Abstract: Systems and methods for selecting objects by tracing the paths the objects traverse on a display. An object moving across a display screen does so along a particular path. Users may trace the shape of this path, such as by outlining the shape of the path with their finger or other device on a touch sensitive screen, moving a cursor with, e.g., a mouse, moving a motion-sensitive screen, or the like. The display may match the shape of the user's traced path to the shape of an object's path. Objects whose paths are shaped sufficiently similar to the user's traced path may then be selected. In this manner, users may select an object by tracing the path it takes, rather than directly picking or touching the object itself. This allows users an additional method for selecting displayed objects, improving the flexibility of many displays and programs run thereon.

Abstract: An approach is provided for automatically updating a data type of a database column. Based on a database definition, category, and usage, the column is determined to be a candidate for a data type change. For first values in the column values, costs of processing queries using a new data type are determined to be less than other costs of processing the queries using other data types. For exception value(s) in the column values, costs of processing the queries using the original data type are determined to be less than other costs of processing the queries using other data types. The original data type is replaced with the new data type for the first values and the original data type is retained for the exception value(s). The first values are associated with a first schema and the exception value(s) are associated with a second schema.

Abstract: A system and associated methodology manages localization data. According to one embodiment of the present invention a primary set of data associated with one or more specific locations is imported and matched to a predefined format. Thereafter external, secondary, data associated with each of the localities listed in the primary data set is collected from a plurality of third party location service providers. With the collected secondary data matched to the same predefined format a comparison is made between the plurality of secondary data sets and the primary data set. Differences between the data sets are identified and the primary data set modified as necessary. Thereafter, normalized data from the modified primary data set is exported to the third party location service providers to enhance consistency and reliable of locational data.

Abstract: Systems and methods are provided for print review systems. One embodiment is a print review system that includes a memory that stores inspection parameters of print media marked by a printer, an interface that communicates with the printer, and a controller that, in response to the printer initiating processing of a print job, receives an indication via the interface of settings used by the printer in processing the print job, modifies the parameters based on the settings, inspects the print media based on the modified parameters, and reports compliance of the print job with the modified parameters.

Abstract: A method and an apparatus for managing a service request in a blockchain network are provided. The method includes receiving, by a first device, a service request, identifying an intent from the service request, selecting one or more atomic contracts, each of which is related to the intent, wherein the atomic contracts are associated with a second device on the blockchain network and are verified in the blockchain network, generating a new contract including the atomic contracts, and broadcasting the new contract over the blockchain network.

Abstract: Various examples are provided related to identification of protected information elements associated with unique entities in data files present in data file collections associated with enterprise IT networks. The unique entities can be associated with one or more entity identifications in one or more data files. Computer-generated identification of entity identifications and protected information elements can be conducted, in part, by at least some human review. Information generated accordingly to the disclosed methodology can be used to generate plans for a time and number of human reviewers needed to review data files. Information generated from the processes herein can be configured as user notifications, reports, dashboards, machine learning for subsequent data file analyses, and notifications of unique entities having protected information elements present in one or more data files.

Abstract: Methods and systems are presented for generating a machine learning model using enhanced gradient boosting techniques. The machine learning model is configured to receive inputs corresponding to a set of features and to produce an output based on the inputs. The machine learning model includes multiple layers, wherein each layer includes multiple models. To generate the machine learning model, multiple models are built and trained in parallel for each layer of the machine learning model. The multiple models use different subsets of features to produce corresponding output values. After a layer in built and trained, a collective error may be determined for the layer based on the output values from the different models in the layer. An additional layer of models may be added to the machine learning model to reduce the collective error of a previous layer.

Abstract: An automated command assistance tool is provided for a browser-enabled command line interface of a cloud service. The automated command assistance tool provides examples illustrating the correct syntax for commands used to manage the resources of a cloud service. The command assistance tool learns the syntax of a command from usage patterns found in telemetric data, scripts and user documentation and forms templates containing a command's usage pattern and related information. The templates are used to generate examples that respond to a user query for assistance with usage of a particular command.

Abstract: Apparatus and methods may include a method for validating a script. The script may be a script for firing a job in an Autosys™ application deployed in a predetermined environment. The validating may use a validation system. The method may include providing a plurality of pre-deployment validation utility actions. The plurality of pre-deployment utility actions may include permitting only insert (INS), update (UPD) and delete (DEL) as actions in the script. The permitting may use an action name review utility. The plurality of pre-deployment utility actions may include permitting only command (CMD) or box parameter types (BMT) in the script. The permitting may use a parameter type review utility. The plurality of pre-deployment utility actions may include specifying only NULL, FDR and LMCTR as project codes. The specifying may use a project code specifier utility.

