Generative adversarial network for named entity recognition

A generative adversarial network (GAN) may be implemented to recognize named entity types in detection of sensitive information in datasets. The GAN may include a generator and a discriminator. The generator may be trained to produce synthetic data to include information that simulates named entity types representing the sensitive information. The discriminator may be fed with real data that are known to include the sensitive information (as positive examples), together with the synthetic data that simulate the sensitive information (as negative examples), to train to classify the real vs. synthetic data. In field operations, the discriminator may be deployed to perform named entity type recognition to identify data having the sensitive information. The generator may be deployed to provide anonymous data in lieu of real data to facilitate sensitive information sharing and disclosure.

BACKGROUND

Sensitive information is data that requires guard from unauthorized access and unwarranted disclosure in order to maintain the information security of an individual or organization. Sensitive information may include personal information, corporations business information or governmental classified information. Protecting sensitive information is becoming increasingly important. For instance, the collection and use of Personally Identifiable Information (PII) (which is one example of sensitive information for purposes of illustration) have been under ever-increasing public scrutiny driven by concerns to protect customers’ privacy interests. Broadly speaking, PII data may include any data that could potentially identify a specific individual. For instance, PII data may include a person’s name, passport number, driver’s license number, social security number, telephone number, customer ID, websites, medical record, biomedical information, and so on. Governments around the world have been enacting stringent data protection laws, such as the European Union’s General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). To comply with relevant governmental regulations, it is thus important for companies that process, store, maintain, and manage data sets to have capabilities of examining and identifying data stores which contain sensitive data.

Identification of sensitive information, for instance, PII data, may be implemented based on named entity recognition (NER). For example, to perform PII data identification, individual PII data may be represented by a respective entity type. For example, human beings’ names may be designated as a first entity type, social security numbers may be represented by a second entity type, and so on. This way, identifying data stores which contain sensitive data (hereinafter “sensitive data stores”) is translated to detecting data stores which comprise the named entity types. Existing NER techniques generally base on discovering regular expressions (hereinafter “regexes”) or analyzing annotated data. A regex is a sequence of one or more characters that define a search pattern. For example, a string of numbers in the range of [000,000,000 - 999,999,999] may be a regex for finding a social security number. Annotated data are texts stored in a separate “annotation file” which annotate (or mark) entity types and/or their positions in the corresponding item, for example, a table in an Amazon DynamoDB, a JSON or XML file in an Amazon S3 bucket, etc. Google Data Loss Prevention (DLP) is one example based on annotated data to perform sensitive data scanning. However, neither of the above approaches is capable of large-scale detection of PII data stores. One, it is hard to deploy the approaches at scale. For example, it may require a large, if not impractical, amount of annotated data to automate scrutiny of large-scale data stores, e.g., those containing gigabytes, terabytes or even exabytes of data. Two, those approaches are vulnerable to issues such as syntactic ambiguities (e.g., a 9-digit number, defined as a regex, may be either a social security number or just a task ID), context proximity semantic (e.g., an IP address, defined as a content detector, may or may not be considered personal data depending on whether it is associated with a person’s name in proximity), and nature of the texts (e.g., natural language versus computed-aid generated texts). Thus, it is desirable to have a tool for implementing automated large-scale detection of sensitive data stores with improved accuracy and efficiency, but without reliance on regexes and/or annotated data.

While embodiments are described herein by way of example for several embodiments and illustrative drawings, those skilled in the art will recognize that the embodiments are not limited to the embodiments or drawings described. It should be understood, that the drawings and detailed description thereto are not intended to limit embodiments to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope as defined by the appended claims. The headings used herein are for organizational purposes only and are not meant to be used to limit the scope of the description or the claims. As used throughout this application, the word “may” is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must). The words “include,” “including,” and “includes” indicate open-ended relationships and therefore mean including, but not limited to. Similarly, the words “have,” “having,” and “has” also indicate open-ended relationships, and thus mean having, but not limited to. The terms “first,” “second,” “third,” and so forth as used herein are used as labels for nouns that they precede, and do not imply any type of ordering (e.g., spatial, temporal, logical, etc.) unless such an ordering is otherwise explicitly indicated.

