US 11,693,960 B2Granted

System and method for detecting leaked documents on a computer network

AssigneeIntSights Cyber Intelligence Ltd.

InventorsGal Ben David, Amir Hozez, Alon Arvatz, Guy Nizan, Shmuel Ur

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and a method of obtaining a location of a document on a computer network based on a document property. The method may include: receiving at least one basic marker and an encoding function associated with the document property; generating a search term according to the encoding function, based on the at least one basic marker; providing the search term to at least one search engine and obtaining therefrom one or more search results corresponding, where each search result may include one or more references to locations of documents on the computer network; discovering at least one document having the document property from the one or more search results and obtaining a discovered location of the document on the computer network; and performing at least one rule-based action, according to at least one document property of the discovered document.

Claims21

Dependent claims

A method for detecting leaked documents, the method comprising:

using at least one processor to perform:
generating one or more search terms using at least one basic marker and at least one encoding function associated with at least one document property of a document;
providing the one or more search terms to at least one search engine and obtaining therefrom one or more search results corresponding to the one or more search terms, wherein the one or more search results include one or more references to locations of documents on a computer network;
identifying, from among the one or more search results and using at least one decoding function associated with the at least one encoding function, at least one document having the at least one document property and a respective at least one identified location on the computer network;
classifying the at least one identified document, based on the at least one identified location, content, and/or property of the at least one identified document, to obtain a respective at least one classification of the at least one identified document;
selecting at least one action according to the at least one classification of the at least one identified document;
and
applying the at least one action on a network entity, wherein the at least one action comprises generating a notification message to the network entity and/or configuring the network entity to restrict transfer of data between the network entity and the at least one identified location.

5 more elements

A method for detecting leaked documents, the method comprising

using at least one processor to perform:
generating one or more search terms using at least one basic marker and at least one encoding function associated with at least one document property of a document, wherein the encoding function comprises at least one obfuscation element;
providing the one or more search terms to at least one search engine and obtaining therefrom one or more search results corresponding to the one or more search terms, wherein the one or more search results include one or more references to locations of documents on a computer network;
identifying, from among the one or more search results, at least one document having the at least one document property and a respective at least one identified location on the computer network, the identifying comprising:
retrieving one or more documents according to their respective locations given in the one or more search results, and
applying a decoding function to the one or more retrieved documents to identify the at least one document having the at least one document property;
and
performing at least one action according to the at least one document property of the at least one identified document,
wherein the at least one action is selected from the group of actions consisting of:
sending a request message to one or more online host devices associated with the at least one identified location;
sending a warning notification to one or more local host devices;
marking the at least one identified document as compromised on a local document repository;
and
storing the at least one identified location on the local document repository.

11 more elements

A system for detecting leaked documents, the system comprising:

a non-transitory memory storing executable code;
and
at least one processor that, upon executing the executable code, performs a method comprising:
generating one or more search terms using at least one basic marker and at least one encoding function associated with at least one document property of a document, wherein the encoding function comprises at least one obfuscation element;
providing the one or more search terms to at least one search engine and obtaining therefrom one or more search results corresponding to the one or more search terms, wherein the one or more search results include one or more references to locations of documents on a computer network;
identifying, from among the one or more search results, at least one document having the at least one document property and a respective at least one identified location on the computer network, the identifying comprising:
retrieving one or more documents according to their respective locations given in the one or more search results, and
applying a decoding function to the one or more retrieved documents to identify the at least one document having the at least one document property;
and
performing at least one action according to the at least one document property of the at least one identified document,
wherein the at least one action is selected from the group of actions consisting of:
sending a request message to one or more online host devices associated with the at least one identified location;
sending a warning notification to one or more local host devices;
marking the at least one identified document as compromised on a local document repository;
and
storing the at least one identified location on the local document repository.

13 more elements

At least one non-transitory memory storing executable code that, when executed by at least one processor, causes the at least one processor to perform a method comprising:

generating one or more search terms using at least one basic marker and at least one encoding function associated with at least one document property of a document, wherein the encoding function comprises at least one obfuscation element;
providing the one or more search terms to at least one search engine and obtaining therefrom one or more search results corresponding to the one or more search terms, wherein the one or more search results include one or more references to locations of documents on a computer network;
identifying, from among the one or more search results, at least one document having the at least one document property and a respective at least one identified location on the computer network, the identifying comprising:
retrieving one or more documents according to their respective locations given in the one or more search results, and
applying a decoding function to the one or more retrieved documents to identify the at least one document having the at least one document property;
and
performing at least one action according to the at least one document property of the at least one identified document,
wherein the at least one action is selected from the group of actions consisting of:
sending a request message to one or more online host devices associated with the at least one identified location;
sending a warning notification to one or more local host devices;
marking the at least one identified document as compromised on a local document repository;
and
storing the at least one identified location on the local document repository.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/323,292Filed 18 May 2021 · continuation
Priority: 8 Jan 2019
Published: US 2021/0271756 A12 Sep 2021
Granted: 4 Jul 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 21/556
Detecting local intrusion or implementing counter-measures: involving covert channels, i.e. data leakage between processes
G06F 16/148
Details of searching files based on file metadata: file search processing
G06F 16/953
Retrieval from the web: querying, e.g. by the use of web search engines
H04L 63/0263
Filtering policies: rule management

Family

Application16/242,018Parent of this continuation · filed 8 Jan 2019
US 2021/0271756 A1Pre-grant publication · published 2 Sep 2021
US 11,120,129 B2Parent of this continuation
US 2020/0218804 A1Published application
US 11,693,960 B2This patent

From the US filing history. Foreign family members aren’t listed.