Automatic identification of files with proprietary information

Patent metadata

Field	Value
Publication number	US-12105852-B2
Application number	US-202217804833-A
Country	US
Kind code	B2
Filing date	May 31, 2022
Priority date	May 31, 2022
Publication date	Oct 1, 2024
Grant date	Oct 1, 2024

Abstract

A system for identifying of presence of protected data in an unknown file includes a processor coupled to a memory storing instructions, the processor being configured to implement the instructions to apply a sliding window process to generate one or more fragments of length, for each generated fragment, check whether information about the generated fragment exists in a library of known fragments of protected data, and if the information about the generated fragment from the unknown file exists in the library of known fragments of protected data, perform steps to reflect an existence of the information about the generated fragment.

First claim

The invention claimed is:

1. A method for creating a notice that identifies protected data in an unknown file of length L within a computer network, the method comprising:
populating a library of known fragments of protected data using a library sliding window to generate the known fragments from a plurality of known files, including:
extracting a known file N-fragment i from a known file of the plurality of known files,
adding the known file N-fragment i and a hierarchical class of the known file and a number of different files of other hierarchical classes that includes the known file N-fragment i to the library of known fragments,
incrementing i based on the library sliding window and repeating the extracting and adding until another N-fragment sequence of symbols in the known file cannot be extracted, and
repeating the extracting, adding, and incrementing for the plurality of known files;

generating an N-fragment N(I) of continuous symbols of length N starting with symbol I from the unknown file for each integer I starting with K: K>0, K<L−N+1, with integer step S(I): S(I)>0, I+S(K)<L−N+1;
checking, for each generated fragment, whether information about the generated fragment exists in the library of known fragments of protected data, wherein the checking stops after a first match is found in the library of known fragments that identifies the presence of protected data; and
creating a notice indicating that the unknown file contains protected data and the hierarchical class if the information about the generated fragment from the unknown file exists in the library of known fragments of protected data; and
communicating the notice to at least one networked computer.

2. The method of claim 1 , further comprising the step of performing preprocessing steps before the step of generating an N-fragment N(I).

3. The method of claim 1 , wherein the step of generating an N-fragment N(I) starts at a first symbol.

4. The method of claim 1 , wherein the step of generating an N-fragment N(I) starts at a location calculated according to a predetermined formula.

5. The method of claim 1 , wherein the step of generating an N-fragment N(I) comprises a sliding window process starting at a location calculated according to predetermined criteria.

6. The method of claim 1 , wherein the step of generating an N-fragment N(I) comprises a sliding window process applies an iterative step of 1 symbol.

7. The method of claim 1 , wherein the step of generating an N-fragment N(I) comprises a sliding window process applies an iterative step calculated according to a predetermined formula or criteria.

8. The method of claim 1 , further comprising the step of preprocessing unknown files according to a file type.

9. The method of claim 1 , further comprising the step of preprocessing predetermined binary unknown files.

10. The method of claim 1 , further comprising:
preprocessing the unknown file depending on a detected type of the unknown file including by a first formatting for a first type of content of the unknown file and a second formatting for a second type of content of the unknown file.

11. The method of claim 1 , further comprising:
generating a hash of N-fragment N(I) by applying an arithmetic operation to a hash of N-fragment N(I−1) and symbols removed between N-fragment N(I−1) and N-fragment N(I).

12. A system for identifying the presence of protected data in an unknown file, the system comprising:
a processor coupled to a memory storing instructions, the processor being configured to implement the instructions to:
populate a library of known fragments of protected data using a library sliding window to generate the known fragments from a plurality of known files, including:
extracting a known file N-fragment i from a known file of the plurality of known files,
adding the known file N-fragment i and a hierarchical class of the known file and a number of different files of other hierarchical classes that includes the known file N-fragment i to the library of known fragments,
incrementing i based on the library sliding window and repeating the extracting and adding until another N-fragment sequence of symbols in the known file cannot be extracted, and
repeating the extracting, adding, and incrementing for the plurality of known files;

apply a sliding window process to generate one or more fragments of length;
check, for each generated fragment, whether information about the generated fragment exists in the library of known fragments of protected data, wherein the check of whether information about the generated fragment exists in the library of known fragments stops after a first match is found; and
if the information about the generated fragment from the unknown file exists in the library of known fragments of protected data, either change or create a record indicating that the unknown file contains protected data and the hierarchical class or send a communication indication that the unknown file contains protected data and the hierarchical class.

13. The system according to claim 12 , wherein the processor is further configured to perform preprocessing steps before the sliding window process is applied.

14. The system according to claim 12 , wherein the sliding window process starts at a first symbol.

15. The system according to claim 12 , wherein the sliding window process starts at a location calculated according to a predetermined formula.

16. The system according to claim 12 , wherein the sliding window process starts at a location calculated according to predetermined criteria.

17. The system according to claim 12 , wherein the sliding window process applies an iterative step of 1 symbol.

18. The system according to claim 12 , wherein the sliding window process applies an iterative step calculated according to a certain formula or criteria.

19. The system according to claim 12 , wherein the processor is further configured to preprocess unknown files according to file type.

20. The system according to claim 12 , wherein the processor is further configured to preprocess predetermined binary unknown files.

Assignees

• Acronis Int Gmbh

Inventors

• Berko Nickolay
• Klimov Ivan
• Bell Serg
• Protasov Stanislav

Classifications

• G06Q50/184

  Intellectual property management · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title