Detecting personal identity information in data associated with cloud computing system

Abstract

The present disclosure describes methods and systems for detecting personal identity information in data associated with a cloud computing system. An example method includes ingestion of data associated with a cloud computing system to generate source data. The method includes processing source data by performing cell-based deduplication to generate cell-based deduplication data, performing regular expression classification on the cell-based deduplication data to generate a first subset of initial results, word-segmenting the cell-based deduplication data to generate word-segmented data, the segmented data is de-duplicated and the de-duplicated segmented data is subjected to a first named entity recognition classification to generate a second subset of initial results. The method includes cross-referencing the cell-based deduplication data and the initial result, and performing a second named entity recognition classification on the output of the cross-referencing to generate a final result. The method includes processing the final result to detect any personal identity information in the final result.

Description

Background Art

[0001] Computing, storage, and network resources are increasingly accessed via public clouds, private clouds, or a mix of the two. Public clouds include a global network of servers that perform various functions, including storing and managing data, running applications, and delivering content or services, such as streaming video, email, office productivity software, or social media. Servers and other components can be located in data centers around the world. While public clouds provide services to the public over the Internet, enterprises can use private or hybrid clouds. Both private and hybrid clouds also include a network of servers housed in data centers. Cloud service providers provide access to these resources by providing cloud computing and storage resources to customers.

[0002] Telemetry and other data associated with such cloud computing systems may include personally identifiable information that may be inadvertently disclosed. Methods and systems are needed that can address issues related to potential disclosure of personally identifiable information in cloud environments. Summary of the invention

[0003] In one aspect, the present disclosure relates to a method implemented by a processing system including at least one processor. The method may include ingesting data associated with a cloud computing system to generate source data. The method may also include, after ingestion, as part of a first process, processing the source data by performing unit-based deduplication to generate unit-based deduplicated data, performing regular expression classification on the unit-based deduplicated data to generate a first subset of initial results, tokenizing the unit-based deduplicated data to generate tokenized data, deduplicating the tokenized data, and performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results.

[0004] The method may also include, after performing the first process, as part of a second process, cross-referencing the unit-based deduplication data with the initial result, and performing a second named entity recognition classification on the cross-referenced output to generate a final result. The method may also include processing the final result to detect any personally identifiable information in the final result.

[0005] In another aspect, the present disclosure is directed to a processing system including at least one processor, the processing system including instructions that, when executed by the at least one processor, perform operations including ingesting data associated with a cloud computing system to generate source data. The operations may also include, after ingestion, as part of a first process, processing the source data by performing unit-based deduplication to generate unit-based deduplicated data, performing regular expression classification on the unit-based deduplicated data to generate a first subset of initial results, tokenizing the unit-based deduplicated data to generate tokenized data, and deduplicating the tokenized data and performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results.

[0006] The processing system may also include instructions that, when executed by at least one processor, perform operations including, after executing the first process, as part of the second process, cross-referencing the cell-based deduplication data with the initial result, and performing a second named entity recognition classification on the output of the cross-referencing operation to generate a final result. The processing system may also include instructions that, when executed by at least one processor, perform operations including processing the final result to detect any personally identifiable information in the final result.

[0007] In another aspect, the present disclosure relates to a method implemented by a processing system including at least one processor. The method may include ingesting telemetry associated with a cloud computing system, and generating batches of source data based on the ingested telemetry, wherein each batch may be identified using an associated batch identifier. The method may also include, as part of a first process, processing each batch of the source data by performing unit-based deduplication to generate unit-based deduplicated data, performing regular expression classification on the unit-based deduplicated data to generate a first subset of initial results, tokenizing the unit-based deduplicated data to generate tokenized data, and deduplicating and filtering the tokenized data to generate deduplicated tokenized data, and performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results.

[0008] The method may also include, after executing the first process, as part of a second process, cross-referencing the unit-based deduplicated data and the initial result, and performing a second named entity recognition classification on the cross-referenced output to generate a final result. The method may also include processing the final result to detect any personally identifiable information (PII) in the final result.

[0009] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The present disclosure is illustrated by way of example and not limitation in the accompanying drawings, in which like reference numerals indicate similar elements. Elements in the drawings are illustrated for simplicity and clarity and have not necessarily been drawn to scale.

[0011] Figure 1 A block diagram of a portion of a system for detecting personally identifiable information according to one example is shown;

[0012] Figure 2 shows a block diagram of an analysis layer according to one example;

[0013] Figure 3 According to an example, a Figure 2 Phase 1 of the analysis layer performs the processing of the source data as part of the first process;

[0014] Figure 4 According to an example, a Figure 2 Stage 2 of the analysis layer performs the processing of a portion of the second flow;

[0015] Figure 5 A block diagram of a portion of a system for detecting personally identifiable information according to one example is shown;

[0016] Figure 6 An example application of value rules and context rules for IP addresses is shown;

[0017] Figure 7 According to an example Figure 5 The output table of the detection layer;

[0018] Figure 8 is a block diagram of a computing system for performing methods associated with the present disclosure according to one example;

[0019] Fig. 9 A data center implementing a system and method for detecting personally identifiable information according to one example is shown;

[0020] Fig.10 A flowchart showing a method for detecting personally identifiable information according to one example; and

[0021] Fig.11 A flow chart of another method for detecting personally identifiable information according to an example is shown. DETAILED DESCRIPTION

[0022] Examples described in this disclosure relate to methods and systems for detecting personally identifiable information in data associated with a cloud computing system. Certain examples relate to the detection and tracking of personally identifiable information in a cloud computing system. The computing system may be a public cloud, a private cloud, or a hybrid cloud. A public cloud includes a global network of servers that perform various functions, including storing and managing data, running applications, and delivering content or services such as streaming video, email, office productivity software, or social media. Servers and other components may be located in data centers around the world. While public clouds provide services to the public over the Internet, enterprises may use private or hybrid clouds. Both private and hybrid clouds also include a network of servers housed in data centers.

