Abstract:
Systems or methods gather information within a network of computers regarding the distribution of documents to calculate the impact of a cyber security incident for a given computer. Specific embodiments analyze word usage within data files and to determine that data files are different versions of a document and use presence of documents on a given computer to determine the impact of a security breach at that computer.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuation of application Ser. No. 13/494,067, filed on Jun. 12, 2012, now U.S. Pat. No. 8,893,281, issued on Nov. 18, 2014. 
     
    
     BACKGROUND 
       [0002]    1. Field of Invention 
         [0003]    This invention relates to computer applications which protect a corporate enterprise from security incidents, including unauthorized intrusions and malicious computer programs. 
         [0004]    2. Description of Prior Art 
         [0005]    The foundation of a good cyber-security policy for any corporate or government enterprise is a security risk assessment: the probability of a security incident and the impact if it were to occur. The amount of risk that can be tolerated and how to mitigate the risk can be determined based upon the risk assessment. 
         [0006]    A security risk assessment is difficult to perform, due in part to the difficulty of assessing impact. The impact of a security incident is most often related to the data which could be compromised, and the most difficult data to assess are corporate secrets. Corporate secrets are often located in text documents, digital slide presentations and spreadsheets. It is difficult locating and assessing the value of these documents throughout a large enterprise. 
       OBJECTS AND ADVANTAGES 
       [0007]    Accordingly, we claim the following as our objects and advantages of our invention:
       1. To automatically and continuously discover documents within an enterprise,   2. mathematically estimate the value of these documents,   3. Calculate the impact of a security incident for computers with these documents       
 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1 , System diagram 
           [0012]      FIG. 2 , Database Schema of the system. 
       
    
    
     LIST OF OBJECTS IN FIGURES 
       [0000]    
       
           10  Computers within the enterprise for which impact is calculated 
           20  Agent which runs on each computer to read and parse data files 
           30  Locally attached disk drive with data files to be analyzed 
           40  Database were data is stored about computers, data files, documents and their values 
           50  Computer which calculates distance (similarity) between data files, value of documents and impact to computers 
           60  Schema for database  50   
           100  Main table for data files linked to computers 
           120  Linking table between data files and words. Captures the number of times each word can be found in the data file 
           130  Table of all words found within all data files 
           140  Document table, which is used to identify data files which are different versions of the same document and assign a value to the document, 
           150  Group table, which is used to identify a group of computers defined by their user&#39;s rank, department or business function, 
           160  Value of a group 
       
     
       DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0025]    Impact of a security breach is calculated by analysis of data files present on computers within an enterprise  10 . Each computer has a program agent  20  which reads data files on disk drives  30  attached to the computer. The agent maybe a Windows NT Service in the case of a Windows operating system, or a demon in the case of a Linux operating system. The agent performs an analysis of words and sends the information to a database  40  with schema  60 . A computer  50  reads the information in the database, determines the distribution for each document, calculates values for each documents based upon its distribution, calculates the impact for each computer with an agent, and saves the information back into the database. Impact and document values for each computer can then be read from the database in order to perform a risk assessment. 
       Operation 
       [0026]    The invention calculates impact of a security breach in the three steps: 1) analyze word usage to identify different versions of the same documents, 2) analyze the distribution of documents to predict their value and 3) add together the value of all documents on a computer to predict the impact of a cyber security breach. Documents include all data files which can contain words such as text documents like Microsoft Word, electronic slides such as Microsoft PowerPoint and spreadsheets such as Microsoft Excel. 
       Identification of Documents Through Analyze of Word Usage 
       [0027]    As documents circulate within an enterprise, they may undergo revision and modification. In order to accurately assess the distribution of a document, all versions of a document must be recognized as the same document. Analysis of word usage is used to identify all versions of a document. 
         [0028]    To perform word usage analysis, each new data file is read and the file name is recorded in table  100 , along with the directory and a link to the computer; words in the document are parsed and the number of times each word appears is counted and recorded  120 . Note that all words across all documents are recorded  130 , and each document will have a value for every word, with a value of zero for words which cannot be found in the document. 
         [0029]    The distance, a measure of similarity, between data files is calculated using equation 1a and 1b. Equation 1a calculates the normalizing value N f  which is the sum of the word count for all words in data file f, and where w f  is the number of times word w is found in data file f. Equation 1b calculates D n,m  which is the distance between data files n and m. Data files which are within some threshold distance from one another are presumed to be the same document. Note that N f  therefore becomes N m  and N m  in equation 1b. 
         [0000]    
       
         
           
             
               
                 
                   
                     N 
                     f 
                   
                   = 
                   
                     
                       ∑ 
                       f 
                     
                      
                     
                       w 
                       f 
                     
                   
                 
               
               
                 
                   Equation 
                    
                   
                       
                   
                    
                   1 
                    
                   a 
                 
               
             
             
               
                 
                   
