Symantec Corporation

Ian Barile

Timothy Micheal Wyatt

Bruce Christopher Wootton

Dirk Kessler

Aleksey Tsibulya

Rajesh Upadhyay

Mario Espinoza

A method and apparatus for determining whether a document is to be protected is described. In one embodiment, a computer system identifies a document to be categorized. The computer system then determines one or more probabilities that the document belongs to one or more of a plurality of predefined categories, the probabilities based on profiles of the predefined categories. The computer system then determines whether the probabilities indicate that the document is to be protected, and, if the document is to be protected, causes the document to be used in data loss detection.

Method and apparatus for categorizing documents containing sensitive information

A client device hosts a behavioral engine. Using the behavioral engine, the client device analyzes behavior of a client application with respect to confidential information. The client device assigns a rating indicative of risk to the client application based on the behavior of the client application. The client device performs an action to mitigate risk of data loss if the rating exceeds a threshold.

Behavioral engine for identifying patterns of confidential data use

A method and apparatus for classifying behavior of an application based on its data access pattern is described. In one embodiment, the method includes monitoring file access events associated with an application, and determining whether at least one of the file access events indicates the application's attempt to manipulate data of a file. If at least one file access event indicates the application's attempt to manipulate the data within the file, then at least one action is caused to be performed.

Data loss protection through application data access classification

A monitor detects a policy violation on a computing device, wherein the policy violation includes a user attempt to perform an operation to move data that includes sensitive information off the computing device. The monitor determines whether one or more previous policy violations have occurred on the computing device. The monitor performs an action to minimize a risk of data loss based on the one or more previous policy violations.

Adaptive data loss prevention policies

Tainted files suspected to contain confidential data that are inaccessible to Data Loss Prevention (DLP) applications are detected and tracked on computers. An access detection module detects that an application has accessed a file that contains confidential information. A transformation detection module that the application wrote a transformed file that contains content inaccessible to the DLP application, where the transformed file is suspected to contain at least a portion of the confidential information. A signature module generates a signature for the transformed file containing the inaccessible content. The signature is stored in a signature database containing a plurality of signatures of transformed files. A comparison module compares the signature generated to files transmitted via a network, wherein the transmitted files contain content inaccessible to the DLP application. A transformed file detection module detects that matched file is the transformed file in response to a comparison indicating that the signature matches a file transmitted via the network.

Growing community of inventors

Mountain View, CA, United States of America

Ian Barile