[0023] Services, applications, and other executable codes in the cloud can generate a large amount of associated telemetry during operation. As used herein, the term "telemetry" means data related to the use, consumption, operation, and / or performance of software, services, systems, applications, and their components, for example, including but not limited to the frequency of use of certain features, measurement of startup time and processing time, hardware involved, application crashes, single window metrics, system operations, counts of features used, single function timing, general usage statistics, and user behavior. In general, telemetry should not contain any personally identifiable information that can be traced back to a specific user who logs in or performs an operation. As used herein, the term "personally identifiable information" ("PII") means any information that allows the identity of a user to be inferred directly or indirectly, including any information that is linked or linkable to the user. For example, including but not limited to the user's name, the user's race or gender, the user's religious beliefs, the user's mailing address, the user's email address, the user's phone number, an IP address that can be traced to a specific user, the user's geographic location, the user's social security number, the user's date of birth and / or place, the user's mother's maiden name, the user's credit card number, the user's bank account number, the user's passport number, and the user's driver's license number, etc.

[0024] Even when developers are very careful to remove PII from logs, PII can leak into telemetry. These leaks can occur much less frequently than easily identifiable leaks, which occur more frequently. For example, these leaks can occur at a rate of one in a million or one in ten million. The volume of telemetry is so high that a naive deep scan of activity logs is prohibitively expensive. The personal data logged can also be embedded in large amounts of non-personal data, making discoverability even more difficult—making it essentially a needle-in-a-haystack problem.

[0025] Figure 1 A block diagram of a system portion 100 for detecting personally identifiable information according to one example is shown. The system portion 100 includes several components that can be used to process telemetry and other data and ingest such data into a form that can be further processed. In this example, the system portion 100 can include a call layer 110, an event publisher 120, an API-based on-demand scanner 130, a data source 140, an ingestion layer 150, and an ingestion data cluster 170. The call layer 110 can include a privacy manager 112 and a data catalog 114. The privacy manager 112 can be implemented as a client that calls a REST API of an enhanced privacy scanning service to trigger an enhanced scan. The data catalog 114 can be configured to perform several operations, including: (1) performing automatic data discovery through data scanning and classification across data industries, (2) collecting enterprise metadata related to cloud-associated analytics and operations, and (3) identifying potential personally identifiable information using lenses such as glossaries, classifications, and sensitivity labels. The call layer 110 can make application program interface (API) calls to the API-based on-demand scanner 130. One type of scanner may scan for patterns, such as email addresses, while another type of scanner may scan for other types of sensitive data.

[0026] Continue to refer Figure 1 , event publisher 120 may involve telemetry generated by the cloud infrastructure, including application crash summary, application utilization summary, infrastructure utilization summary, infrastructure capacity summary, infrastructure performance summary, API summary, virtual machine (VM) events, VM placement summary, VM utilization summary, VM capacity summary, etc. Data source 140 may include other data sources, including SQL databases and data lake storage.

[0027] Still reference Figure 1, the ingestion layer 150 may include a trigger monitor 152, a scan scheduler 154, and a data puller 156. In this example, the ingestion layer 150 is responsible for managing the ingestion of data that is further analyzed to detect any PII. The trigger monitor 152 may monitor a set of events published by the event publisher 120. In one example, based on the monitoring by the trigger monitor 152, the scan scheduler 154 may periodically initiate a scan of event-related data. The scan scheduler 154 may also schedule a scan using an API-based on-demand scanner 130. The data puller 156 may pull data from the data source 140. In one example, the data puller 156 may create an ingestion data cluster 170 that includes data indexed by batches (e.g., batches of 1GB in size). Each such batch may have an associated ingestion batch identifier so that any personally identifiable information can be traced back to the data source. The data puller 156 may also pull any other scan data and event-related data and store the indexed batches as part of the ingestion data cluster 170. The ingestion data cluster 170 is configured as an indexed store that allows for faster searches of data. In one example, the indexing process may include indexing all columns of each index batch stored as part of the ingestion data cluster 170. Figure 1 System portion 100 is shown including certain components arranged in a certain manner, but system portion 100 may include other components arranged in a similar manner or arranged in a different manner.

[0028] Figure 2 FIG. 2 shows a block diagram of an analysis layer 200 according to an example. The analysis layer 200 may Figure 1 The ingestion data cluster 170 performs various types of scans. One type of scan may involve scanning patterns, such as email addresses. Another type of scan may include scanning other types of sensitive data. Another type of scan may include using a data scanner that can be configured to scan various types of data. Furthermore, any of these scanners can be configured based on the data source and the load. The analysis layer 200 may include two stages: stage 1 210 and stage 2 260. These stages may be configured to process data from Figure 1 The ingested data cluster 170 retrieves the source data.

[0029] The two-stage arrangement of the analysis layer 200 allows two processes to be used to improve the confidence level of the named entity recognition (NER) classification process. Stage 1 210 can be configured to Figure 1 The ingestion data cluster 170 performs several processes on the source data received. In one example, the source data may include Figure 1Such data is processed column by column for each index column received by the stored table as part of the ingested data cluster 170. In this example, these processes include cell-based deduplication 212, regex classification 214, token-based deduplication and filtering 222, and named entity recognition (NER) classification 224, as well as storing initial results and pointers to source data (e.g., pointers to Figure 1 The ingestion data cluster 170 contains pointers to the source data) 230. Stage 2 260 can be configured to perform additional processes on certain outputs and initial results produced by stage 1 210. In this example, these processes include cross-referencing deduplication units and initial results 262, NER classification 264, and storing final results and pointers to source data 270 (e.g., pointers to Figure 1 A pointer to the source data in the ingested data cluster 170).