                     D 
                     
                       n 
                       , 
                       m 
                     
                   
                   = 
                   
                     
                       ∑ 
                       
                         
                           ( 
                           
                             
                               
                                 w 
                                 n 
                               
                                
                               
                                 / 
                               
                                
                               
                                 N 
                                 n 
                               
                             
                             - 
                             
                               
                                 w 
                                 m 
                               
                                
                               
                                 / 
                               
                                
                               
                                 N 
                                 m 
                               
                             
                           
                           ) 
                         
                         2 
                       
                     
                   
                 
               
               
                 
                   Equation 
                    
                   
                       
                   
                    
                   1 
                    
                   b 
                 
               
             
           
         
       
     
         [0030]    By using equation 1b, to find similar data files within the enterprise, data files can be organized into documents in the database, to determine their distribution and subsequently their value. Following are the steps to organize data files together into documents. Note that distance D n,m  in equation 1b is calculated in step 5. 
         [0031]    Steps to Organize Data Files into Documents 
         [0000]    
       
         
               
               
             
           
               
                   
               
               
                 Step 
                 Activity 
               
               
                   
               
             
             
               
                 1 
                 Delete all rows in the following tables: DOC_Document (140) 
               
               
                   
                 and DOF_DocumentDataFile (150) 
               
               
                 2 
                 Fetch the next data file from DAC_DataFileComputer (100), or 
               
               
                   
                 end if no more data files. 
               
               
                 3 
                 Go to step 2 if data file is already attached to a document 
               
               
                   
                 in the table DOC_Document (140) through linking table 
               
               
                   
                 DOF_DocumentDataFile (150) 
               
               
                 4 
                 Insert a new row in table DOC Document (140) and a linking 
               
               
                   
                 row in table DOF_DocumentDataFile (150) 
               
               
                 5 
                 Find all data files which are within the distance threshold 
               
               
                   
                 and link these to the row in table DOC_Document from step 
               
               
                   
                 3 by adding a linking row in DOF_DocumentDataFile (150) 
               
               
                 6 
                 Go to step 2 
               
               
                   
               
             
          
         
       
     
         [0032]    The Equations 1a and 1b can be implemented with database schema  60  by using SQL 1a and 1b, were SQL 1a can be used to calculate the normalizing values in equation 1a or variables @N and @M used in SQL 1b, and where SQL 1b can be used to calculate distance between data files @DataFile_n and @DataFile_m. 
         [0000]    
       
         
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 SQL 1a: 
               
               
                   
                   -- Normalizing value N f  and values @N and @M in SQL 1b 
               
               
                   
                   SELECT 
               
               
                   
                    SUM(DAW_Count) 
               
               
                   
                   FROM 
               
               
                   
                    DAW_DataFileWord 
               
               
                   
                   WHERE 
               
               
                   
                    DAW_DAC_DataFileComputerID=@DataFile 
               
               
                   
                 SQL 1b: 
               
               
                   
                   -- Distance value D n,m  between data files n and m 
               
               
                   
                   SELECT 
               
               
                   
                    SQRT(SUM(SQUARE(n.DAW_Count/@N-m.DAW_Count/ 
               
               
                   
                    @M) ) ) 
               
               
                   
                   FROM 
               
               
                   
                    DAW_DataFileWord 
               
               
                   
                     INNER JOIN DAC_DataFileComputer n 
               
               
                   
                     ON DAW_DAC_DataFileComputerID= 
               
               
                   
                     n.DAC_DataFileComputerID 
               
               
                   
                     INNER JOIN DAC_DataFileComputer m 
               
               
                   
                     ON DAW_DAC_DataFileComputerID= 
               
               
                   
                     m.DAC_DataFileComputerID 
               
               
                   
                   WHERE 
               
               
                   
                    n.DAW_WOR_WordID=m.DAW_WOR_WordID 
               
               
                   
                    AND n.DAW_DAC_DataFileComputerID=@DataFile_n 
               
               
                   
                    AND m.DAW_DAC_DataFileComputerID=@DataFile_m 
               
               
                   
                   
               
             
          
         
       
     
       Calculate Document Value Based on Distribution 
       [0033]    In order to calculate the value of documents, computers within an enterprise are organized into groups, where each computer is assigned to one or more groups. Groups may be departments within an organization such as the Human Resource department (HR), but they may also be artificial collections such as the most senior staff of a corporation, the CEO, CFO, CIO, CTO and COO (CXO). Groups are assigned values according to the value of documents they might produced. For example, the CXO group will have a higher value than the HR group since the CXO group is more likely to produce documents with company secrets. 
         [0034]    In the database schema ( 60 ), groups are created in the GRO_Group table ( 150 ) with their assigned values ( 160 ), and computers are organized into groups through the linking table GRC_GroupComputer ( 170 ). 
         [0035]    The value V d,g  of a document d is calculated for each group g according to equation 2a, where K g  ( 160 ) is the value for group g, N d,g  is the number of computers in group g where document d has appeared, and the denominator of equation 2a is the greater of two values N the total number of computers across all groups where the document has appeared or M g  the total number of computers within group g. The affect of the denominator in equation 2a is to devalue documents which are widely distributed or documents which are not distributed at all. 
         [0000]        V   d,g   =K   g   ×N   d,g /( NνM   g )  Equation 2a:
 