DETAILED DESCRIPTION

In various embodiments, systems and methods for detecting data stores containing sensitive information may be implemented. A sensitive information detection system may comprise a topology inference module, an optional record sampling module, an entity type identifier, an optional structural clustering module, a feature engineering module, and a data store classifier. The topology inference module may access one or more data stores and, for individual data store, infer a topology of a respective data store based on metadata associated with items stored in the data store. The inferred topology may provide information as to distributions of the items in the respective data store. The topology inference module may also create one or more record set(s) based on external form similarities of the items of the data store. The optional record sampling module may, for individual data store, sample records from the items of the respective data store based on the inferred topology of the respective data store. The optional record samples may be representative of the whole population of the respective data store. For individual data store, the entity type identifier may analyze the record samples to determine whether the respective data store contains data which matches named entity types, wherein the named entity types represent sensitive information such as PII data. The optional structural clustering module may further partition individual record set into one or more record clusters based on structural similarities of the record samples in the record set. The structural similarities may represent an extent of content similarities of the record samples. Thus, the record clusters may have records of more homogenous structures than those in the corresponding record set. The feature engineering module may extract information obtained by the above modules, for instance, the metadata, identification of the named entity types, record cluster(s), and so on, to create one or more features. The data store classifier may then take the extracted features as input to detect whether the data store contains sensitive data. For instance, the data store classifier may render a confidence score to indicate a probability for the data store to contain sensitive information, such as PII data. For purposes of illustration, this disclosure will be focused on PII data detection. The systems, methods and techniques disclosed herein may however be applied for inspection of other types of sensitive information, such as corporations business information, governmental classified information, etc.

FIG.1is a block diagram showing an example sensitive data detection system, according to some embodiments. As shown inFIG.1, provider network100may provide various network-based services to one or more client(s)105via network110. For instance, provider network100may provide computing services115, storage services120, networking services125, email services130, application development services135and remote serve services140. Each of the above services may involve processing, storage, maintenance and management of datasets. Sensitive data detection system145may access the datasets, programmatically or on-demand, and inspect those datasets to detect whether and which datasets contain sensitive information such as PII data. As used herein, “data store” and “dataset” may be used interchangeably to mean a collection of data, typically data in objects or files stored in a storage resource.FIG.1depicts the applications of sensitive data detection system145in provider network100as one example. Sensitive data detection system145may be applied to detect sensitive data stored on local storage devices, enterprise local access networks (LANs), or a hybrid network including LAN and cloud computing resources, and the like. Moreover, in the context of large-scale data processing, storage, maintenance and management, it is more often to employ structured data formats in order to achieve organized data storage and fast search and retrieval. Example items having structured data may include tables in an Amazon DynamoDB, and JSON documents or XML files in an Amazon S3 bucket. Referring toFIG.1, sensitive data detection system145may include topology inference module150, optional record sampling module155, entity type identifier160, optional structural clustering module165, feature engineering module170, and data store classifier175. Sensitive data detection system145may access the data stores and collect information, such as locations of items stored in respective data stores and metadata associated with the items. Metadata may comprise information describing data in each item. The metadata may comprise, for instance, a means of creation of data, a purpose of the data, a time and date of creation, a creator or author of data, placement on a computer network associated with where the data was created, standards used, basic information (e.g., a digital image may include metadata describing how large the digital image is, a color or depth of the digital image, a resolution of the digital image, a creation time, etc.) Different from annotated data described above, metadata are not stored in a separate file. Rather, they may be generated together with data and become an integrated part of the data. In some embodiments, once created, metadata may be immutable. For instance, Amazon S3 bucket may create system-defined metadata for each object stored in the bucket, including object creation date, object size, last modification date, storage class, usage of encryption and permissions, etc. Further, when uploading data, a client may also assign user-created metadata to an object to aid data search and retrieval. The user-defined metadata may include, for example, column name, content type, and so on.

Based on the metadata associated with the items of the data store, topology inference module150may infer a topology of the data store. The topology inference may provide information as to distributions of items and their contained records in the data store. For instance, for a given S3 bucket, topology inference module150may analyze the bucket’s prefix tree architecture (i.e., the directory of the data store) to identify how many prefixes (i.e., folders) may be stored in the data store and how many items each prefix may contain. The distribution information may represent a density of the population of the data store, which may facilitate sampling of records by optional sample recording module155. Based on metadata, topology inference module150may further approximate items types and create one or more record sets. As used herein, the word “record” may refer to data of an item (e.g., an object or file) in a data store. For instance, a row of an Amazon DynamoDB table or a log event from an Amazon S3 log file may be viewed as one record. A record set may be a collection of items having a similar external form. For instance, tables in Amazon DynamoDB, Redshift or Athena may be grouped into one record set. Alternatively, log files of a service written to an S3 bucket may be another record set.

