Traffic Analyzer for Intent-Based Information Quarantine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for monitoring and enforcing electronic information dissemination policies are inadequate as they fail to understand the motives behind information leaks, leading to suboptimal event handling and potential damage to organizations due to unauthorized dissemination of sensitive information.
Innovation Solution
A system and method that analyze the intent of senders through various heuristics and scenarios to determine the likelihood of malicious or mistaken intentions, using a traffic analyzer with an intention assessment unit to quarantine information before dissemination, and identify problematic business policies by analyzing recipient addresses and message parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current monitoring systems block all unauthorized information dissemination events, then information confidentiality is improved, but legitimate business processes are disturbed
Solution Approach 1:
The patent segments information dissemination events into different categories based on sender motivation (malicious, mistake, bending rules, legitimate). This segmentation allows the system to apply different handling strategies to different types of events, blocking only malicious ones while allowing legitimate and mistake events to proceed with appropriate notifications.
Solution Approach 2:
The patent applies different quality levels of monitoring and response to different types of dissemination events. Malicious events receive complete blocking with no notification, mistake events receive notification and opportunity to override, and bending rules events receive specific handling. This local differentiation resolves the contradiction by being strict where needed and permissive where appropriate.
2Measurement precision
If monitoring systems analyze all electronic information traffic in detail, then detection accuracy of unauthorized dissemination is improved, but system complexity and processing time increase
Solution Approach 1:
The patent performs preliminary analysis of sender motivation and event characteristics before applying detailed monitoring rules. By pre-categorizing events based on initial indicators (sender identity, recipient pattern, information type), the system avoids complex analysis for events that are clearly legitimate or clearly malicious, reducing overall system complexity while maintaining detection accuracy.
Solution Approach 2:
The system uses automated analysis of event patterns and sender behavior to self-categorize dissemination events without requiring manual configuration for each case. The monitoring system serves itself by learning from patterns and automatically applying appropriate detection rules, reducing the complexity burden on operators while maintaining high detection accuracy.
3Ease of operation
If monitoring systems notify senders about all blocked dissemination events, then sender awareness and correction opportunities are improved, but malicious dissemination may be facilitated
Solution Approach 1:
The patent segments notification policies based on sender motivation type. Senders classified as making mistakes receive detailed notifications with opportunities to correct and resend. Senders classified as malicious receive no notifications, allowing the system to provide ease of operation where appropriate while preventing facilitation of harmful factors where dangerous.
Solution Approach 2:
Different quality levels of notification and interaction are applied to different sender types. Mistake senders receive high-quality interaction with explanations and correction opportunities, while malicious senders receive minimal or no interaction to prevent facilitation. This local differentiation resolves the contradiction between ease of operation and preventing harmful factors.
Data Source
AI summary
A system and method for determining an intent of a sender in transmitting electronic information in order to prevent unauthorized dissemination of electronic information is disclosed. The system and method facilitate cost-effective handling of dissemination events and comprise a traffic analyzer configured to analyze descriptors of the electronic information and parameters of the transmission of the electronic information in order to determine the intent of the sender. By determining the intent of the sender, it is possible to effectively quarantine the electronic information before it is disseminated.