . The method according to claim 10 , further comprising, using the rule, computing a level of certainty that the semantic role of the extracted information element is as deduced.
13 . The method according to claim 12 , further comprising storing the extracted information element, in a database, in association with the level of certainty.
14 . The method according to claim 10 , wherein deducing the semantic role of the extracted information element comprises deducing that the extracted information element is a location of a particular device.
15 . The method according to claim 10 , wherein the information elements included in the training data include ground truth information elements whose respective semantic roles are certain, and wherein using the training data comprises using the ground truth information elements.
16 . The method according to claim 15 , wherein the subset of the information elements includes uncertain training information elements whose respective semantic roles are uncertain, and wherein automatically learning the rule comprises:
for each uncertain training information element of the uncertain training information elements:
selecting a corresponding one of the ground truth information elements that (i) is of the same type as the uncertain training information element, and (ii) was associated with a particular entity at a time that is within a particular threshold of a time at which the uncertain training information element was associated with the entity, and
ascertaining whether a value of the corresponding one of the ground truth information elements is sufficiently close to a value of the uncertain training information element; and
learning the rule, based on the ascertaining for all of the uncertain training information elements.
17 . The method according to claim 15 , wherein the information elements included in the training data were extracted from communication exchanged in accordance with a particular application protocol, and wherein learning the rule comprises at least partly learning the particular application protocol.
18 . The method according to claim 10 , wherein automatically learning the rule comprises automatically learning the rule by ascertaining that respective values of the information elements in the subset are sufficiently close to each other.
19 . A computer software product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by one or more processors, cause the processors to:
using training data that include information elements, automatically learn a rule that relates to a semantic role of at least a subset of the information elements,
subsequently, extract, from communication exchanged over a computer network, an information element whose semantic role is uncertain, and
using the rule, deduce the semantic role of the extracted information element.
20 . The computer software product according to claim 19 , wherein the instructions further cause the processors to store the extracted information element, in a database, in a manner that indicates the deduced semantic role of the extracted information element.