[0030] Continue to refer Figure 2 , the process of unit-based deduplication 212 can include identifying unique units within the source data. The unit-based deduplication process can be run for each batch of data (e.g., a batch of 1GB in size) included in the source data. The output of the unit-based deduplication 212 can be subjected to regular expression (regex) classification 214 to detect the regular expressions or patterns found within each unique unit. The regex classification 214 can include using services such as text analysis to extract regular expressions or patterns. Then, the extracted patterns or expressions, including email addresses, phone numbers, mailing addresses, etc. output from the regex classification 214, can be processed by storing initial results and pointers 230 to the source data. In some cases, personally identifiable information may not conform to regular expressions or patterns. For example, personally identifiable information can be embedded in a URL, query, or file path. In order to process such personally identifiable information, the output of the unit-based deduplication 212 can be further processed using word segmentation-based deduplication and screening 222.

[0031] Continue to refer Figure 2, deduplication and screening based on word segmentation 222 can segment, deduplicate, and screen the input. The purpose of word segmentation is to find unique deduplicated word segments that may contain personally identifiable information, and send each of these word segments to the classifier separately. Certain word segments, such as "-" or "@", may be excluded because they are usually part of a globally unique user identifier (GUID) and an email address, respectively. The word segmentation process can be repeated multiple times so that delimiting characters not included in one step can potentially be included in another step. The entire process is configurable, and its overall goal is to obtain unique deduplicated word segments. Deduplication ensures that unique word segments are found, and then only such unique word segments can be passed to the classifier. Although some context may be lost based on the characters used for word segmentation, the advantage of this process is that it will reveal personally identifiable information embedded in non-regular expressions or patterns.

[0032] In one example, to preserve the intermediate context, a JavaScript Object Notation (JSON) key-value pair deduplication process may be used after unit-based deduplication 212 and before token-based deduplication and filtering 222. This JSON key-value pair deduplication can help preserve the "intermediate context" by preserving unique key names and their values. Deduplicating the key-value pair as a single object maintains the association between the key and its value, allowing the key to serve as the context of the corresponding value. This intermediate context is sometimes required because in some instances of the key-value pair, it is impossible to determine whether the identified entity contains PII without the context provided by the key. This is because the regex classifier detects PII by matching data patterns (e.g., regular expressions). However, in some instances, pattern matching JSON key-value pairs may not be sufficient. For example, any 10-digit number can match the data pattern associated with a phone number, but only some of these 10-digit numbers may be phone numbers. As an example, consider two JSON key-value pairs: (i) {"Phone": "123456789" and (ii) {"TimeTakenNMs": "23456789"}. In each of these examples, although both values ​​(123456789) match the data pattern associated with a phone number, the context provided by the corresponding keys helps determine that the first example contains PII, but the second example does not. In other words, to reduce such false positives, it is helpful to retain context (such as the keys of the JSON key-value pairs). This is particularly helpful in the case of data obtained as telemetry, which can have a large number of repeated key-value pairs in the JSON data. Deduplication of such JSON key-value pairs while maintaining the intermediate context provided by the keys leads to a more accurate determination of PII.

[0033] As part of word segmentation-based deduplication and filtering 222, filtering can be used to reduce the size of the working set that needs further analysis by discarding certain information that is unlikely to contain personally identifiable information. For example, word segmentation-based deduplication and filtering 222 can be configured to discard GUIDs and timestamps. The output of word segmentation-based deduplication and filtering 222 can be provided to NER classification 224. NER classification 224 can process the output received from word segmentation-based deduplication and filtering 222 to locate and classify named entities in the unstructured data received from word segmentation-based deduplication and filtering 222 into predefined categories, such as email addresses, mailing addresses, telephone numbers, etc. The various processes performed as part of phase 1 210 are referred to as first processes.

[0034] Still reference Figure 2 , stage 2 260 may be used to execute a second flow to perform additional processes. In this example, these processes include cross-referencing deduplicated units and initial results 262, NER classification 264, and storing final results and pointers to source data 270 (e.g., pointers to Figure 1 The cross-reference process may process the output of the cell-based deduplication 212 and compare the output with the initial results obtained after the process performed as part of stage 1 210 is completed (e.g., the initial results stored as part of storing the initial results and pointers to the source data 230). The purpose of the comparison is to identify each row in the cell produced by the cell-based deduplication 212 that includes at least one initial result found after the process associated with stage 1 210 is completed. By comparing the initial results with the output of the cell-based deduplication 212 that has not yet been subjected to the token-based deduplication and filtering 222, the second process may help retain information that may be lost during the token-based deduplication and filtering 222. For example, as a result of aggressive deduplication, the tokenization process may break up personally identifiable information into patterns or expressions that may not be recognized by the NER classification 224. The output of the cross-reference deduplication unit and initial results 262 may be provided to the NER classification 264. Cross-referencing the initial results with information that has not yet been tokenized may help identify additional personally identifiable information using the NER classification 264. The final step may include taking the output of the NER classification 264 and storing the final result and a pointer 270 to the source data (e.g., to Figure 1 pointer to the source data in the ingested data cluster 170). Although Figure 2 Analysis layer 200 is shown as being implemented in a certain manner using a certain sequence of processes, but analysis layer 200 may also be implemented in other manners, including additional stages or processes.

[0035] Figure 3According to an example, a Figure 2 100 of the first process of performing a portion of source data processing 300. In this example, source data 310 includes five cells (312, 314, 316, 318, and 320). As shown, cells 312 and 320 are duplicates—each of these cells contains the same input data: www.example.com / update? user=john. The cell-based deduplication output 330 is shown as a cell-based deduplication output (e.g., Figure 2 The output of the unit-based deduplication process 212 shows that the duplicate unit 320 has been removed. Therefore, the unit-based deduplication output 330 includes only four units (332, 334, 336, and 338). The output of the unit-based deduplication process is deduplicated and filtered based on word segmentation (e.g., Figure 2 The word segmentation-based deduplication and filtering 222). The word segmentation-based deduplication output 340 shows the deduplicated word segments. The initial result 350 shows the result of filtering the unit-based deduplication output. Figure 2 The initial result 350 is obtained as a result of the regex classification 214 of the word segmentation-based deduplication output 340. Figure 2 The initial results of NER classification 224 were obtained.

