Symantec Corporation

Yuval Tarsi

Ramzi Abi Antoun

Kenneth J Coleman

Everett J Lai

Binu Chandrasekara Pillai

Dan Boeriu

Qun Li

Stefano Emiliozzi

Craig Olinsky

The disclosed computer-implemented method for searching unstructured documents for structured data may include (1) receiving a request to search unstructured documents for a document that contains data (e.g., sensitive data) from a structured dataset, (2) generating a secure search index (e.g., a Bloom filter) for searching the unstructured documents for the sensitive data, (3) extracting a first token and a second token from an unstructured document, (4) generating a hashed key from the first token and the second token, (5) querying the secure search index to determine whether the second hashed key is contained in the secure search index, and (6) responding, upon determining that the second hashed key is contained in the secure search index, to the request with information about the unstructured document. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for searching unstructured documents for structured data

The present disclosure relates to using signatures in a data loss prevention system. According to one embodiment, a DLP system identifies an occurrence of a data loss prevention (DLP) incident triggered by content and a DLP rule. The DLP system generates a first signature representing the DLP incident based on a specific pattern inherent to the content which triggered the DLP incident. The DLP system compares the first signature to one or more second signatures generated from other DLP incidents associated with the DLP rule. Upon determining the first signature matches at least one of the second signatures, the DLP system assigns an event status of the second matching signature to the first signature.

Match signature recognition for detecting false positive incidents and improving post-incident remediation

A computer-implemented method for scanning a file is described. A Golomb-Compressed Sequence (GCS) index may be queried to determine whether GCS data is associated with the scanned data. The GCS index may be stored in a first storage medium and the GCS data may be stored in a second storage medium. The second storage medium may be different from the first storage medium. Upon determining the GCS data is associated with the scanned data, the location of the GCS data associated with the scanned data may be identified. The GCS data may be retrieved from the identified location. At least a portion of the retrieved GCS data may be analyzed. Based on the analysis of the retrieved GCS data, it may be determined whether to perform additional data querying.

Systems and methods for determining membership of an element within a set using a minimum of resources

A method and system for low-memory footprint fingerprinting and indexing for efficiently measuring document similarity and containment are described. A method may include extracting, by a processor, content from a set of one or more data files. The method may also determine a size of the content and apply a hash function to the content to generate multiple hashes. The method selects a constrained set of the hashes to generate a fixed-size fingerprint representative of the content when the size of the content is greater than a threshold size. The method stores the fixed-size fingerprint representative of the content in an endpoint index for at least partial file content matching by an endpoint device. The method may employ a statistical-based optimization to speed-up query time.

Growing community of inventors

Lafayette, CA, United States of America

Yuval Tarsi