Abstract: Systems, methods, and computer media for securing software applications are provided herein. By recording path data representing interactions between an application and other components, it can be determined what data an attacker has received by the time malicious activity is detected. During a session with an application, queries made to a dataset by the application can be recorded. After the session is found to be malicious, the session is transferred to a cloned application session in which access to the dataset is blocked. Based on the recorded queries, an alternative dataset for queries made in the cloned application session is generated that includes a subset of the original dataset, thus limiting future queries of the attacker in the cloned application session to data already received before the malicious activity was detected.

Abstract: Through a cloud-based centralized user interface, a federated compliance system presents a policy of interest and representations of disparate systems that match the policy of interest to a user. The disparate systems, which operate in a distributed network computing environment, can include cloud-based repositories and off-cloud repositories. The federated compliance system can pull the cloud-based repositories through a cloud orchestrator and the off-cloud repositories through an off-cloud orchestrator over a secure tunnel. The federated compliance system utilizes user-provided information on the policy of interest to determine various categories of attributes from different repository schemas employed by the disparate systems. A federated retention policy mapper, implemented as a compliance service, maps the attributes to a common schema, creates a federated retention policy, and stores it in a federated space in the distributed network computing environment.

Abstract: Provided herein are systems and methods for identifying personal identifiers in content. An entity engine may receive content to identify candidate personal identifiers. The entity engine may determine that a text string in the content matches to a data format specified in entity definitions corresponding to types of personal identifiers and a rule for finding a geographic or linguistic term in the content correlated to the specific type of personal identifier. Each entity definition may specify a data format for finding a specific type of personal identifier in content. The data format corresponds to a type of personal identifier. The entity engine may identify, according to a rule of the first entity definition, a geographic or linguistic term in the content correlated to the type of personal identifier. The entity engine may classify the text string as the type of personal identifier, for preventing data breach or exfiltration.

Abstract: A shared-nothing database system is provided in which parallelism and workload balancing are increased by assigning the rows of each table to “slices”, and storing multiple copies (“duplicas”) of each slice across the persistent storage of multiple nodes of the shared-nothing database system. When the data for a table is distributed among the nodes of a shared-nothing system in this manner, requests to read data from a particular row of the table may be handled by any node that stores a duplica of the slice to which the row is assigned. For each slice, a single duplica of the slice is designated as the “primary duplica”. All DML operations (e.g. inserts, deletes, updates, etc.) that target a particular row of the table are performed by the node that has the primary duplica of the slice to which the particular row is assigned. The changes made by the DML operations are then propagated from the primary duplica to the other duplicas (“secondary duplicas”) of the same slice.

Abstract: A computational instance may includes a set of computing devices and a configuration management database (CMDB), wherein the CMDB contains a representation of a service deployed on a managed network, wherein the representation of the service includes metadata, service group membership, and an entry point, and wherein the computational instance is configured to: receive an instruction to export the representation of the service to a file; copy, to a metadata object in the file, the metadata; determine a hierarchical subset of the service groups that are related to the service; write, to one or more service group objects in the file, the hierarchical subset of the service groups; determine, from a list of entry points of the managed network, that the entry point is of the service; and write, to an entry point object in the file, the entry point.

Abstract: Embodiments of an instant recall process and system for long-term data stored on a cloud storage tier. Embodiments include saving a content handle of a file in a cloud storage tier as an extended attribute in a single file system namespace; moving the file from the cloud storage tier to an active storage tier for data processing; recalling the file from the active storage tier to the cloud storage tier upon completion of the data processing; using the content handle from hidden metadata for a working copy of the file; and saving a hash of a segment reference as part of the extended attribute.

Abstract: Techniques are described for managing communications between multiple computing nodes, such as for computing nodes that are part of managed virtual computer networks provided on behalf of users or other entities. In some situations, one or more of the computing nodes of a managed virtual computer network is configured to perform actions to extend capabilities of the managed virtual computer network to other computing nodes that are not part of the managed virtual computer network, such as by forwarding communications between computing nodes of the managed virtual computer network and the other external computing nodes so as to enable the other external computing nodes to participate in the managed virtual computer network. In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users.