According to some embodiments, optional record sampling module155of sensitive data detection system145may sample records from the items of a data store. For a given data store, it may be ideal to inspect entire data of the data store. This is possible for small size data stores. However, for large-scale data stores having gigabytes, terabytes, or even exabytes of data, full population inspection may be challenging if not impossible. Thus, to improve efficiencies, optional record sampling module155may perform the record sampling based on the inferred topology of the data store. For instance, a S3 bucket may have three prefixes, wherein S3://a prefix stores 50% of the S3 bucket’s objects, S3://b/c prefix contains 40% objects, and S3://b/d prefix includes 10% objects. Record sampling module310may thus be configured to sample records randomly from //a, //b/c and //b/d prefixes in an approximate proportion with the distribution of items in those three prefixes. This way, the record samples may be representative for the whole population of this bucket.

According to some embodiments, entity type identifier160may be configured to identify that a datastore contains data matching one or more named entity types. As described above, each named entity type may represent one type of sensitive information. For instance, a first named entity type may represent clients’ names, while a second named entity type (with the first named entity type in proximity) may correspond to names of diseases (with clients’ names in proximity) - meaning disease information may belong to PII data if it is attributed to a person. This way, detecting the sensitive information may now translate to named entity recognition. Entity type identifier160may analyze the record samples and/or associated metadata to determine whether a given data store contains data that fit a named entity type. For instance, entity type identifier160may inspect the record samples to recognize whether the record samples include data that appear like a person’s name. Alternatively, entity type identifier160may examine whether the record samples contain data that match the name of a disease with adjacent data, e.g., data in the same record sample or the same object or file, which seem like a person’s name. According to some embodiments, entity type identifier160may be implemented using pattern-based approaches. The pattern-based approaches may employ dictionary-based solutions, implemented with indexes, prefix tress, or other data structures, capable of storing and retrieving textual patterns. One example pattern-based approach may use regex pattern matches with optional validation filters to identify named entities. Alternatively, according to some embodiments, entity type identifier160may be implemented based on machine learning algorithms, for instance, sequence-to-sequence (seq2seq) language processing networks, to perform named entity type identification.

According to some embodiments, sensitive data detection system145may include optional structural clustering module165, as shown inFIG.1. The purpose of structural clustering module165may cluster one or more record samples into record cluster(s). As described above, topology inference module150may create record set(s), based on metadata, each having a collection of records with a homogenous external form. The external form similarity may be obtained based on metadata and indicate that items in one record set may belong to same or similar types. Structural clustering module165may investigate the record samples in a record set, based on the record samples’ structural similarity, and further partition the record set into record cluster(s). The structural similarity may represent an extent of records’ content similarity, for example, how closely the records contain same or similar contents. Thus, rather than relying merely on metadata, structural clustering module165may use structures of the record samples to create the record cluster(s). The record cluster(s) may include record samples which may be more homogenous than those in original record set(s). For instance, a record set may include three DynamoDB records - table A, B and C. Table A may include fields such as (ID name, phone, age), table B may contain fields such as (ID, name, phone), and table C may have fields such as (company-name, symbol). Structural clustering module165may group tables A and B into a first record cluster because they have more similar structures and table C into a second record cluster.

According to some embodiments, feature engineering module170of sensitive data detection system145may perform feature transformation on information provided by topology inference module150, record sampling module155, entity type identifier160, and optional structural clustering module165to extract one or more features which may then be used as input to data store classifier175. For instance, feature engineering module170may create a small number of features from a large number to reduce dimensions of the input. Further, feature engineering module170may create a new feature to emphasize characteristics of the input to improve training performance. Moreover, feature engineering module170may transform the input into a uniform format to ease feature manipulation and calculations. Examples of extracted features may include, for instance, a percentage of records from a record set or cluster which have a given entity type, a mean number of labels of a given type from a given field of records in a record set or cluster, approximation of heat maps used to statistically test if a given sample comes from a given distribution characterizing a named entity, etc. The extracted features, based on entity type identification as well as metadata, may comprise information representing existence of an entity type but also “context” linked with the entity type, but without reliance on annotated data or regexes. This can mitigate ambiguities and improve precisions of sensitive data detection.

