Websense, Inc.

Portauthority Technologies, Inc.

Sharon Bruckner

Lidror Troyansky

Daniel Lyle Hubbard

Assaf Litai

A system and method for identifying infection of unwanted software on an electronic device is disclosed. A software agent configured to generate a bait and is installed on the electronic device. The bait can simulate a situation in which the user performs a login session and submits personal information or it may just contain artificial sensitive information. Parameters may be inserted into the bait such as the identity of the electronic device that the bait is installed upon. The output of the electronic device is monitored and analyzed for attempts of transmitting the bait. The output is analyzed by correlating the output with the bait and can be done by comparing information about the bait with the traffic over a computer network in order to decide about the existence and the location of unwanted software. Furthermore, it is possible to store information about the bait in a database and then compare information about a user with the information in the database in order to determine if the electronic device that transmitted the bait contains unwanted software.

Method and system for protection against information stealing software

A method for mitigating false positive type errors while applying an information leak prevention policy to identify important information and to prevent outward leakage. A positive criterion is defined for a positive set, and a negative criterion for a negative set of benign traffic. An ambiguity set contains items showing indications for both positive and negative sets. An ambiguity resolution criterion allows ambiguous items to be placed in/removed from the positive set or negative set. Each information item is searched for matches with the positive set. Each item in the positive set is checked for membership in the ambiguity set. The ambiguity resolution criteria are used for each member of the ambiguity set and to remove items from the positive set accordingly. The leak prevention policy is applied for all items remaining in the positive set thus protecting the important information.

Method and system for information leak prevention

A method for mitigating false positive type errors while applying an information leak prevention policy, the method comprising the computer implemented steps of: defining at least one positive criterion for a positive set, wherein the positive criterion comprises at least one indicator of a possible breach of the information leak prevention policy; defining at least one negative criterion for a negative set, wherein the negative criterion comprises at least one indicator of benign traffic; establishing an ambiguity set in association with an intersection between the positive set and the negative set, such that information items in the intersection enter the ambiguity set; defining at least one ambiguity resolution criterion for resolving the ambiguity; monitoring and analyzing electronic traffic, where each information item in the traffic is searched for matches with the positive set; checking for membership of each item in the positive set in the ambiguity set; resolving ambiguities using one of the ambiguity resolution criterion for each member of the ambiguity set and removing items from the positive set accordingly, and applying information leak prevention policy for all items remaining in the positive set following the removal of items using ones of the ambiguity resolution criteria.

Growing community of inventors

Tel Aviv, Israel

Sharon Bruckner