# US 10,503,929 B2 · Visually configurable privacy enforcement > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,929 B2 - Document ID: US10503929B2 - Status: Granted - Kind: B2 - Application number: 15/243,278 - Filed: 2016-08-22 - Published: 2018-02-22 - Granted: 2019-12-10 - Earliest claimed: 2016-08-22 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Lior Horesh; Raya Horesh; Marco Pistoia; Omer Tripp - Web page: https://patentgrep.com/patent/US10503929B2 ## CPC - G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method is disclosed including presenting via a graphical user interface of an application at least one element that is activatable to specify a source of information as a source of information to be logged, receiving from the user via the graphical user interface an activation of the at least one element, and in response to receiving the activation of the at least one element, instrumenting the application to capture and log information received from the specified source of information, capturing information received by the application from the specified source using the instrumentation, logging the information in memory, capturing data that is output by the application, comparing the captured data to the logged information, determining based on the comparison that a leak of the information has occurred, and in response to determining that a leak of the information has occurred, performing a corrective action. ## Claims ### Claim 1 A method performed by at least one hardware processor, comprising: presenting via a graphical user interface of an application installed on a user device at least one element associated with a source of information, the at least one element activatable by the user to specify the source of information as a source of information to be logged; receiving from the user via the graphical user interface, an activation of the at least one element, the activation specifying that the source of information is to be logged; in response to receiving the activation of the at least one element, instrumenting the application using a configuration file, the instrumentation configured to capture and log information received from the specified source of information, wherein the instrumentation is performed based on a setting for the instrumentation in the configuration file being set to active in response to receiving the activation of the at least one element, the instrumentation is configurable based on changes to the configuration file, and instrumenting the application comprises, based on an operating system of the user device, performing one of: modifying compiled bytecode of the application to inject a custom class loader into the application, wherein the custom class loader loads specialized versions of classes of an application program interface (API) of the operating system instead of an original version of the classes in response to calls made by the application to the classes of the API, and the specialized version includes additional code for tracking and logging the source of information specified by the activation; and modifying, in a dispatch table, mappings between selectors and underlying functions in classes of the API to redirect method calls from the application to method calls that are specified for tracking and logging the source of information specified by the activation; capturing information received by the application from the specified source using the instrumentation; logging the captured information in memory; capturing data that is output by the application; comparing the captured data to the logged information, wherein the comparing comprises: determining a similarity between the captured data and the logged information based on a string-similarity analysis; determining that the similarity is above a pre-determined threshold value; in response to the similarity being greater than the pre-determined threshold value, determining based on the comparison that a leak of the information has occurred; in response to determining that a leak of the information has occurred, performing at least one corrective action, wherein the at least one corrective action comprises preventing the captured data from exiting the application, reformatting the captured data, encrypting the captured data, and sending a notification to a developer of the application of the leak of the information. ### Claim 2 (depends on 1) The method of claim 1, wherein the source of information is an input field of the graphical user interface of the application. ### Claim 3 (depends on 2) The method of claim 2, further comprising receiving an activation of the input field, the presentation of the at least one element occurring in response to the received activation of the input field. ### Claim 4 (depends on 1) The method of claim 1, wherein the source of information is an environment variable of the application. ### Claim 5 (depends on 4) The method of claim 4, further comprising receiving an activation of a portion of the graphical user interface other than an input field, the presenting of the at least one element occurring in response to the received activation of the portion of the graphical user interface other than an input field. ### Claim 6 (depends on 1) The method of claim 1, wherein instrumenting the application comprises injecting instrumentation into executable code of the application. ### Claim 7 (depends on 6) The method of claim 6, wherein instrumenting the application comprises the use of at least one of a custom class loader and method swizzling. ### Claim 8 (depends on 1) The method of claim 1, wherein the string-similarity analysis comprises one of: a determination of a Hamming distance between the captured data and the logged information; and a determination of a Levenshtein distance between the captured data and the logged information. ### Claim 9 (depends on 1) The method of claim 1, wherein determining the similarity between the captured data and the logged information further comprises applying a Bayesian algorithm. ### Claim 10 (depends on 1) The method of claim 1, further comprising: detecting a selection of an input field in the graphical user interface made by the user; and prompting the user to perform an additional action in the graphical user interface; wherein presenting the at least one element associated with the source of information via the graphical user interface is performed in response to the user having performed the additional action in the graphical user interface. ### Claim 11 (depends on 1) The method of claim 1, further comprising: detecting a selection of a portion in the graphical user interface made by the user, wherein the portion does not include an input field; and prompting the user to perform an additional action in the graphical user interface; wherein presenting the at least one element associated with the source of information via the graphical user interface is performed in response to the user having performed the additional action in the graphical user interface. ### Claim 12 (depends on 1) The method of claim 1, wherein the configuration file is an Extensible Markup Language (XML) file. ### Claim 13 A system comprising: at least one hardware processor configured to: present via a graphical user interface of an application installed on a user device at least one element associated with a source of information, the at least one element activatable by the user to specify the source of information as a source of information to be logged; receive from the user via the graphical user interface, an activation of the at least one element, the activation specifying that the source of information is to be logged; in response to receiving the activation of the at least one element, instrument the application using a configuration file and