According to some embodiments, data store classifier175of sensitive data detection system145may classify the inspected data based on the extracted features. Unlike those existing approaches which primarily focus on identifying named entities, data store classifier175aims at providing a detection of whether the data store contains sensitive data. For instance, data store classifier175may render output, e.g., a decision about sensitive data store detection assigned with a confidence score. According to some embodiments, the confidence score may be a normalized value between [0, 1] balanced at 0.5. A score greater than 0.5 may be interpreted as: we believe that the data store contains sensitive data. The higher the confidence score, with the more probability that the data store does contain sensitive data. Alternatively, a score less than the threshold 0.5 may be construed as: we do not believe that the data store contains sensitive data, but there are some chances. The lower the confidence score, the more probably that the data store does not contain sensitive data. As described above, identifying an entity in a data store does not necessarily mean that the entity is actually sensitive data because of associated ambiguities. For example, identification of 9-digit numbers does not necessarily mean that they are sensitive data, because a 9-digit number could be a social security number or just a task ID. Thus, data store classifier175may provide a more meaningful and precise detection. For instance, instead of saying S3://Development contains social security numbers (which could actually be just task IDs) merely due to identifying 9-digit numbers, sensitive data detection system145may provide that S3://Development contains sensitive data with a 98% confidence score.

The above operations of sensitive data detection system145may be further illustrated inFIG.2. As shown inFIG.2, example sensitive data detection process200may begin with inferring topology of a data store, for instance, by topology inference module150as described above with regards toFIG.1(block205). The topology inference may be implemented based on metadata associated with items stored in a data store. The topology inference may provide density information as to distributions of items and/or their sizes in the data store, and create one or more record sets based on external form similarities. Based on the density information, sensitive data detection process200may transition to sample records, for instance, by record sampling module155ofFIG.1(block210). The record samples may be representative of the population of the data store. Next, sensitive data detection process200may analyze the record samples to identify named entity types contained in the record samples, for instance, by entity type identifier160as described above inFIG.1(block215). As described above, the named entity types may represent personal information such as PII data. Sensitive data detection process200may further optionally cluster the record samples to create record cluster(s) based on associated structural similarities, for instance, by structural clustering module165ofFIG.1(block220). The record cluster(s) may further partition a record set into more homogenous groups of record samples. Based on information obtained so far, sensitive data detection process200may perform feature engineering to extract features for data store classification. As described above, the feature engineering may be implemented based on identification of named entity types and metadata to create extracted features representing both named entities and associated context. Next, sensitive data detection process200may detect whether the data store contains sensitive data based on the extracted features, for instance, by data store classifier175(block230). For instance, sensitive data detection process200may provide information whether the data store contains sensitive data with an assigned confidence score. Sensitive data detection process200may be repeated for different data stores to inspect whether individual data store includes sensitive data.

FIG.3shows an example application of sensitive data detection, according to some embodiments. As shown inFIG.3, data management system300may include data store catalog305that may include one or more storage resources residing on a client’s premise and/or cloud. Data store catalog305may be configured to process, store, maintain and manage data sets. Data store catalog305may maintain a data ledge, such as a directory of objects, and provide the associated storage locations and metadata to sensitive data detection system310. Sensitive data detection system310may further obtain sensitive data detection rules from sensitive data definitions registry315. Governmental regulations often provide only generic definitions of PII data. For example, GDPR provides that personal data means “any information relating to an identifiable natural person.” CCPA has its own definitions on top of GDPA. One functionality of sensitive data definitions registry315is to “translate” the qualitative sensitive data regulations into computer friendly sensitive data detection rules. For instance, a first rule may be a first named entity type indicating people’s names; a second rule may be a second named entity type (with a first named entity type in proximity), wherein the second named entity type indicates names of diseases (with a person’s name in proximity) -meaning disease information may belong to PII data if it is attributed to a person. Sensitive data definitions registry315may continuously update the sensitive data detection rules along with evolution of governmental regulations and/or clients/companies’ legal requirements. Moreover, sensitive data detection system310may optionally receive privacy compliance rules320. The privacy compliance rules320may be provided by sensitive data definitions registry315or a separate privacy compliance rules repository. The privacy compliance rules may include mandatory and/or customized requirements as to sensitive data handling.