[0036] Figure 4 According to an example, a Figure 2 The second process 400 is performed as part of the second process at stage 260. The second process generates cross-referenced data 410. In this example, the cross-referenced data 410 is Figure 3 This is because, as previously described, the cross-reference process can process the output of the cell-based deduplication and compare it with the initial results obtained after the process performed as part of the first process is completed. The purpose of this comparison is to identify each row in the cell produced by the cell-based deduplication process, including the rows that are generated after the completion of the cross-reference process with the cell-based deduplication process. Figure 2 The second process can help preserve information that may be lost in the word segmentation-based deduplication and filtering process by comparing the initial results with the unit-based deduplication output that has not yet been subjected to the word segmentation-based deduplication and filtering process. In this example, no such information is lost. Then, the cross-referenced data 410 is processed. Figure 2 NER classification 264. This in turn results in a NER classification output 420 that includes only entities that are identified and therefore likely to be PII.

[0037] Figure 5 A block diagram of a system portion 500 for detecting personally identifiable information (PII) according to one example is shown. Although running multiple processes with multiple classifiers can increase confidence and detection coverage, further processing is required before a PII leak can be identified. For example, not all IP addresses are necessarily personally identifiable information. Additional processing (such as distinguishing between private and public IP addresses) may be helpful. Similarly, certain names that appear in certain logs are not necessarily people's names, but may represent the maximum value that a variable can take (e.g., the word Max to identify the maximum value). System portion 500 includes a method for further processing the data from the log. Figure 2 The system portion 500 may include a detection layer 510, a remediation layer 530, and a presentation layer 550. The detection layer 510 may be configured to increase the fidelity of the data output by the analysis layer (e.g., by reducing false positives generated by the analysis layer). In this example, the detection layer 510 processes the analyzed data and sorts the leaks for priority purposes. The purpose of the detection layer 510 is to output a sorted result. The sorting of the results can be used to determine an action commensurate with the sorting. For example, the highest confidence result may result in an automatic notification of a PII leak, and a medium confidence result may require further analysis.

[0038] Continue to refer Figure 5 , the detection layer 510 can be configured to apply value rules and context rules to Figure 2 The value rules can be used to filter out false positive results related to personally identifiable information (PII) identified by the analysis layer. Example value rules for IP addresses may include: (1) removing those with a confidence score below a score threshold (as determined by Figure 2 (a) identifying PII that is generated as a result of the analysis performed by the analysis layer 200 of the embodiment of the present invention; (b) excluding any PII if the source of the PII corresponds to a column that should be excluded (e.g., a column that is unlikely to contain PII); (c) determining whether the IP address is a private IP address or a public IP address, and excluding the private IP address based on the determination; and (d) determining whether the IP address is a real IP address or a DLL version number. Example value rules for human names may include: (1) removing PII with a confidence score below a score threshold (as determined by Figure 2 200); and (2) excluding any PII if the source of the PII corresponds to a column that should be excluded (e.g., a column that is unlikely to contain PII). Example value rules for email addresses may include: (1) removing a column with a confidence score below a score threshold (as determined by Figure 2510); (2) if the source of the PII corresponds to a column that should be excluded (e.g., a column that is unlikely to contain PII), then exclude any PII; (3) determine whether the person's name matches a list of non-PII usernames (e.g., administration, support, no response, etc.), and exclude those names based on that determination; and (4) determine whether the character length of the username exceeds the maximum allowed character length (e.g., 64 characters), and then exclude those person's names that exceed the maximum allowed character length. These value rules are merely examples, and other value rules may be included as part of the detection layer 510.

[0039] Still reference Figure 5 , context rules can be used to help determine the normalized personally identifiable information (PII) score of any PII that is still indicated as existing after applying the above-mentioned value rules. Context rules can be related to the context of the data in which the PII is found. In one example, the PII detection score can be calculated based on how many context rules the claimed PII satisfies. The normalized PII score can be calculated by determining the weighted average of the context rules satisfied by the PII. The context rules can include an "include list" for each entity to include certain context strings. The context rules can also include an "exclude list" for each entity to exclude certain context strings. For example, for an IP address, the include list can have context strings such as "clientIP", "IPAddress", and "IP Address", and the exclude list can have context strings such as: "Version", "AssemblyVersion", "Hostname", and "requestURI". As another example, for a person's name, the include list may have context strings such as "URL," "URI," and "requestURI," and the exclude list may have context strings such as "HostName" and "AffinityKey." As another example, for an email address, the exclude list may have context strings such as "message id." In one example, any combination of value rules and context rules may be specified to act as a final filter in the process of personally identifiable information (PII) identification.

[0040] Figure 6 An example application of value rules and context rules for IP addresses is shown. Figure 6As shown, when the data is processed by the various layers and associated processes, the final set of any personally identifiable information leaked includes much less information than was initially ingested. In this example, unit-based deduplication data 610 is shown at the top. As previously described, the ingested data is processed by the analytics layer, which uses two flows to perform the processing. As part of the first flow, unit-based deduplication is performed, producing unit-based deduplication data 610. Tokenization of this data produces tokenized data 620. Token-based deduplication of tokenized data 620 produces token-based deduplication data 630. Upon completion of the analysis of the ingested data, the unit-based deduplication data 610 is performed. Figure 2 After the remaining processes described as part of the first process and the second process (e.g., first process NER classification, cross-reference, and second process NER classification) in the analysis layer output 640 are obtained. In this example, the analysis layer output 640 includes three IP addresses: "123.43.5.23", "1.0.3.2", and "10.32.4.12". As previously described, one of the value rules of the IP address includes determining whether the IP address is a private IP address or a public IP address, and excluding the private IP address based on the determination. In this example, the IP address "10.32.4.12" is a private IP address, so the output after applying the value rule 660 excludes the IP address. As previously described, one of the context rules of the IP address determines whether the IP address is used in the context of the context string: "version". In this example, the IP address "1.0.3.2" is preceded by the pattern "myClient Version" (as shown in the deduplication data 630 based on word segmentation), so the IP address is excluded from PII. This in turn results in the output after applying context rule 670 only including the IP address "123.43.5.23". Figure 6 As shown, Figure 5 The remedial layer 530 and Figure 5 The presentation layer 550 provides the output of the detection layer (after applying the value rules and context rules).

