Abstract: Monitored content is classified to determine partial matches with fragments of documents. A set of redundant keys, or sliding sectional fingerprints, are computed for every possible alignment of the documents with respect to the monitored content. The keys are stored in repositories according to the classification of the corresponding documents. Sectional fingerprints are computed for the monitored content, and the repositories are searched. If a match is found in a repository corresponding to public content, then the monitored data section is classified as public. If a match is found only in a repository corresponding to private content, then the data section is classified as private. Otherwise, the data section is classified as unknown. In a related aspect, a set of policies are searched for a first match in part according to the classifications of the monitored data sections, and a designated action taken if the first match is found.

Abstract: Monitored content is analyzed to determine full and partial matches to previously classified content. Monitored content matching previously classified public content is classified as public, even if the monitored content is also found to match previously classified private content. In other words, public classification “overrides” potentially private classification. Monitored content matching only previously classified private content is classified as private. All remaining otherwise unclassified monitored content is classified as unknown. Monitored content is analyzed with respect to a session. If any content in a session is private, then the session is classified as private. If all content in a session is public, then the session is classified as public. Otherwise, the session is classified as unknown. In a related aspect, a set of policies are searched for a first match in part according to the classification, and a designated action taken if the first match is found.

Abstract: In one embodiment, documents accessible via a designated public account are classified as public. In another embodiment, documents accessible according to a designated public access control list are classified as public. In some embodiments, all documents not classified as public are classified as private. Content in the public documents is linguistically analyzed, resulting in a set of keys for use in subsequent full and partial content matching. The keys and associated file names are stored in a public-content identification repository. Similarly, content in the private documents is linguistically analyzed, and the results are stored in a private-content identification repository. Subsequently, full and partial content matching is performed on monitored content according to information in the public and private repositories.