With these information, sensitive data detection system310, which may be substantially similar to sensitive data detection system145as described above inFIG.1, may access and inspect data stores to detect whether they contain sensitive data. For instance, sensitive data detection system310may access items in each of one or more data stores according to the storage locations. Sensitive data detection system310may infer a topology of the data store based on associated metadata, providing density information and/or creating record set(s). Sensitive data detection system310may sample records based on the density information. Sensitive data detection system310may optionally cluster the record samples to create record cluster(s). Sensitive data detection system310may identify named entity types based on the record samples. Sensitive data detection system310may extract feature(s) based on named entity type identification, record set(s) and/or record cluster(s) with feature engineering. Sensitive data detection system310may detect the data store to classify whether it contains PII data with a confidence score. In some embodiments, based on the detection, sensitive data detection system310may publish a sensitive data summary325. The sensitive data summary325may provide information as to distributions of the sensitive data in the one or more data stores, for example, whether a data store contains sensitive data, which data store contains sensitive data store, what type of data store are contained in which data store, statistics such as a percentage of sensitive data store in a database, etc. Further, the sensitive data summary325may display distributions of sensitive data at customizable hierarchical and detail levels. For instance, it may provide that DynamoDB table x contains GPS coordinates and customer IDs, or DynamoDB table x contains GPS coordinates in field f1 and customer IDs in field f2. Optionally, sensitive data detection system310may further make recommendations of privacy policy based on the detection and privacy compliance rules320. For instance, sensitive data detection system310may recommend a privacy policy as to data access, retention and usage restrictions to implement programmatical deletion of no longer needed sensitive data. Sensitive data summary325and optionally recommended privacy policy330may be provided to data store catalog305for creating an audit report335.

According to some embodiments, it may be required for sensitive data detection system310to inspect data stores securely. To implement a secure inspection, sensitive data detection system310may access data stored in the data stores in isolation. Isolation controls how and when changes as to a data store of a client are made and if they become visible to another data store or client. According to some embodiments, isolated data access may be implemented by using a fleet of one or more sensitive data detection systems310, as a central “detector”, to fetch and inspect data from individual data stores, and store relevant results. Alternatively, according to some embodiments, isolated data access may be performed in a decentralized manner where data stores, owned by one client, may be examined by one respective sensitive data detection system310. The respective sensitive data detection system310may be assigned customizable permissions, for launching and/or terminating computing resources, to read data from data stores of an individual client to perform sensitive data detection. This way, one sensitive data detection system310may be limited to access to only data stores owned by the same client. Further, operations of multiple sensitive data detection systems will not interfere with each other. For purposes of illustration, this disclose will focus on decentralized data access and sensitive data detection.

FIG.4is a flowchart showing an example process for performing the decentralized sensitive data detection, according to some embodiments. InFIG.4, sensitive data detection process400may first load a sensitive data detection system, for instance, from a repository (which may include one or more models of sensitive data detection systems, such as one substantially similar to sensitive data detection systems145and310) to create a sensitive data detection instance (block405). Next, PII data detection process400may obtain sensitive data detection rules, for instance, from sensitive data definitions registry315ofFIG.3as described above with regards toFIG.3(block410). Optionally, sensitive data detection process400may further obtain privacy compliance rules (block415). Then, the sensitive data detection system may access a data store, for instance, with corresponding permissions as described above (block420). The sensitive data detection system may, for example, read data and objects of the data store based on location information (e.g., provided by data store catalog305) and associated metadata. Next, the sensitive data detection system may inspect the data store to detect whether it contains sensitive data, following the operations described above inFIGS.1-3(block425). Based on the detection, the PII data detection system may publish a sensitive data summary for the inspected data store, such as sensitive data summary325described above inFIG.3(block430). Optionally, the sensitive data detection system may produce privacy policy recommendations, for instance, based on the privacy compliance rules as described above with regards toFIG.3(block435). Moreover, with the detection, the sensitive data detection system may generate a report for auditing purposes (block440).