Abstract: A attribute-based data matching system determines top matches for a first element from a plurality of second elements. The data matching system extracts attributes for the first element from first dataset and attributes for the plurality of second elements from a plurality of second datasets. Pairs of attributes are generated wherein each attribute pair includes an attribute of the first element and an attribute of one of the plurality of second elements. Pairwise rankings of the plurality of second elements corresponding to the attributes of the first element are generated based on weights of the attribute pairs. The pairwise rankings of the attribute pairs are aggregated to determine a ranked list that orders the plurality of second elements based on the extent of their match with the first element. User feedback to the ranked list can be collected and used to adjust the data matching system.

Abstract: Aspects of the present disclosure provide systems for managing product development that include receiving development data. The systems record an amount of time spent developing one or more project features; calculate, based at least in part on development data and the amount of time spent developing the feature, business momentum; and calculate, based on certain development data, project agility and market agility.

Abstract: In one example, the present disclosure describes a device, computer-readable medium, and method for proactively adjusting the infrastructure of a communications network in response to reporting of real-time network performance. For instance, in one example, a method includes obtaining real-time network performance metrics directly from a user endpoint device operated by a customer of a telecommunication service provider network, correlating the real-time network performance metrics with data from another data source, wherein the data includes data other than network performance metrics, and adjusting an infrastructure of the telecommunication service provider network in response to an insight gleaned through the correlating.

Abstract: A method performed by at least one computing system and including performing a document identifying operation on a corpus of documents. The documents are associated one each with a plurality of numeric tier scores. The operation identifies results including one or more of the documents. The method includes calculating each tier score in a portion of the numeric tier scores and organizing the documents into tiers based at least in part on the numeric tier scores. The portion of the numeric tier scores is identified based on the results. The tiers are ranked from most to least relevant and include relevant and non-relevant portions. The method includes sending any of the tiers in the relevant portion one at a time to one or more reviewer computing devices in an order determined by the ranking. Any of the tiers in the non-relevant portion are not sent to reviewer computing device(s).

Abstract: Exemplary methods, apparatuses, and systems include detecting a trigger to update a data integrity scan frequency. In response to detecting the trigger, an age indicator for a subdivision of memory or a utilization value for the subdivision of memory are obtained. A new data integrity scan frequency is determined using the age indicator or the utilization value. A scan of the subdivision of memory is initiated during a current media scan loop using the new data integrity scan frequency.

Abstract: A system and method for observing and controlling a programmable network via higher layer attributes is disclosed. According to one embodiment, the system includes one or more collectors and a remote network manager. The one or more collectors are configured to receive network traffic data from a plurality of network elements in the network. The remote network manager is configured to connect to the one or more collectors over the Internet via a network interface. The one or more collectors extract metadata from the network traffic data and send the metadata to the network manager.

Abstract: Disclosed are systems and methods of querying a hybrid event index of a user. The systems and methods can include receiving a search request pertaining to at least a first namespace of a plurality of namespaces and determining a first index server storing a first portion of the hybrid event index associated with the first namespace. The systems and methods can further include searching, the first portion of the hybrid event index stored at the first index server, determining one or more attributes from the search request, and determining a payload based on the search results of the first portion of the hybrid event index. Finally, the systems and methods can include applying one or more attributes to the payload and sending the filtered payload.

Abstract: A technique is configured to provide various data protection schemes, such as replication and erasure coding, for data blocks of volumes served by storage nodes of a cluster configured to perform deduplication of the data blocks. Additionally, the technique is configured to ensure that each deduplicated data block complies with data redundancy guarantees of the data protection schemes, while improving storage space of the storage nodes. In order to satisfy the data integrity guarantees while improving available storage space, the storage nodes perform periodic garbage collection for data blocks to optimize storage in accordance with currently applicable data protection schemes.

Abstract: The technology disclosed presents an improved endpoint data loss prevention (DLP) solution, referred to herein as “small-footprint endpoint DLP (sf-EDLP),” which enforces security policies at endpoints by relying on previously generated sensitivity metadata, rather than by performing content sensitivity scans at the endpoints. Since content sensitivity scans are computationally intensive and time consuming, sf-EDLP leads to a significantly simpler implementation, reduced runtime computation, and a smaller memory footprint; making it suitable for computationally constrained environments such as modern mobile devices.

