Method and system for detecting sensitive data

An apparatus comprising:

• a processor;
• a memory coupled to the processor;
• and
• a sensitive data detector in the memory and executed by the processor, the sensitive data detector comprising:
• a keyword matcher, executed during a first stage of the sensitive data detector, that matches predetermined keywords in input text, and determines text in vicinities of matched keywords in the input text in which sensitive data is likely to be found, wherein the keyword matcher comprises a pre-constructed automaton configured to match the predetermined keywords in a single pass over the input text;
• and
• a pattern matcher, executed during a second stage of the sensitive data detector, that receives input from the keyword matcher and matches predefined patterns associated with sensitive data to the text in vicinities of matched keywords to detect sensitive data;
• and
• a validator, executed during a third stage of the sensitive data detector, that selects a checksum to apply based on a sensitive data type identified by the pattern matcher and applies the checksum to validate the sensitive data detected by the pattern matcher;
• wherein the keyword matcher executes prior to the pattern matcher;
• and
• wherein the text in vicinities of matched keywords is substantially shorter in length than the input text.