# US 2021/0240845 A1 · Enterprise document classification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240845 A1
- Document ID: US20210240845A1
- Status: Published application
- Kind: A1
- Application number: 17/217,181
- Filed: 2021-03-30
- Published: 2021-08-05
- Earliest claimed: 2018-04-13
- Assignees: Sophos Limited
- Applicants: Sophos Limited
- Inventors: Andrew J. Thomas
- Web page: https://patentgrep.com/patent/US20210240845A1

## CPC

- G06F 21/45: Structures or tools for the administration of authentication
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)}
- G06F 16/285: {Clustering or classification}
- G06F 16/93: Document management systems
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06N 3/0675: {using electro-optical, acousto-optical or opto-electronic means}
- G06N 5/046: Forward inferencing; Production systems
- G06N 5/048: Fuzzy inferencing
- G06N 20/00: Machine learning
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/16: the keys or algorithms being changed during operation
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04L 9/3271: {using challenge-response}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 41/20: {Network management software packages}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0838: {using one-time-passwords}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/102: {Entity profiles}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06F 2221/034: Test or assess a computer or a system
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 2463/082: applying multi-factor authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A collection of documents or other files and the like within an enterprise network are labelled according to an enterprise document classification scheme, and then a recognition model such as a neural network or other machine learning model can be used to automatically label other files throughout the enterprise network. In this manner, documents and the like throughout an enterprise can be automatically identified and managed according to features such as confidentiality, sensitivity, security risk, business value, and so forth.

## Claims

### Claim 1

A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
selecting a plurality of documents stored in an enterprise network;
labeling each of the plurality of documents with a business value, thereby providing a labeled data set;
configuring a recognition model with the labeled data set to score the business value for a new document based on a file location of the new document in the enterprise network, an organization role of a user in an access control list associated with the new document, and content of the new document;
selecting a document in the enterprise network other than the plurality of documents in the labeled data set to use as the new document;
scoring the business value of the new document with the recognition model; and
applying an enterprise policy to the new document based upon the business value, wherein the enterprise policy controls at least one of document access and document movement.

### Claim 2 (depends on 1)

The computer program product of claim 1 wherein the recognition model includes a machine learning model trained to estimate business value based on the labeled data set.

### Claim 3

A method comprising:
selecting a plurality of files stored in an enterprise network;
labeling each of the plurality of files with a business value, thereby providing a labeled data set;
configuring a recognition model with the labeled data set to score the business value for a new file based on a file location of the new file in the enterprise network, an organization role of a user in an access control list associated with the new file, and content of the new file;
selecting a document in the enterprise network other than the plurality of files in the labeled data set to use as the new file;
scoring the business value of the new file with the recognition model; and
applying an enterprise policy to the new file based upon the business value.

### Claim 4 (depends on 3)

The method of claim 3 further comprising taking action to prevent distribution of the new file based on the business value of the new file.

### Claim 5 (depends on 3)

The method of claim 3 further comprising labeling the new file with the business value.

### Claim 6 (depends on 3)

The method of claim 3 wherein labeling each of the plurality of files includes automatically labeling each of the plurality of files with an organizational role associated with a folder where a corresponding one of the plurality files is located.

### Claim 7 (depends on 3)

The method of claim 3 wherein labeling each of the plurality of files includes automatically labeling each of the plurality of files based upon a corresponding organizational role of one or more users associated with each of the plurality of files.

### Claim 8 (depends on 3)

The method of claim 3 wherein labeling each of the plurality of files includes automatically labeling each of the plurality of files based on permissions in a corresponding access control list.

### Claim 9 (depends on 3)

The method of claim 3 wherein labeling each of the plurality of files includes manually labeling one or more of the plurality of files.

### Claim 10 (depends on 3)

The method of claim 3 wherein labeling each of the plurality of files includes manually labeling each of the plurality of files.

### Claim 11 (depends on 3)

The method of claim 3 wherein the plurality of files includes one or more documents.

### Claim 12 (depends on 3)

The method of claim 3 wherein the plurality of files includes one or more spreadsheets, word processing documents, or presentations.

### Claim 13 (depends on 3)

The method of claim 3 wherein the plurality of files includes one or more executables.

### Claim 14 (depends on 3)

The method of claim 3 wherein the enterprise policy controls file access.

### Claim 15 (depends on 3)

The method of claim 3 wherein the enterprise policy controls file movement.

### Claim 16 (depends on 3)

The method of claim 3 further comprising labeling the new file with an estimated business value determined with the recognition model.

### Claim 17

A system comprising:
a training system configured to receive a user selection of a plurality of files stored in an enterprise network and to label each of the plurality of files with a business value, thereby providing a labeled data set, to train a recognition model with machine learning to estimate a business value for a new file based on at least one of: an organizational role associated with a folder where a corresponding one of the plurality of files is located, a corresponding organizational role of one or more users associated with each of the plurality of files, a list of permissions for use of the corresponding one of the plurality of files, and content of the corresponding one of the plurality of files;
a labeling system configured to locate other files in the enterprise network different than the plurality of files, to estimate the business value for each of the other files, and to label each of the other files with a label indicating an estimated business value; and
a threat management facility configured to apply an enterprise policy for the enterprise network to each of the other files based on the estimated business value.

### Claim 18 (depends on 17)

The system of claim 17 wherein the plurality of files includes one or more documents.

### Claim 19 (depends on 17)

The system of claim 17 wherein the plurality of files includes one or more spreadsheets, word processing documents, or presentations.

### Claim 20 (depends on 17)

The system of claim 17 wherein the plurality of files includes one or more executables.