[0041] Figure 7 According to an example Figure 5Output table 700 of detection layer 510 of the present invention. Output table 700 includes several columns, including columns identified as follows: category 710, fully qualified table name 720, PII column 730, operation name 740, PII detection score 750, text 760, report timestamp 770, and leakage characteristics 780. Category 710 specifies the category to which PII belongs. Example categories include email addresses, IP addresses, or names. Fully qualified table name 720 includes the complete table name containing PII. PII column 730 includes columns containing PII (e.g., message column, exception column, etc.). Operation name 740 specifies the operation that causes PII leakage (e.g., CreateTable (create table), UpdateRow (update row), etc.). Output table 700 groups potential PII leakage according to operation name 740. In a multi-classifier approach, the same PII can be detected in multiple classifiers. The detection layer using additional post-processing is responsible for the aggregation of classifications from multiple sources and generates a unique signal for each leakage. Being able to combine multiple classifiers is useful because not all classifiers can detect all entities associated with PII leakage with the same confidence. Some classifiers are better at some entities, while other classifiers are better at other entities.

[0042] Continue to refer Figure 7 , the PII detection score 750 column of the output table 700 may include a confidence score (as represented by Figure 2 The confidence scores may be normalized to facilitate proper comparison. Text 760 may include the detected text that is the basis for the PII leak. Report timestamp 770 may include the date and / or time when the PII leak was detected. Leak characteristics 780 may include additional information about the PII leak. For example, leak characteristics 780 may include information about whether the PII leak is related to internal information or external information. Figure 7 The output table 700 is shown as a certain number of columns arranged in a certain manner, but the output table 700 may include additional or fewer columns arranged in a different manner. For example, the output table 700 may include an activity name and / or activity identifier (if available) associated with each PII leak. In addition, the information shown in the output table 700 may be communicated using other formats.

[0043] Back to Figure 5, the remediation layer 530 can consume the highest confidence results generated by the detection layer 510 to generate a signal that can be used to clean up the PII or otherwise remediate the PII leak. In a distributed system (e.g., a cloud computing system), multiple events that may be the source of a PII leak can occur at the same precise timestamp. The remediation layer 530 can make the PII leak traceable (e.g., by identifying the location of the PII leak in the source data). The detection table can have more than 50,000 rows that share the same timestamp. In such a situation, additional information may be required to uniquely identify the leak. Such additional categories of information may include an ingestion batch ID and an ingestion row ID, which may be included in the output table 700. The ingestion batch ID can be compared to the previously referenced Figure 1 The ingestion layer described herein generates batches of 1GB of source data. Within a batch, each row can be imprinted with an ingestion row ID. The ingestion row ID can be used to pinpoint the exact row within the batch that corresponds to a leak. Another advantage of the ingestion batch ID and ingestion row ID is that developers are able to collaborate across email and event management systems without exposing sensitive PII information. The ingestion batch ID and ingestion row ID pointers can also be used to build shareable queries that show where personal information is found (or where the PII originated) to collaborate rather than exposing PII.

[0044] Still reference Figure 5 , the presentation layer 550 can allow the system administrator (or another authorized user) to access information related to the PII leak by enabling the system administrator to obtain enhanced reports related to the PII leak. In addition, the presentation layer 550 can allow the system administrator to view a summary scan report that includes all PII originating from a particular source. When relevant or available, such a summary scan report can include the technical and associated operation names of PII by classification category. In addition, the presentation layer 550 can allow the system administrator to review the PII text itself that led to the detection. The presentation layer 550 can also allow on-demand scanning of data sources from any PII source.

[0045] Figure 8 8 is a block diagram of a computing system 800 for executing methods associated with the present disclosure according to an example. The computing system 800 may also be used to implement the above Figure 1 , 2, and 5 described processes and layers. Computing system 800 can be a distributed computing system, which includes components placed in a data center, a customer's house, or any other location. For example, computing system 800 is used to implement various parts of the components, services, layers, processes, and data storage described herein. Computing system 800 includes (multiple) processors 802, (multiple) I / O components 804, memory 806, (multiple) presentation components 808, sensors 810, (multiple) databases 812, network interfaces 814, and (multiple) I / O ports 816, which can be interconnected via bus 820. (Multiple) processors 802 can execute instructions stored in memory 806 or any other instructions received via wired or wireless connections. (Multiple) processors 802 may include CPUs, GPUs, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or other types of logic configured to execute instructions. (Multiple) I / O components 804 may include components such as keyboards, mice, speech recognition processors, or touch screens. The memory 806 may be any combination of non-volatile storage or volatile storage (e.g., flash memory, DRAM, SRAM, or other types of memory). The (multiple) presentation components 808 may include (multiple) displays, (multiple) holographic devices, or other (multiple) presentation devices. The (multiple) displays may be any type of display, such as an LCD, LED, or other type of display. The (multiple) sensors 810 may include telemetry or other types of sensors configured to detect and / or receive information (e.g., conditions associated with various devices in a data center). The (multiple) sensors 810 may include sensors configured to sense conditions associated with a CPU, memory or other storage component, FPGA, motherboard, baseboard management controller, etc. The (multiple) sensors 810 may also include sensors configured to sense conditions associated with a rack, chassis, fan, power supply unit (PSU), etc. The sensor(s) 810 may also include sensors configured to sense conditions associated with a network interface controller (NIC), a top of rack (TOR) switch, a middle of rack (MOR) switch, a router, a power distribution unit (PDU), a rack-level uninterruptible power supply (UPS) system, or the like.

[0046] Still reference Figure 8, (multiple) databases 812 may be used to store any data or files (e.g., metadata storage or other data sets) required to perform the various methods and systems described herein. (Multiple) databases 812 may be implemented as a collection of distributed databases or as a single database. (Multiple) network interfaces 814 may include communication interfaces such as Ethernet, cellular radio, Bluetooth radio, UWB radio, or other types of wireless or wired communication interfaces. (Multiple) I / O ports 816 may include Ethernet ports, fiber optic ports, wireless ports, or other communication ports.

