# US 8,544,060 B1 · Method and system for detecting and protecting against potential data loss from unknown applications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,544,060 B1
- Document ID: US8544060B1
- Status: Granted
- Kind: B1
- Application number: 13/360,084
- Filed: 2012-01-27
- Granted: 2013-09-24
- Earliest claimed: 2012-01-27
- Assignees: Symantec Corporation
- Applicants: Rupesh Khetawat
- Inventors: Rupesh Khetawat
- Web page: https://patentgrep.com/patent/US8544060B1

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/60: Protecting data
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method for detecting and protecting against potential data loss from unknown applications is described. In one embodiment, a method includes detecting, by an endpoint data loss prevention (DLP) system running on a client computing device, that a local application has accessed a document on the client computing device. The method further includes determining that the document contains sensitive data according to one or more DLP polices of the endpoint DLP system and determining that a combination of the local application and a type of the document is not included in a whitelist of the DLP policies. Then, the method includes capturing at least one of one or more screenshots, and video of one or more operations that the application performs on the document and sending the captured at least one of the one or more screenshots, and the video to an enforcement server associated with the endpoint DLP system.

## Claims

### Claim 1

A computer-implemented method, comprising:
detecting, by an endpoint data loss prevention (DLP) system running on a client computing device, that a local application has accessed a document on the client computing device;
determining that the document contains sensitive data according to one or more DLP polices of the endpoint DLP system;
determining that a combination of the local application and a type of the document is not included in a whitelist of the DLP policies;
capturing at least one of one or more screenshots, and video of one or more operations that the application performs on the document;
sending the captured at least one of the one or more screenshots, and the video to an enforcement server associated with the endpoint DLP system; and
receiving one or more updated DLP policies from the enforcement server, the one or more updated DLP policies comprising changes based on the captured at least one of the one or more screenshots or the video;
wherein the one or more updated DLP policies cause the endpoint DLP system to at least one of blacklist the combination of the application and document type, restrict access to the document, encrypt the document, or move the document to a different location.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the endpoint DLP system utilizes one or more application programming interfaces (APIs) of an operating system of the client computing device in order capture the at least one of the one or more screenshots or the video.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein the one or more screenshots are taken at periodic time intervals over a time span that the application is in use.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein the enforcement server analyzes the captured data to determine if at least one of malicious or suspicious activity occurred with respect to the document on the endpoint device.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein the whitelist comprises one or more different application and document type pairs that have been approved by an administrator of the endpoint DLP system as being an allowable combination.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, further comprising, prior to the capturing:
presenting a notice to a user of the application that the application may be subject to screenshot or video capture that present privacy issues; and
allowing access to the document when the user acknowledges and accepts the notice.

### Claim 7

An endpoint device, comprising:
a memory to store instructions for a data loss prevention (DLP) policy; and
a processing device coupled with the memory, wherein the processing device is configured to:
detect that a local application of the endpoint device has accessed a document on the client computing device;
determine that the document contains sensitive data according to the DLP policy;
determine that a combination of the local application and a type of the document is not included in a whitelist of the DLP policies;
capture at least one of one or more screenshots, and video of one or more operations that the application performs on the document;
send the captured at least one of the one or more screenshots, and the video to an enforcement server associated with the endpoint DLP system; and
receive one or more updated DLP policies from the enforcement server, the one or more updated DLP policies comprising changes based on the captured at least one of the one or more screenshots or the video;
wherein the one or more updated DLP policies cause the endpoint DLP system to at least one of blacklist the combination of the application and document type, restrict access to the document, encrypt the document, or move the document to a different location.

### Claim 8 (depends on 7)

The endpoint device of claim 7, wherein the one or more screenshots are taken at periodic time intervals over a time span that the application is in use.

### Claim 9 (depends on 7)

The endpoint device of claim 7, wherein the enforcement server analyzes the captured data to determine if at least one of malicious or suspicious activity occurred with respect to the document.

### Claim 10 (depends on 7)

The endpoint device of claim 7, wherein the whitelist comprises one or more different application and document type pairs that have been approved by an administrator of the endpoint DLP system as being an allowable combination.

### Claim 11 (depends on 7)

The endpoint device of claim 7, further comprising, prior to the capturing:
presenting a notice to a user of the application that the application may be subject to screenshot or video capture that present privacy issues; and
allowing access to the document when the user acknowledges and accepts the notice.

### Claim 12

A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform a method comprising:
receiving, by an enforcement server device of a data loss prevent (DLP) system, data representing captured at least one of one or more screenshots or video of an application manipulating a sensitive document at an endpoint DLP system of the DLP system;
analyzing, by the enforcement server device, the received captured data to determine whether at least one of suspicious or malicious activity occurred with respect to the sensitive document;
updating, by the enforcement server device, one or more DLP policies based on the results of the analysis; and
deploying, by the enforcement server device, the one or more updated DLP policies to one or more endpoint DLP systems;
wherein the one or more updated DLP policies cause the one or more endpoint DLP systems to at least one of blacklist the combination of the application and document type, restrict access to the document, encrypt the document, or move the document to a different location.

### Claim 13 (depends on 12)

The non-transitory computer readable storage medium of claim 12, wherein the one or more screenshots are taken at periodic time intervals over a time span that the application is in use.

### Claim 14 (depends on 12)

The non-transitory computer readable storage medium of claim 12, wherein the enforcement server maintains a whitelist comprising one or more different application and document type pairs that have been approved by an administrator of the enforcement server and is part of the one or more updated DLP policies.

### Claim 15 (depends on 14)

The non-transitory computer readable storage medium of claim 14, wherein the instructions, when executed by the processing device, cause the processing device to perform further operations of the method comprising: if, based on the analysis, operations of the application manipulating the sensitive document are not at least one of suspicious or malicious, then adding a combination of the application and a type of the sensitive document to the whitelist.