Abstract: One embodiment relates to an apparatus for creating and managing security policies for data leakage prevention. The apparatus includes a database which stores three layers of objects comprising digital assets, content templates, and security policies, and a user interface configured to access said database so as to provide for input and editing of said three layers of objects. The security policies may include at least a target element, an action element, and a condition element. A content template may be used to form the condition element. Content templates may include compliance templates which are configured to satisfy specific regulatory requirements and other templates to protect specified types of information. Other embodiments, aspects and features are also disclosed.

Abstract: One embodiment relates to an apparatus configured to match a list of keywords against a target document. The apparatus includes data storage configured to store computer-readable instruction code and data, and a processor configured to access the data storage and to execute said computer-readable instruction code. The apparatus further includes a keyword searcher and a keyword object generator. The keyword searcher is configured to receive the list of keywords and a textual string corresponding to the target document file, and search the textual string for instances of the keywords so as to generate a sequence of keyword instances. The keyword object generator implemented using the instruction code and configured to receive the sequence of keyword instances, and generate a keyword object, wherein the keyword object includes a range-dependent match function. Other embodiments and features are also disclosed.

Abstract: One embodiment relates to a method for providing a service which matches document fingerprints against a database of document fingerprints. Target text data on a mobile phone device is obtained, and target document fingerprints are generated for the target text data using a fingerprint generator on the mobile phone device. The target document fingerprints are transmitted to a service cloud. A feedback message is received from the service cloud. The feedback message depends on results from matching the target document fingerprints against the database of document fingerprints. Other embodiments, aspects and features are also disclosed.

Abstract: Difference data is generated between a reference file and a target file that are orderly dependent having common blocks that appear in the same order in both the reference and target files. The difference data is generated by comparing hash values of chunks of the reference file against hash values of parts of the target file to identity copy operations between the reference and target files. Chunks of the reference file and parts of the target file are loaded into main memory to create hashes for comparison and unloaded from the main memory after exhaustion. The difference data is included in a difference file, which is provided to one or more endpoint computers. In an endpoint computer, the target file is reconstructed using a copy of the reference file and the difference data from the difference file.

Abstract: A computer system includes a data collector and an anomaly detector. The data collector monitors network traffic/event log and sends monitoring data to the anomaly detector. The anomaly detector extracts values for a category of measure from the monitoring data and processes the values to generate a processed value. The anomaly detector predicts an expectation value of the category of measure based at least on time decayed residual processed values. The anomaly detector determines a deviation of the processed value from the expectation value to detect an anomaly event, and applies a security rule to the anomaly event to detect a security event.

Abstract: One embodiment relates to a computer-implemented method for generating difference data between reference and target files. A difference engine performs a first procedure to generate difference data representing the difference between the reference and target files if the reference and target files are sequences of sorted data records. The first procedure may compare a lexical order of a record from the reference file against a lexical order of a record from the target file. An entry may be added to a copy list if the records are the same, and an entry may be added to an add list if that the record from the reference file is lexically greater than the record from the target file. Another embodiment relates to an apparatus for generating difference data.

Abstract: One embodiment relates to a computer-implemented method for multiple-keyword matching performed using a computer including at least a processor, data storage, and computer-readable instructions. A keyword set and a text input to be searched are obtained. The keyword set is processed to create a reverse trie. A search procedure which starts from the end of the text is then applied using the reverse trie to find keyword occurrences in the text input. Other embodiments, aspects, and features are also disclosed.

Abstract: A copolymer and preparation method and application thereof are disclosed. The copolymer is random copolymer obtained from monomers consisting of acrylamide, acrylic acid, alkenyl sulfonate, 2-acrylamido-dodecyl sulfonate, p-styrene sulfonate or isoprene sulfonate and so on. The copolymer of present invention can be used as fluid loss additive and has good fluid loss properties, which would not make the drilling fluid thicken at high temperature of 200° C. and high salt conditions of saturated brine. It has a medium-pressure fluid loss after aging and rolling for 16 h at high temperature of 200° C., as measured in accordance with the American Petroleum Institute Standard Test at room temperature, and has good properties of high temperature-resisting and salt-resisting.

Abstract: One embodiment relates to a computer-implemented method for multiple-keyword matching performed using a computer including at least a processor, data storage, and computer-readable instructions. A keyword set and a text string to be searched are obtained. A suffix sorting procedure is applied to the text string to create a suffix index array. A dual binary keyword search procedure is applied to a reference list of suffix strings presented by the suffix index array. The dual binary keyword search procedure may apply a recursive function that utilizes a divide-and-conquer process and may have inputs of a results list, the suffix index array, and the keyword set. The recursive function may add a range of items to the results list if a keyword is determined to be a prefix of a suffix string in the reference list. Other embodiments, aspects, and features are also disclosed.

Abstract: One embodiment relates to an apparatus configured to efficiently group a set of strings into clusters of related strings. Data storage is configured to store computer-readable code and data, and a processor is configured to access the data storage and to execute said computer-readable code. Computer-readable code is configured to receive the set of strings, determine an evaluation function between pairs of strings in said set, and group the strings into clusters, wherein determining the evaluation function between pairs of strings utilizes hash tables. Another embodiment relates to a computer-implemented method of efficiently grouping a set of strings into clusters of related strings based on rules of inference. Other embodiments and features are also disclosed.