Abstract: In various aspects, a method, system and computer program product provides for concurrent changes to data of a document or a file by a plurality of users at a plurality of user devices. The documents or file may be rendered in JavaScript™ Object Notation (JSON) format. The documents may be patched or changed by employing new functional operations for applying metadata for elements of the arrays associated with the document or file, and to merge changes from made among the various users. The disclosure provides for maintaining and producing new versions of the document or the file, the changes controlled so that data of the arrays are merged atomically and the updates do not fail permitting simultaneous changes to the document or file by multiple users.

Abstract: A method of scanning files for malware on a computer system. The method comprises detecting a file to be scanned for malware in the computer system, determining the file being a partial file that comprises only a part of the file content, searching for an original clean file associated with the partial file, wherein the original clean file is a full copy of the partial file, based on finding a candidate original clean file associated with the partial file, calculating a partial hash of the same length as the partial file for the candidate original clean file, and based on determining that partial hashes of the candidate original clean file and the partial file match, signalling a false alarm.

Abstract: The disclosure discloses a photo processing method including: acquiring characteristic information of each of a plurality of photos in an album; determining, based on the characteristic information, a matching degree between every two adjacent photos of the plurality of photos with predetermined storage orders; and generating at least one aggregation folder, when the plurality of photos in the album comprises photos whose storage orders are successive and matching degree is greater than or equal to a preset threshold, wherein each of the at least one aggregation folder is configured to aggregate the photos whose storage orders are successive and matching degree is greater than or equal to the preset threshold.

Abstract: The technology disclosed presents an improved endpoint data loss prevention (DLP) solution, referred to herein as “small-footprint endpoint DLP (sf-EDLP),” which enforces security policies at endpoints by relying on previously generated sensitivity metadata, rather than by performing content sensitivity scans at the endpoints. Since content sensitivity scans are computationally intensive and time consuming, sf-EDLP leads to a significantly simpler implementation, reduced runtime computation, and a smaller memory footprint; making it suitable for computationally constrained environments such as modern mobile devices.

Abstract: Computer-implemented techniques are disclosed for managing reusable collaborative content item components in a collaborative content management system. The techniques include providing locations in collaborative content items where users may store reusable components. When editing a collaborative content item, a user may select a portion, fragment or section of the collaborative content item content and save that as a reusable component. The reusable component is saved in a reusable component catalog. Other users may then insert the same component from the reusable component catalog t into their collaborative content items. When the component in the catalog is updated, other collaborative content items in the collaborative content management system that use that component are automatically updated as well.

Abstract: A file merging method performed by a controller in a storage system includes reading a first file and a second file on a solid state disk, determining whether a key of the first data is the same as a key of the second data, creating a third file on a mechanical hard disk when the key of the first data is the same as the key of the second data, merging the first data and the second data, and writing the merged data into the third file.

Abstract: A system for management of shared hardware and communication resources shared by a plurality of Workload Generators (WGs), the system comprising a processing resource configured to: obtain historical and current information indicative of past and current utilizations of portions of the shared hardware and communication resources by respective WGs of the plurality of WGs, at a plurality of points-in-time, wherein the historical and current information includes WG usage attributes of the respective WGs at the respective points-in-time; determine importance scores for one or more of the WGs, based on the historical and current information of the respective WG; and perform one or more monitoring or management activities associated with one or more of the WGs, based on the importance scores.

Abstract: Various techniques are described for platform management of integrated access of public and privately-accessible datasets utilizing federated query generation and query schema rewriting optimization, including receiving at a dataset access platform a query formatted according to a first data schema, generating a copy of the query, saving the query and the copy to a datastore, parsing the copy of the query in the first schema using an inference engine, determining whether the query comprises data associated with an access control condition associated with accessing the dataset, the access control condition being configured to indicate whether the query is permitted to access the dataset, and rewriting, using a proxy server, the copy of the query in a second schema, and optimizing the rewriting by identifying a database engine to execute the query and including other data converted into another triple associated with an attribute of the query.

Abstract: Methods, systems, and computer-readable storage media for determining, by an asset service executing on a server associated with the on-premise system, that a document has been added to the on-premise system, providing, within the cloud-based system, a temporary data object that stores data of the document, generating, within the cloud-based system, a persistent data object based on the temporary data object, the persistent data object storing data of the document, deleting the temporary data object, and associating a document identifier of the document to an asset identifier of the persistent data object within a repository of the on-premise system.

