# US 11,030,150 B1 · Systems and methods for classifying electronic files > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,150 B1 - Document ID: US11030150B1 - Status: Granted - Kind: B1 - Application number: 15/583,410 - Filed: 2017-05-01 - Granted: 2021-06-08 - Earliest claimed: 2017-05-01 - Assignees: NortonLifeLock Inc. - Applicants: Symantec Corporation - Inventors: Ilya Sokolov; Lei Gu; Keith Newstadt - Web page: https://patentgrep.com/patent/US11030150B1 ## CPC - G06F 16/11: File system administration, e.g. details of archiving or snapshots (error detection or correction of the data by redundancy in operations G06F11/14) - G06F 16/13: File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) - G06F 16/168: {Details of user interfaces specifically adapted to file systems, e.g. browsing and visualisation, 2d or 3d GUIs (query results presentation G06F16/156)} - G06F 16/285: {Clustering or classification} - H04L 67/04: specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 67/566: Grouping or aggregating service requests, e.g. for unified processing - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosed computer-implemented method for classifying electronic files may include (i) identifying an electronic file that is being evaluated for importance by a file-categorization system, (ii) collecting, via at least one user-state monitoring device, information about a physical state of at least one user while the user is interacting with the electronic file, (iii) determining, based on the information about the physical state of the user while the user was interacting with the electronic file, whether the user considers the electronic file to be important, and (iv) classifying, by the file-categorization system and based at least in part on determining whether the user considers the electronic file to be important, the electronic file as an important file. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for classifying electronic files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a plurality of instances of an electronic file that comprises a plurality of versions of the electronic file; in response to determining that a user from among a plurality of users is interacting with one or more instances of an electronic file by opening the one or more instances of the electronic file on a computing device, causing a file-categorization system to evaluate the one or more instances of the electronic file for importance; collecting, via at least one user-state monitoring device, information about a physical state of at least one user while the user is interacting with the one or more instances of the electronic file; determining, based on the information about the physical state of the user while the user was interacting with the one or more instances of the electronic file, whether the user considers the one or more instances of the electronic file to be important; classifying, by the file-categorization system and based at least in part on determining whether each user in the plurality of users that has interacted with the one or more instances of the electronic file considers the one or more instances of the electronic file to be important, the plurality of instances of the electronic file as important files; and in response to classifying the plurality of instances of the electronic file as important files, notifying at least one software security system that the plurality of instances of the electronic file are important files, thereby causing the at least one software security system to prioritize actions involving the important files over actions involving electronic files that are not classified as important files. ### Claim 2 (depends on 1) The method of claim 1, wherein determining whether the user considers the one or more instances of the electronic file to be important comprises calculating, based on the information about the physical state of the user, an attention score that represents a numerical approximation of whether the user considers the one or more instances of the electronic file to be important. ### Claim 3 (depends on 2) The method of claim 2, wherein the attention score comprises a percentage probability that the user considers the one or more instances of the electronic file to be important. ### Claim 4 (depends on 2) The method of claim 2, wherein the attention score is based on at least one of: the frequency with which the user views the one or more instances of the electronic file; and the rate at which the user scrolls through the one or more instances of the electronic file. ### Claim 5 (depends on 2) The method of claim 2: further comprising calculating an attention score for each user in a plurality of users that interact with one or more instances of the electronic file; and wherein classifying the plurality of instances of the electronic file as important files comprises classifying the plurality of instances of the electronic file based on an aggregate attention score that represents an approximation of whether the plurality of users considers the plurality of instances of the electronic file to be important. ### Claim 6 (depends on 1) The method of claim 1, wherein the physical state of the user comprises at least one of the user's: heart rate; respiration rate; brainwave activity; and facial microexpressions. ### Claim 7 (depends on 1) The method of claim 1, wherein collecting information about the physical state of the user comprises tracking the direction of the user's field of vision. ### Claim 8 (depends on 7) The method of claim 7, further comprising identifying, based on analyzing the direction of the user's field of vision, an important section of the one or more instances of the electronic file. ### Claim 9 (depends on 1) The method of claim 1, wherein classifying the plurality of instances of the electronic file as important files comprises classifying the plurality of instances of the electronic file based on a role within an organization that is associated with the user. ### Claim 10 (depends on 9) The method of claim 9, wherein classifying the plurality of instances of the electronic file based on the role within the organization comprises classifying the plurality of instances of the electronic file as important to at least one of: the user; an organization; and a department within the organization. ### Claim 11 (depends on 1) The method of claim 1, wherein determining whether the user considers the one or more instances of the electronic file to