Abstract: One embodiment relates to a computer-implemented method for generating difference data between reference and target files. A difference engine implemented using a computer receives the reference and target files. The difference engine performs a first procedure to generate difference data representing the difference between the reference and target files if the size of the reference file is less than a first threshold size. The difference engine performs a second procedure to generate the difference data if the size of the reference file is less than a second threshold size and greater than the first threshold. The difference engine performing a third procedure to generate difference data if the size of the reference file is greater than the second threshold size. Other embodiments relate to apparatus for generating difference data between reference and target files and for reconstructing the target files from the reference files using the difference data.

Abstract: A system (and a method) is disclosed for fingerprinting based entity extraction using a rolling hash technique. The system is configured to receive an input stream comprising characters, the input stream of a predetermined length, and a hash table having plurality of indexed entries. The system defines a fixed window length. The system isolates, through the fixed window length, a set of a plurality of characters of the input stream. The system generates a hash key. The hash key is used to index into the hash table. The system compares the isolated set of plurality of characters of the input stream with the entry corresponding to the index into the hash table to determine whether there is an exact match with the entry. The system slides the fixed window length one character to isolate another set of a plurality of characters of the input stream in response to no exact match from the comparison. Alternatively, the system stores the input stream in response to an exact match from the comparison.

Abstract: A system (and a method) evaluates raw data from an application prior to modification of the raw data. The system inserts injection code into an application. The injection code is configured to hook an application. The application is configured to allow modification of the raw data. Modification includes encryption and/or compression. The system analyzes the raw data in a context of a predefined policy in response to the executing application reaching the injected code during execution. The system instructs the application to cease operating on the raw data in response to the predefined policy prohibiting further processing of the raw data or instructs the application to bypass the injection code in response to the predefined policy no prohibiting processing of the raw data.

Abstract: One embodiment relates to a computer-implemented process for generating document fingerprints. A document is normalized to create a normalized text string. A first hash function with a sliding hash window is applied to the normalized text string to generate an array of hash values. Candidate anchoring points are selected by applying a first filter to the array of hash values. The anchoring points are chosen by applying a second filter to the candidate anchoring points. Finally, a second hash function is applied to substrings located at the chosen anchoring points to generate hash values for use as fingerprints for the document. Other embodiments and aspects are also disclosed.

Abstract: A system (and a method) is disclosed to extract entity values from texts. The system receives, at a first tier entity recognition engine, an input data string having a plurality of entities. The first tier entity recognition engine marks entities of the plurality of entities that are regular expression and transmits the input data stream with the marked entities to a second tier entity recognition engine. The second tier entity recognition engine receives the input data stream and identifies unmarked entities in the input data stream received at the second tier entity recognition engine. The second tier entity recognition engine determines whether the unmarked entities comprise a predetermined data format, and if so, outputs those unmarked entities of the plurality of entities that comprise the predetermined data format.

Abstract: A document signature index and search system is disclosed. The logical structure of the signature index that includes search tables is defined. Also specified is a system of creating, managing and using the signature index. The system includes an index engine and search engine. The search tables are compact in disk usage and suitable for differential computation, making large scale deployment feasible. With the introduction of meta-data and an algorithm of multiple value dual binary searching, the search engine based on the search tables is very efficient in searching for signatures from large search tables which may store millions of signatures. Other embodiments, aspects and features are also disclosed.

Abstract: A system and a method generates at least one signature associated with document. In one embodiment, a document comprised of text is received and parsed to generate a token set. The token set includes a plurality of tokens. Each token corresponds to the text in the document that is separated by a predefined character characteristic. A score is calculated for each token in the token set based on a frequency and distribution of the text in the document. Each token is then ranked based on the calculated score. A subset of the ranked tokes is selected and a signature is generated for each occurrence of the selected tokens. The selected list of signatures is then output.

Abstract: A copolymer and preparation method and application thereof are disclosed. The copolymer is random copolymer obtained from monomers consisting of acrylamide, acrylic acid, alkenyl sulfonate, 2-acrylamido-dodecyl sulfonate, p-styrene sulfonate or isoprene sulfonate and so on. The copolymer of present invention can be used as fluid loss additive and has good fluid loss properties, which would not make the drilling fluid thicken at high temperature of 200° C. and high salt conditions of saturated brine. It has a medium-pressure fluid loss after aging and rolling for 16 h at high temperature of 200° C., as measured in accordance with the American Petroleum Institute Standard Test at room temperature, and has good properties of high temperature-resisting and salt-resisting.

Abstract: A system and method provides a graphical user interface (GUI) for users to monitor and manage sensitive information within an enterprise network. The GUI can provide users with information, such as the presence of input/output devices (I/O device), the location of documents containing sensitive information (sensitive documents), and the status of local security policy. The GUI can also provide users with real-time information, such as the occurrence of local security policy violations, the life-cycle of sensitive documents, and the sensitive information dynamic flow within the enterprise network.

Abstract: A system and a method are disclosed for sensitive document management. The system includes one or more agents, a behavior analysis engine, a local policy engine, and a local matching service. The method identifies whether a document is sensitive, identifies behaviors applied to the document, determines whether the document contains sensitive information and determines whether to allow the identified behavior to continue based on security policies.