[0047] Instructions for enabling various systems, components, devices, methods, services, layers, and processes may be stored in memory 806 or another memory. When the instructions are executed by processor(s) 802 or other processors, the instructions may provide functionality associated with the various systems, components, devices, services, layers, processes, and methods described in this disclosure. The instructions may be encoded as hardware corresponding to a processor or a field programmable gate array. Other types of hardware, such as ASICs and GPUs, may also be used. The functionality associated with the systems, services, devices, components, methods, processes, and layers described herein may be implemented using any appropriate combination of hardware, software, or firmware. Although Figure 8 Computing system 800 is shown as including a certain number of components arranged and coupled in a certain manner, but the computing system may include fewer or additional components arranged and coupled in a different manner. In addition, the functionality associated with computing system 800 may be distributed or combined as desired.

[0048] Fig. 9A data center 900 for implementing a system and method for identifying PII according to an example is shown. As an example, the data center 900 may include several rack clusters, which include platform hardware, such as computing resources, storage resources, network resources, or other types of resources. The computing resources may be provided via a computing node, which is provided via a server, which may be connected to a switch to form a network. The network may enable connection between each possible combination of switches. The data center 900 may include a server 1 910 and a server N 930. The data center 900 may also include data center-related functions 960, including deployment / monitoring 970, directory / identification services 972, load balancing 974, a data center controller 976 (e.g., a software defined network (SDN) controller and other controllers), and a router / switch 978. Server 1 910 may include CPU(s) 911, host hypervisor 912, memory 913, storage interface controller(s) (SIC) 914, cooling 915, network interface controller(s) (NIC) 916, and storage disks 917 and 918. Server N 930 may include CPU(s) 931, host hypervisor 932, memory 933, storage interface controller(s) (SIC) 934, cooling 935, network interface controller(s) (NIC) 936, and storage disks 937 and 938. Server 1 910 may be configured to support virtual machines, including VM1 919, VM2 920, and VMN 921. The virtual machines may also be configured to support applications, such as APP1 922, APP2 923, and APPN 924. Server N 930 may be configured to support virtual machines, including VM1 939, VM2 940, and VMN 941. The virtual machines may also be configured to support applications, such as APP1 942 , APP2 943 , and APPN 944 .

[0049] Continue to refer Fig. 9 In one example, a data center 900 may be enabled for multiple tenants using a virtual extensible local area network (VXLAN) framework. Each virtual machine (VM) may be allowed to communicate with VMs in the same VXLAN segment. Each VXLAN segment may be identified by a VXLAN network identifier (VNI). Fig. 9 Data center 900 is shown as including a certain number of components arranged and coupled in a certain manner, but the data center may include fewer or additional components arranged and coupled in a different manner. In addition, the functions associated with data center 900 may be distributed or combined as desired.

[0050] Fig.10A flowchart 1000 of a method for detecting personally identifiable information according to an example is shown. The steps associated with the method may be performed by the various layers described above. As previously described, when instructions corresponding to the layers constituting a processing system for detecting personally identifiable information are executed by at least one processor, the steps described herein may be performed. Step 1010 may include ingesting data associated with a cloud computing system to generate source data. As previously described with reference to Figure 1 As explained, ingested data can include Figure 1 The various components of the ingestion layer 150 are related to the execution of instructions. Figure 1 As explained, data associated with a cloud computing system may include telemetry and data obtained by executing queries against any service or application running in the cloud computing system. Source data may include data generated by Figure 1 The ingestion layer 150 generates the index columns.

[0051] Step 1020 may include, after ingestion, as part of a first process, processing the source data by performing unit-based deduplication to generate unit-based deduplicated data, performing regular expression classification on the unit-based deduplicated data to generate a first subset of initial results, tokenizing the unit-based deduplicated data to generate tokenized data, and deduplicating the tokenized data and performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results. In one example, step 1020 may be performed as part of a first process with Figure 2 Stage 1 210 of the analysis layer 200 performs various aspects related to the execution of a portion of an instruction.

[0052] Step 1030 may include, after executing the first process, as part of a second process, cross-referencing the unit-based deduplication data and the initial result, and performing a second named entity recognition classification on the cross-referenced output to generate a final result. In one example, step 1030 may be performed as a step with Figure 2 Stage 2 260 of the analysis layer 200 performs various aspects related to the execution of a portion of the instruction.

[0053] Step 1040 may include processing the final results to detect any personally identifiable information in the final results. Figure 5 As explained, processing the final result may include performing Figure 5 The instructions related to each component of the detection layer 510. As previously referenced Figure 5 As explained, processing the final result to detect any personally identifiable information in the final result may include applying value rules and context rules to the final result. In addition, the final result may include a pointer to a service responsible for any leakage of personally identifiable information.

[0054] Fig.11 A flowchart 1100 of another method for detecting personally identifiable information according to an example is shown. The steps associated with the method can be performed by the various layers described previously. As previously described, when the instructions corresponding to the layers constituting the processing system for detecting personally identifiable information are executed by at least one processor, the steps described herein can be caused to be performed. Step 1110 can include ingesting telemetry associated with a cloud computing system, and generating batches of source data based on the ingested telemetry, wherein each batch can be identified using an associated batch identifier. As described in reference Figure 1 As explained above, data associated with a cloud computing system may include data obtained by executing queries on any service or application running in the cloud computing system. Figure 1 The ingestion layer 150 generates the index columns.

[0055] Step 1120 may include, as part of a first process, processing each batch of source data by performing unit-based deduplication to generate unit-based deduplication data, performing regular expression classification on the unit-based deduplication data to generate a first subset of initial results, tokenizing the unit-based deduplication data to generate tokenized data, and deduplicating and filtering the tokenized data to generate deduplicated tokenized data, and performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results. In one example, step 1120 may be performed as a first process with Figure 2 Stage 1 210 of the analysis layer 200 performs various aspects related to the execution of a portion of an instruction.

