Data processing systems and methods for automatically detecting target data transfers and target data processing

Patent metadata

Field	Value
Publication number	US-11526624-B2
Application number	US-202117480377-A
Country	US
Kind code	B2
Filing date	Sep 21, 2021
Priority date	Sep 21, 2020
Publication date	Dec 13, 2022
Grant date	Dec 13, 2022

Abstract

Aspects of the present disclosure provide methods, apparatuses, systems, computing devices, computing entities, and/or the like for protection of system software, or data from destruction, unauthorized modification, and/or unauthorized disclosure securing by, for example, detecting the transfer and/or processing of target data. Accordingly, a method is provided that involves: scanning a software application to identify functionality configured for processing target data; identifying fields associated with the functionality; identifying metadata associated with a field; generating, from the metadata, an identification of a type of data associated with the field; determining a location based on the processing of the target data by the functionality; determining a risk associated with the functionality processing the target data based on the location and the type of data; determining that the risk satisfies a threshold level of risk; and in response, causing an action to be performed to mitigate the risk.

First claim

We claim:

1. A method comprising:
scanning, by computing hardware, a software application to identify functionality configured for processing target data;
identifying, by the computing hardware, a plurality of fields associated with the functionality;
identifying, by the computing hardware, metadata associated with a field from the plurality of fields;
generating, by the computing hardware and from the metadata, an identification of a type of data associated with the field using at least one of a rules-based model or a machine-learning model;
determining, by the computing hardware, a first location and a second location based on the processing of the target data by the functionality, wherein determining the first location and the second location comprises activating the functionality via requests originating from a plurality of computing systems in a plurality of locations;
determining, by the computing hardware, a risk associated with the functionality processing the target data based on the first location, the second location, and the type of data for the field, wherein determining the risk comprises:
determining a first risk associated with the first location identified by activating the functionality,
determining a second risk associated with the second location identified by activating the functionality, and
setting the risk to at least the second risk based on the second risk being greater than the first risk;

determining, by the computing hardware and based on at least one of the functionality or the type of data for the field, a threshold level of risk;
determining, by the computing hardware, that the risk satisfies the threshold level of risk; and
responsive to determining that the risk satisfies the threshold level of risk, causing, by the computing hardware, an action to be performed to mitigate the risk, wherein the action comprises at least one of causing the software application to become unavailable, generating an electronic communication sent to personnel identifying the functionality and the risk, or disabling the functionality in the software application.

2. The method of claim 1 , wherein the risk comprises at least one of a risk of experiencing a data privacy incident due to the functionality processing the target data and a risk of being noncompliant with a data privacy standard due to the functionality processing the target data.

3. The method of claim 1 further comprising:
determining, by the computing hardware, a vendor associated with the functionality based on metadata associated with the functionality, wherein at least one of the first location or the second location is a jurisdiction in which the vendor processes data and processing of the target data by the functionality involves transferring the target data to at least one of the first location or the second location.

4. The method of claim 1 , wherein the software application comprises a website and the functionality comprises a webform found on the website in which at least one of the plurality of fields is used on the webform to collect the target data.

5. The method of claim 1 , wherein the software application comprises a mobile application and the functionality comprises a graphical user interface provided through the mobile application in which at least one of the plurality of fields is used on the graphical user interface to collect the target data.

6. The method of claim 1 , wherein determining the risk associated with the functionality processing the target data based on the type of data for the field, the first location, and the second location involves using at least one of a second rules-based model or a second machine learning model to generate the first risk and the second risk, wherein each of the first risk and the second risk represents a likelihood of experiencing at least one of a data privacy incident due to the functionality processing the target data or being noncompliant with a data privacy standard due to the functionality processing the target data.

7. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
scanning a software application to identify functionality configured for processing target data;
identifying metadata associated with the functionality;
processing the metadata using at least one of a rules-based model or a machine learning model to generate an identification of a type of data associated with the functionality;
determining a first location and a second location based on the processing of the target data by the functionality, wherein determining the first location and the second location comprises activating the functionality via requests originating from a plurality of computing systems in a plurality of locations;
determining a risk associated with the functionality processing the target data based on the type of data, the first location, and the second location, wherein determining the risk comprises:
determining a first risk associated with the first location identified by activating the functionality,
determining a second risk associated with the second location identified by activating the functionality, and
setting the risk to at least the second risk based on the second risk being greater than the first risk;

determining the risk satisfies a threshold level of risk; and
responsive to determining the risk satisfies the threshold level of risk, causing an action to be performed to mitigate the risk, wherein the action comprises at least one of causing the software application to become unavailable, generating an electronic communication sent to personnel identifying the functionality and the risk, or disabling the functionality in the software application.

8. The system of claim 7 , wherein the risk comprises at least one of a risk of experiencing a data privacy incident due to the functionality processing the target data or a risk of being noncompliant with a data privacy standard due to the functionality processing the target data.

9. The system of claim 7 , wherein the operations further comprise:
determining a vendor associated with the functionality based on the metadata, wherein at least one of the first location or the second location is a jurisdiction in which the vendor is located and processing of the target data by the functionality involves transferring the target data to at least one of the first location or the second location.

10. The system of claim 7 , wherein determining the risk associated with the functionality processing the target data based on the type of data, the first location, and the second location involves processing the type of data, the first location, and the second location using at least one of a second rules-based model or a second machine learning model to generate each of the first risk and the second risk representing a likelihood of experiencing at least one of a data privacy incident due to the functionality processing the target data or being noncompliant with a data privacy standard due to the functionality processing the target data.

11. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
scanning a software application to identify functionality configured for processing target data;
identifying metadata associated with the functionality;
identifying a type of data associated with the functionality based on the metadata;
d

Assignees

• Onetrust Llc

Inventors

• Brannon Jonathan Blake
• Whitney Patrick

Classifications

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title