based on an operating system of the user device, the instrumentation configured to capture and log information received from the specified source of information, wherein the instrumentation is performed based on a setting for the instrumentation in the configuration file being set to active in response to receiving the activation of the at least one element, the instrumentation is configurable based on changes to the configuration file, and wherein to instrument the application based on the operating system of the user device, the at least one hardware processor is further configured to perform one of: modify compiled bytecode of the application to inject a custom class loader into the application, wherein the custom class loader loads specialized versions of classes of an application program interface (API) of the operating system instead of an original version of the classes in response to calls made by the application to the classes of the API, and the specialized version includes additional code for tracking and logging the source of information specified by the activation; and modify, in a dispatch table, mappings between selectors and underlying functions in classes of the API to redirect method calls from the application to method calls that are specified for tracking and logging the source of information specified by the activation; capture information received by the application from the specified source using the instrumentation; log the captured information in memory; capture data that is output by the application; compare the captured data to the logged information, wherein to compare the captured data, the at least one hardware processor is further configured to: determine a similarity between the captured data and the logged information based on a string-similarity analysis; determine that the similarity is above a pre-determined threshold value; in response to the similarity being greater than the pre-determined threshold value, determine based on the comparison that a leak of the information has occurred; and in response to determining that a leak of the information has occurred, performing at least one corrective action, wherein the at least one corrective action comprises preventing the captured data from exiting the application, reformatting the captured data, encrypting the captured data, and sending a notification to a developer of the application of the leak of the information. ### Claim 14 (depends on 13) The system of claim 13, wherein the source of information is an input field of the graphical user interface of the application, the at least one hardware processor further configured to receive an activation of the input field, the presentation of the at least one element occurring in response to the received activation of the input field. ### Claim 15 (depends on 13) The system of claim 13, wherein the source of information is an environment variable of the application, the at least one hardware processor further configured to receive an activation of a portion of the graphical user interface other than an input field, the presenting of the at least one element occurring in response to the received activation of the portion of the graphical user interface other than an input field. ### Claim 16 (depends on 13) The system of claim 13, wherein instrumenting the application comprises injecting instrumentation into executable code of the application. ### Claim 17 (depends on 16) The system of claim 16, wherein instrumenting the application comprises the use of at least one of a custom class loader and method swizzling. ### Claim 18 An apparatus comprising: a display; at least one input device; at least one hardware processor associated with the at least one input device and the display, the at least one hardware processor configured to: present via the display, a graphical user interface of an application installed on the apparatus; present via the graphical user interface at least one element associated with a source of information, the at least one element activatable by the user via the input device to specify the source of information as a source of information to be logged; receive from the user via the at least one input device, an activation of the at least one element, the activation specifying that the source of information is to be logged; in response to receiving the activation of the at least one element, instrument the application using a configuration file and based on an operating system of the user device, the instrumentation configured to capture and log information received from the specified source of information, wherein the instrumentation is performed based on a setting for the instrumentation in the configuration file being set to active in response to receiving the activation of the at least one element, the instrumentation is configurable based on changes to the configuration file, and wherein to instrument the application based on the operating system of the user device, the at least one hardware processor is further configured to perform one of: modify compiled bytecode of the application to inject a custom class loader into the application, wherein the custom class loader loads specialized versions of classes of an application program interface (API) of the operating system instead of an original version of the classes in response to calls made by the application to the classes of the API, and the specialized version includes additional code for tracking and logging the source of information specified by the activation; and modify, in a dispatch table, mappings between selectors and underlying functions in classes of the API to redirect method calls from the application to method calls that are specified for tracking and logging the source of information specified by the activation; capture information received by the application from the specified source using the instrumentation; log the captured information in memory; capture data that is output by the application; compare the captured data to the logged information, wherein to compare the captured data, the at least one hardware processor is further configured to: determine a similarity between the captured data and the logged information based on a string-similarity analysis; determine that the similarity is above a pre-determined threshold value; in response to the similarity being greater than the pre-determined threshold value, determine based on the comparison that a leak of the information has occurred; and in response to determining that a leak of the information has occurred, performing at least one corrective action, wherein the at least one corrective action comprises preventing the captured data from exiting the application, reformatting the captured data, encrypting the captured data, and sending a notification to a developer of the application of the leak of the information. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the source of information is an input field presented by the graphical user interface of the application, wherein the at least one hardware processor is further configured to receive an activation of the input field from the input device, the presentation of the at least one element via the graphical user interface occurring in response to the received activation of the input field. ### Claim 20 (depends on 18) The apparatus of claim 18, wherein the source of information is an environment variable of the application, wherein the at least one hardware processor is further configured to receive an activation of a portion of the graphical user interface other than an input field via the user input, the presentation of the at least one element via the display occurring in response to the received activation of the portion of the graphical user interface other than an input field.