         [0036]    Each document therefore has a value for each group, with a value of zero for groups where the document does not appear. Equation 2b, assigns to document d a final value which is the highest value found for this document across all groups. This value is recorded in the DOC_Value column of database table DOC_Document ( 140 ). 
         [0000]        V   d =Max d ( V   d,g )  Equation 2b:
 
         [0037]    The value V d,g  for each document can be calculated with schema  60  by using SQL 2a-2c, where output from SQL 2a is the value N d,g , the output from SQL 2b is the value M g , and the output from SQL 2c is the value N. 
         [0000]    
       
         
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 SQL 2a: 
               
               
                   
                   -- Computers(N g ) in group=@Group which have 
               
               
                   
                 document=@Document 
               
               
                   
                   SELECT 
               
               
                   
                    DISTINCT COM_ComputerID 
               
               
                   
                   FROM 
               
               
                   
                    DOC_Document 
               
               
                   
                     INNER JOIN DOF_DocumentDataFile 
               
               
                   
                     ON DOF_DOC_DocumentID=DOC_DocumentID 
               
               
                   
                     INNER JOIN DAC_DataFileComputer 
               
               
                   
                     ON DAC_DataFileComputerID= 
               
               
                   
                     DOF_DAC_DataFileComputerID 
               
               
                   
                     INNER JOIN GRC_GroupComputer 
               
               
                   
                     ON DAC_COM_ComputerID=GRC_COM_ComputerID 
               
               
                   
                   WHERE 
               
               
                   
                    GRC_GRO_GroupID=@Group 
               
               
                   
                    AND DOC_DocumentID=@Document 
               
               
                   
                 SQL 2b: 
               
               
                   
                   -- Total Computers(M g ) in group=@Group 
               
               
                   
                   SELECT 
               
               
                   
                    COUNT(GRC_COM_ComputerID) AS Mg 
               
               
                   
                   FROM 
               
               
                   
                    GRC_GroupComputer 
               
               
                   
                   WHERE 
               
               
                   
                    GRC_GRO_GroupID=@Group 
               
               
                   
                 SQL 2c: 
               
               
                   
                   -- Total Computers(N) in all groups with document=@Document 
               
               
                   
                   SELECT 
               
               
                   
                    DISTINCT COM_ComputerID 
               
               
                   
                   FROM 
               
               
                   
                    DOC_Document 
               
               
                   
                     INNER JOIN DOF_DocumentDataFile 
               
               
                   
                     ON DOF_DOC_DocumentID=DOC_DocumentID 
               
               
                   
                     INNER JOIN DAC_DataFileComputer 
               
               
                   
                     ON DAC_DataFileComputerID= 
               
               
                   
                     DOF_DAC_DataFileComputerID 
               
               
                   
                   WHERE 
               
               
                   
                    DOC_DocumentID=@Document 
               
               
                   
                   
               
             
          
         
       
     
       Calculate Impact Based Upon Documents Present 
       [0038]    Finally, the impact I c  of cyber security incident for a computer c can be calculated using equation 3, which sums the value of documents present on that computer. 
         [0000]    
       
         
           
             
               
                 
                   
                     I 
                     c 
                   
                   = 
                   
                     
                       ∑ 
                       c 
                     
                      
                     
                       V 
                       d 
                     
                   
                 
               
               
                 
                   Equation 
                    
                   
                       
                   
                    
                   3 
                 
               
             
           
         
       
     
         [0039]    Impact I c  for each computer can be calculated with schema  60  by using SQL 3. 
         [0000]    
       
         
               
             
               
               
             
           
               
                   
               
               
                 SQL 3: 
               
               
                   
               
             
             
               
                   
               
             
          
           
               
                   
                 SELECT 
               
               
                   
                  SUM(GRO_Value) AS Impact 
               
               
                   
                  ,COM_ComputerIdentifier 
               
               
                   
                 FROM 
               
               
                   
                  COM_Computer 
               
               
                   
                   INNER JOIN DAC_DataFileComputer 
               
               
                   
                   ON DAC_COM_ComputerID=COM_ComputerID 
               
               
                   
                   INNER JOIN DOF_DocumentDataFile 
               
               
                   
                   ON DOF_DAC_DataFileComputerID= 
               
               
                   
                   DAC_DataFileComputerID 
               
               
                   
                   INNER JOIN DOC_Document 
               
               
                   
                   ON DOF_DOC_DocumentID=DOC_DocumentID 
               
               
                   
                 GROUP BY 
               
               
                   
                  COM_ComputerIdentifier