[0056] Step 1130 may include, after executing the first process, cross-referencing the unit-based deduplication data and the initial result as part of the second process, and performing a second named entity recognition classification on the cross-referenced output to generate a final result. In one example, step 1130 may be performed as a step with Figure 2 Stage 2 260 of the analysis layer 200 performs various aspects related to the execution of a portion of the instruction.

[0057] Step 1140 may include processing the final results to detect any personally identifiable information (PII) in the final results. Figure 5 As explained, processing the final result to detect any personally identifiable information in the final result may include applying value rules and context rules to the final result. In addition, the final result may include a pointer to a service responsible for any leakage of personally identifiable information.

[0058] In summary, the present disclosure relates to a method implemented by a processing system including at least one processor. The method may include ingesting data associated with a cloud computing system to generate source data. The method may also include, after ingestion, as part of a first process, processing the source data by performing unit-based deduplication to generate unit-based deduplicated data, performing regular expression classification on the unit-based deduplicated data to generate a first subset of initial results, tokenizing the unit-based deduplicated data to generate tokenized data, deduplicating the tokenized data, and performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results.

[0059] The method may also include, after performing the first process, cross-referencing the unit-based deduplication data with the initial result as part of a second process, and performing a second named entity recognition classification on the cross-referenced output to generate a final result. The method may also include processing the final result to detect any personally identifiable information in the final result.

[0060] The source data may include an index column. The method may also include, after deduplicating the tokenized data, filtering the deduplicated tokenized data before performing the first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results. Processing the final results to detect any personally identifiable information in the final results may include applying a value rule and a context rule to the final results.

[0061] The method may also include grouping any detected personally identifiable information by service operation name, activity name, or activity identifier. The end result may include pointers to any leaked services responsible for personally identifiable information and pointers to source data from which the personally identifiable information originated. Data associated with a cloud computing system may include telemetry and data obtained by performing queries on any service or application running in the cloud computing system.

[0062] In another aspect, the present disclosure is directed to a processing system including at least one processor, the processing system including instructions that, when executed by the at least one processor, perform operations including ingesting data associated with a cloud computing system to generate source data. The operations may also include, after ingestion, as part of a first process, processing the source data by operations including performing unit-based deduplication to generate unit-based deduplicated data, performing regular expression classification on the unit-based deduplicated data to generate a first subset of initial results, tokenizing the unit-based deduplicated data to generate tokenized data, and deduplicating the tokenized data and performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results.

[0063] The processing system may also include instructions that, when executed by at least one processor, perform operations including, after executing the first process, as part of the second process, cross-referencing the cell-based deduplication data with the initial result, and performing a second named entity recognition classification on the output of the cross-referencing operation to generate a final result. The processing system may also include instructions that, when executed by at least one processor, perform operations including processing the final result to detect any personally identifiable information in the final result.

[0064] The source data may include index columns. The operations may also include an operation of filtering the deduplicated tokenized data before performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results. The operation of processing the final results to detect any personally identifiable information in the final results may include an operation of applying value rules and context rules to the final results.

[0065] The operations may also include an operation to group any detected personally identifiable information by service operation name, activity name, or activity identifier. The end result may include a pointer to any leaked service responsible for the personally identifiable information, as well as a pointer to the source data from which the personally identifiable information originated. The data associated with the cloud computing system may include telemetry and data obtained by performing queries on any service or application running in the cloud computing system.

[0066] In another aspect, the present disclosure relates to a method implemented by a processing system including at least one processor. The method may include ingesting telemetry associated with a cloud computing system, and generating batches of source data based on the ingested telemetry, wherein each batch may be identified using an associated batch identifier. The method may also include, as part of a first process, processing each batch of the source data by performing unit-based deduplication to generate unit-based deduplicated data, performing regular expression classification on the unit-based deduplicated data to generate a first subset of initial results, tokenizing the unit-based deduplicated data to generate tokenized data, deduplicating and filtering the tokenized data to generate deduplicated tokenized data, and performing a first named entity recognition classification on the deduplicated tokenized data to generate a second subset of initial results.

[0067] The method may also include, after executing the first process, as part of a second process, cross-referencing the unit-based deduplication data and the initial result, and performing a second named entity recognition classification on the cross-referenced output to generate a final result. The method may also include processing the final result to detect any personally identifiable information (PII) in the final result.

[0068] The source data may include an index column. Processing the final result to detect any personally identifiable information in the final result may include applying a value rule and a context rule to the final result. The method may also include grouping any detected personally identifiable information by service operation name, activity name, or activity identifier.

[0069] The end results may include pointers to any services responsible for the disclosure of personally identifiable information, as well as pointers to source data from which the personally identifiable information originated. Data associated with a cloud computing system may also include data obtained by performing queries on any service or application running in the cloud computing system.

[0070] It should be understood that the systems, services, devices, methods, terminals, and components described herein are only examples. Alternatively or additionally, the functions described herein may be performed at least in part by one or more hardware logic components. For example, illustrative types of hardware logic components that can be used include FPGA, ASIC, application specific standard product (ASSP), system on chip (SOC), complex programmable logic device (CPLD). In an abstract but still clear sense, the arrangement of any components that implement the same function is effectively "associated" to achieve the desired function. Therefore, any two components combined herein to achieve a specific function can be regarded as "associated" with each other, regardless of the architecture or intermediate components, so as to achieve the desired function. Similarly, any two components so associated can also be regarded as "operably connected" or "coupled" to each other to achieve the desired function. Just because a component that can be any other implementation of a device, structure, equipment, system, or function is described herein as being coupled to another component, this does not mean that these components must be separate components. As an example, a component A described as being coupled to another component B can be a subcomponent of component B, component B can be a subcomponent of component A, or component A and component B can be a combined subcomponent of another component C.