be important comprises analyzing the state of the user's electronic workspace while the user was interacting with the one or more instances of the electronic file. ### Claim 12 (depends on 1) The method of claim 1: further comprising: determining that the plurality of instances of the electronic file is part of an enterprise workflow; and identifying a plurality of users involved in the enterprise workflow; and wherein classifying the plurality of electronic files comprises classifying the plurality of instances of the electronic file as important files based at least in part on determining whether each user in the plurality of users considers at least one instance in the plurality of instances of the electronic file to be important. ### Claim 13 (depends on 1) The method of claim 1, wherein collecting the information about the physical state of the user comprises collecting information from at least one wearable device worn by the user. ### Claim 14 (depends on 1) The method of claim 1, wherein the software security system comprises at least one of: a data-loss prevention system; a file backup system; and a file-integrity management system. ### Claim 15 A system for classifying electronic files, the system comprising: an identification module, stored in a memory of the system, that: identifies a plurality of instances of an electronic file comprising a plurality of versions of the electronic file; and in response to determining that a user from among a plurality of users is interacting with one or more instances of an electronic file by opening the one or more instances of the electronic file on a computing device, causes a file-categorization system to evaluate the one or more instances of the electronic file for importance; a collection module, stored in the memory, that collects, via at least one user-state monitoring device, information about a physical state of at least one user while the user is interacting with the one or more instances of the electronic file; a determination module, stored in the memory, that determines, based on the information about the physical state of the user while the user was interacting with the one or more instances of the electronic file, whether the user considers the one or more instances of the electronic file to be important; a classification module, stored in the memory, that: classifies, by the file-categorization system and based at least in part on determining whether each user in the plurality of users that has interacted with the one or more instances of the electronic file considers the one or more instances of the electronic file to be important, the plurality of instances of the electronic file as important files; and in response to classifying the plurality of instances of the electronic file as important files, notifies at least one software security system that the plurality of instances of the electronic file are important files, thereby causing the at least one software security system to prioritize actions involving the important files over actions involving electronic files that are not classified as important files; and at least one physical processor configured to execute the identification module, the collection module, the determination module, and the classification module. ### Claim 16 (depends on 15) The system of claim 15, wherein the determination module determines whether the user considers the one or more instances of the electronic file to be important comprises calculating, based on the information about the physical state of the user, an attention score that represents a numerical approximation of whether the user considers the one or more instances of the electronic file to be important. ### Claim 17 (depends on 16) The system of claim 16, wherein the attention score comprises a percentage probability that the user considers the one or more instances of the electronic file to be important. ### Claim 18 (depends on 16) The system of claim 16, wherein the attention score is based on at least one of: the frequency with which the user views the one or more instances of the electronic file; and the rate at which the user scrolls through the one or more instances of the electronic file. ### Claim 19 (depends on 16) The system of claim 16, wherein: the determination module calculates an attention score for each user in a plurality of users that interact with at least one instance of the electronic file; and the classification module classifies the plurality of instances of the electronic file as important files by classifying the plurality of instances of the electronic file based on an aggregate attention score that represents an approximation of whether the plurality of users considers the plurality of instances of the electronic file to be important. ### Claim 20 A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: identify a plurality of instances of an electronic file that comprises a plurality of versions of the electronic file; in response to determining that a user from among a plurality of users is interacting with one or more instances of an electronic file by opening the one or more instances of the electronic file on a computing device, cause a file-categorization system to evaluate the one or more instances of the electronic file for importance; collect, via at least one user-state monitoring device, information about a physical state of at least one user while the user is interacting with the one or more instances of the electronic file; determine, based on the information about the physical state of the user while the user was interacting with the one or more instances of the electronic file, whether the user considers the one or more instances of the electronic file to be important; classify, by the file-categorization system and based at least in part on determining whether each user in the plurality of users that has interacted with the one or more instances of the electronic file considers the one or more instances of the electronic file to be important, the plurality of instances of the electronic file as important files; and in response to classifying the plurality of instances of the electronic file as important files, notify at least one software security system that the plurality of instances of the electronic file are important files, thereby causing the at least one software security system to prioritize actions involving the important files over actions involving electronic files that are not classified as important files.