Abstract: A method can include receiving, at a node comprising a distributed trust data storage system, a request to execute a transaction modifying a portion of a data partition. Replicas of the data partition may be stored at a plurality of nodes comprising the distributed trust data storage system. In response to the request, the transaction can be sent to the plurality of nodes storing replicas of the data partition to modify the portion of the data partition. The transaction can be committed based on a threshold quantity of the plurality of nodes reaching a consensus by determining a same cryptographic hash for the transaction. The transaction can be committed by sending, to the plurality of nodes, an indication to add an entry corresponding to the transaction to a transaction log recording transactions executed on the portion of the data partition. Related systems and articles of manufacture are also provided.

Abstract: Various techniques are described for platform management of integrated access of public and privately-accessible datasets utilizing federated query generation and query schema rewriting optimization, including receiving at a dataset access platform a query formatted according to a first data schema, generating a copy of the query, saving the query and the copy to a datastore, parsing the copy of the query in the first schema using an inference engine, determining whether the query comprises data associated with an access control condition associated with accessing the dataset, the access control condition being configured to indicate whether the query is permitted to access the dataset, and rewriting, using a proxy server, the copy of the query in a second schema by converting the copy of the query into a triple associated with the query and another triple associated with the access control condition.

Abstract: A system and method for observing and controlling a programmable network via higher layer attributes is disclosed. According to one embodiment, the system includes one or more collectors and a remote network manager. The one or more collectors are configured to receive network traffic data from a plurality of network elements in the network. The remote network manager is configured to connect to the one or more collectors over the Internet via a network interface. The one or more collectors extract metadata from the network traffic data and send the metadata to the network manager.

Abstract: A method prepares data for subsequent analysis. The method obtains a data model that encodes a data sources as a tree of logical tables. Each logical table has its own physical representation and includes logical fields. Each logical field corresponds to either a data field or a calculation that spans logical tables. The method associates each logical table in the data model with a corresponding concept in a concept graph. The concept graph embodies hierarchical inheritance of semantics. For each logical field, the method assigns a semantic role to the logical field based on a concept corresponding to a logical table. The method also validates the logical field based on its semantic role. The method also displays transformations to clean the logical field based on validating the logical field. The method transforms the logical field according to a user selection, and updates the logical table.

Abstract: The present application provides a method and a network device for identifying a type of a wireless hotspot. The method comprises: in response to receiving a type determination request for a first wireless hotspot, obtaining information of the first wireless hotspot, wherein the type determination request is configured to request that a type of the first wireless hotspot be provided; searching for a second wireless hotspot which is identical or similar to the first wireless hotspot based on the information of the first wireless hotspot and information of multiple second wireless hotspots in a preset set of hotspots, wherein a type of the second wireless hotspot is an open wireless hotspot with authentication required; and in response to locating a second wireless hotspot which is identical or similar to the first wireless hotspot, identifying the type of the first wireless hotspot as an open wireless hotspot with authentication required.

Abstract: A method for managing relational transactions in a workspace inventory and analytics service is provided. The method includes retrieving, via a communication interface, device data from a source by invoking a source application programming interface, the device data including a source data set identifier; persisting the device data in a staging table of a staging database; mapping the source data set identifier to a predefined data set identifier; transforming, by using a model, the device data from the staging table into a key value pair based on the mapping; persisting the key value pair in a device metadata table of an asset database; and invoking a service.

Abstract: Systems, methods and/or devices are used to perform memory-efficient mapping of block/object addresses. In one aspect, a method of managing a storage system having one or more storage devices includes a tiered data structure in which each node has a logical ID and entries in the nodes reference other nodes in the tiered data structure using the logical IDs. As a result, when a child node is updated and stored to a new location, but retains its logical ID, its parent node does not need to be updated, because the logical ID in the entry referencing the child node remains unchanged. Further, the storage system uses a secondary mapping table to translate the logical IDs to the corresponding physical locations of the corresponding nodes. Additionally, the secondary mapping table is cached in volatile memory, and as a result, the physical location of a required node is determined without accessing non-volatile memory.

Abstract: A container service management method and apparatus, to integrate a container service and a container service management function into an NFV MANO system. The method includes: receiving, by a container service management entity, a creation request for a container service, where the creation request is used to request to create a specified container service, and the creation request carries a first management policy for managing a lifecycle of the specified container service; creating, by the container service management entity, the specified container service in response to the creation request; and managing, by the container service management entity, the lifecycle of the specified container service according to the first management policy.