[0071] Functions associated with some examples described in this disclosure may also include instructions stored in non-transient media. The term "non-transient media" used herein refers to any medium that stores data and / or instructions that cause a machine to operate in a particular manner. Exemplary non-transient media include non-volatile media and / or volatile media. For example, non-volatile media include hard disks, solid-state drives, disks or tapes, optical disks or tapes, flash memory, EPROM, NVRAM, PRAM, or other such media, or networked versions of such media. For example, volatile media include dynamic memory (such as DRAM, SRAM, cache, or other such media). Non-transient media are different from transmission media, but can be used in combination with transmission media. Transmission media are used to transmit data and / or instructions to or from a machine. Exemplary transmission media include coaxial cables, fiber optic cables, copper wires, and wireless media, such as radio waves.

[0072] In addition, those skilled in the art will recognize that the boundaries between the functions of the above-mentioned operations are merely illustrative. The functions of multiple operations can be combined into a single operation, and / or the functions of a single operation can be distributed in additional operations. In addition, alternative embodiments can include multiple instances of specific operations, and the order of operations can be changed in various other embodiments.

[0073] Although the present disclosure provides specific examples, various modifications and changes may be made without departing from the scope of the present disclosure as set forth in the following claims. Therefore, the description and drawings should be regarded as illustrative rather than restrictive, and all such modifications are intended to be included within the scope of the present disclosure. Any benefits, advantages, or solutions to problems described herein with respect to specific examples are not intended to be construed as key, required, or essential features or elements of any or all claims.

[0074] In addition, the terms "a" or "an" as used herein are defined as one or more. Likewise, even when the same claim includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "a" or "an", the use of introductory phrases such as "at least one" and "one or more" in the claims should not be construed as implying that the introduction of another claim element by the indefinite article "a" or "an" limits any particular claim containing such introduced claim element to inventions containing only one such element. The same is true for the use of definite articles.

[0075] Unless otherwise stated, terms such as "first" and "second" are used to arbitrarily distinguish between the elements these terms describe. Therefore, these terms are not necessarily intended to indicate temporal or other prioritization of these elements.

Claims

1. A method implemented by a processing system, the processing system comprising at least one processor, the method comprising: Ingesting data associated with cloud computing systems to generate source data; After the ingestion, as part of the first process, the source data is processed by: performing cell-based deduplication to generate cell-based deduplication data, performing regular expression classification on the cell-based deduplication data to generate a first subset of initial results, tokenizing the unit-based deduplication data to generate tokenized data, and De-duplicating the segmented data, and performing a first named entity recognition classification on the de-duplicated segmented data to generate a second subset of the initial results; After executing the first process, as part of a second process, cross-reference the unit-based deduplication data and the initial result, and perform a second named entity recognition classification on the cross-referenced output to generate a final result; as well as The final result is processed to detect any personally identifiable information in the final result. The method of claim 1 , wherein the source data comprises indexed columns.

3. The method according to claim 1 further includes, after deduplicating the tokenized data, filtering the deduplicated tokenized data before performing the first named entity recognition classification on the deduplicated tokenized data to generate the second subset of the initial results. 4 . The method of claim 1 , wherein processing the final result to detect any personally identifiable information in the final result comprises applying value rules and context rules to the final result.

5. The method of claim 1, further comprising grouping any detected personally identifiable information by service operation name, activity name, or activity identifier.

6. The method of claim 1, wherein the end result includes a pointer to a service responsible for any leakage of the personally identifiable information and a pointer to source data from which the personally identifiable information originated.

7. The method of claim 1, wherein the data associated with the cloud computing system includes telemetry and data obtained by executing queries on any service or application running in the cloud computing system.

8. A processing system comprising at least one processor, the processing system comprising instructions, when the instructions are executed by the at least one processor, performing operations, the operations comprising: Ingesting data associated with cloud computing systems to generate source data; After ingestion, as part of the first process, the source data is processed through operations including: performing cell-based deduplication to generate cell-based deduplication data, performing regular expression classification on the cell-based deduplication data to generate a first subset of initial results, tokenizing the unit-based deduplication data to generate tokenized data, and De-duplicating the segmented data, and performing a first named entity recognition classification on the de-duplicated segmented data to generate a second subset of the initial results; After executing the first process, as part of a second process, cross-referencing the unit-based deduplication data and the initial result, and performing a second named entity recognition classification on the output of the cross-referencing operation to generate a final result; as well as The final result is processed to detect any personally identifiable information in the final result.

9. The processing system of claim 8, wherein the source data comprises indexed columns.

10. The processing system of claim 8, wherein the operations further comprise an operation of filtering the deduplicated tokenized data before performing the first named entity recognition classification on the deduplicated tokenized data to generate the second subset of the initial results.

11. The processing system of claim 8, wherein the operation of processing the final result to detect any personally identifiable information in the final result comprises the operation of applying value rules and context rules to the final result.

12. The processing system of claim 8, wherein the operations further comprise the operations of grouping any detected personally identifiable information by service operation name, activity name, or activity identifier.

13. The processing system of claim 8, wherein the final result includes a pointer to a service responsible for any leakage of the personally identifiable information and a pointer to source data of a source of the personally identifiable information.

14. The processing system of claim 8, wherein the data associated with the cloud computing system includes telemetry and data obtained by executing queries on any service or application running in the cloud computing system.

15. A method implemented by a processing system, comprising at least one processor, the method comprising: ingesting telemetry associated with the cloud computing system and generating batches of source data based on the ingested telemetry, wherein each batch may be identified using an associated batch identifier; As part of the first process, each batch of source data is processed by: performing cell-based deduplication to generate cell-based deduplication data, performing regular expression classification on the cell-based deduplication data, to generate a first subset of initial results, tokenizing the unit-based deduplication data to generate tokenized data, and De-duplicating the tokenized data and screening the tokenized data to generate de-duplicated tokenized data, and performing a first named entity recognition classification on the de-duplicated tokenized data to generate a second subset of the initial results; After executing the first process, as part of a second process, cross-reference the unit-based deduplication data and the initial result, and perform a second named entity recognition classification on the cross-referenced output to generate a final result; as well as The final results are processed to detect any personally identifiable information (PII) in the final results.

Images