Abstract: The safety of a database that conceals large-scale data is efficiently assessed. A database storage (10) stores an original database and a secure database. A neighbor record search part (11) obtains a neighbor record set by a neighbor search of the original database for each record in the secure database. A nearest neighbor record calculation part (13) calculates a distance between each record in the secure database and each record in the neighbor record set and obtains a nearest neighbor record. A re-identification determination part (14) calculates a re-identification rate of a record based on whether the record in the original database corresponding to each record in the secure database matches the nearest neighbor record. A re-identification rate calculation part (15) calculates a re-identification rate of the secure database based on the re-identification rate calculated for each record in the secure database.

Abstract: A mechanism that dynamically creates a new access policy for a set of database servers when a policy violation has been identified in a database access response issued by any database in the set. The new access policy is then propagated in real-time and instantiated across the set of database servers so as to inoculate the other database servers and pre-empt any new compromise of information based on the intruder's actions that were found to have produced the policy violation in the first instance. Thus, the approach uses a response policy violation at one database server of a set to trigger generation of a new request access policy that is then instantiated across one or more other database servers. This response policy violation-to-request access policy instantiation occurs in substantially real-time so that the intruder cannot use a prior successful access request to obtain information from other databases using a similar strategy.

Abstract: The described technology is generally directed towards a streaming data storage system that compacts older stream data by aggregating that data based on an aggregation function, and replacing the older data with the aggregated data. The technology works with a data stream in different storage tiers (e.g., Tier-1 and Tier-2), provides consistent data stream compaction of data streams having multiple segments, works with different reader applications at different event positons in the data stream, and allows the use of multiple, different aggregation functions. The technology facilitates more efficient compaction for a data stream with a lesser number of routing keys by maintaining per-chunk aggregated data for such data streams.

Abstract: A collaboration device is configured to be communicably connected with a device that includes a camera, a sensor, and a processor configured to recognize a human face from an image captured by the camera. The collaboration device includes a memory, and at least one processor coupled to the memory. The at least one processor is configured to, when the device detects a person by recognizing a face, generate first text data based on sensing data acquired by sensing the detected person, and contribute the first text data to a specified group in an Social Networking Service. The at least one processor is configured to, when the device has not detected a person by recognizing a face for a predetermined time span, generate second text data indicating that the device has not detected a person for the predetermined time span, and contribute the second text data to the specified group.

Abstract: The disclosed systems facilitate collection and management of personal data management documentation requirements and associated data. A master questionnaire is used to solicit information regarding documentation requirements for several contexts in a single interaction and responsive data can be mapped to questionnaires and/or datasets for particular contexts, such as jurisdictions and business sectors. The system can generate graphical user interfaces for presenting the documentation requirement data for a particular context by generating an interface with navigational elements for various contexts, detecting browser state data indicating user manipulation of one or more such elements, and generating a subsequent graphical user interface based on the browser context data.

Abstract: Various techniques are described for platform management of integrated access of public and privately-accessible datasets utilizing federated query generation and query schema rewriting optimization, including receiving at a dataset access platform a query formatted according to a first data schema, generating a copy of the query, saving the query and the copy to a datastore, parsing the copy of the query in the first schema using an inference engine, determining whether the query comprises data associated with an access control condition associated with accessing the dataset, the access control condition being configured to indicate whether the query is permitted to access the dataset, and rewriting, using a proxy server, the copy of the query in a second schema by converting the copy of the query into a triple associated with the query and another triple associated with the access control condition.

Abstract: An e-mail application is identified by parsing a network packet from the network packets. Responsive to the e-mail application identification, a display name associated with the user is extracted and the display name is stored among a plurality of display names in association with the company e-mail address of the user. Responsive to one of the plurality of display names matching a display name of a private e-mail address of the user as a destination of e-mail along with surpassing a threshold amount of data transfer, the user is flagged for possible data exfiltration.

Abstract: An apparatus and method for processing sensitive data. The apparatus includes one or more processors and executable memory for storing at least one program executed by the one or more processors. The at least one program is configured to, in an unprotected data area, read sensitive data from a storage device and transmit the same to a protected data area using the sensitive-data storage endpoint of the protected data area; to, in the protected data area, process the sensitive data using at least one endpoint when a command for a sensitive-data service requested by a client device is received from the unprotected data area; and to, in the unprotected data area, transmit the result of processing the sensitive data to the client device.