Entity type identification may be implemented based on machine learning algorithms, for example, Hidden Markov Models (HMM), Decision Trees, Maximum Entropy Models, Support Vector Machines (SVM), and Conditional Random Fields (CRF), etc. According to some embodiments, sensitive data detection system145may perform the entity type identification with a generative adversarial network (GAN).FIGS.5A and5Bshow structures and operations of an example GAN for sensitive data store detection, according to some embodiments. As shown inFIG.5A, GAN500may include generator505and discriminator510. When training begins, generator505may take a training set, for instance, “random seeds”, as input. For convenience, the random seed may be created by randomly sampling real-world sensitive data. The real-world sensitive data may or may not be the same sensitive data used as positive examples in training of discriminator510. Generator 505 may train to generate synthetic sensitive data to simulate the training set which are known to contain sensitive data. The purpose may be to use the synthetic sensitive data to “fool” (and train) discriminator510so that it may perform better when in use. The synthetic sensitive data may be provided to sensitive discriminator510, serving as negative examples. As used herein, the words “negative examples” may be used to differentiate artificially generated sensitive data (by generator505) from positive examples known to have sensitive data collected. discriminator510may receive synthetic data (as negative examples) and real data (as positive examples) and train to distinguish synthetic vs. real data. discriminator510may provide a binary label to indicate results of the classification, for instance, 1 for positive example and 0 for synthetic data. Alternatively, discriminator510may provide the classification according to a confidence level which indicates a probability. For instance, discriminator510may provide that a training set to discriminator510has 75% chance to be synthetic data, or 33% chance to be a positive example. Based on success or not of the distinguishment, discriminator510may generate losses, based on loss function(s), for discriminator510itself and generator505. In training, discriminator510may work in a supervised mode. For instance, when discriminator510takes synthetic sensitive data (from generator505) as input but mistakenly classifies them as real data, or when discriminator510erroneously identifies real data as synthetic data, discriminator510may assign a high loss to itself. Conversely, when discriminator510correctly classifies the input as synthetic or real data respectively, discriminator510may produce a low loss to itself. Similarly, when generator505produces a forged sensitive data which is erroneously distinguished by discriminator510as real data, discriminator510may assign a low loss to generator505(to reward generator505′s successful fooling of discriminator510). Vice versa, when discriminator510successfully classifies the data from generator505as synthetic, discriminator510may feedback a high loss to generator505(to punish generator505′s defeat). Based on respective losses, generator505and discriminator510may update their respective parameters (e.g., weights and biases), for instance, with backpropagation and descent gradients. For example, (a new value of weight) = (an old value of the weight) - (learning rate) × (partial gradient of the loss with respect to the weight). As generator505and PII discriminator510compete against each other in training, generator505may become more skilled at forging synthetic sensitive data, while discriminator510grow better at discriminating synthetic vs real sensitive data. Training of GAN500may require positive only examples (e.g., a list of clients’ IDs) without having to annotate the corresponding objects and mark positions for the clients’ IDs. This can ease collections of training sets and improve efficiencies of sensitive data detection.

Once trained, GAN500may be deployed in field operations to perform named entity type identification, as shown inFIG.5B. For instance, discriminator510may receive record samples, for instance, from record sampling module155as described above inFIG.1. discriminator510may identify whether the record samples contain the named entity types. By comparison, generator505may be deployed to produce synthetic or anonymous sensitive data. When there is a need to disclose sensitive data or part of the sensitive data, for instance, to a third party, the anonymous sensitive data may replace the entire or part of the data to satisfy the disclosure but without exposing the actual sensitive data.

FIG.6shows example operations of GAN500, according to some embodiments. As shown inFIG.6, operation600may begin with training of GAN500, as described above with regards toFIG.5(block605). For instance, generator505may receive a training set (block605) and generate synthetic sensitive data (block610). discriminator510may receive positive examples (e.g., real data known to contain sensitive data) (block615) and discriminate synthetic vs real sensitive data (block620). discriminator510may generate losses for discriminator510itself and generator505(block625). operation600may determine whether training of GAN500may complete (block630). The determination may be reached based on, for example, how long GAN500has been trained, how many epochs have been executed, whether the losses fall within threshold values, etc. generator505and discriminator510may update their respective parameters, for instance, with backpropagation based on descent gradients, and repeat the above operations when the training is determined to continue (blocks635and640). Conversely, when operation600determines that GAN500′s training finishes, GAN500may be deployed to identify named entity types in record samples (blocks645and650). Separately, generator505may receive input such as random seeds (block655) and generate synthetic or anonymous sensitive data (block660).

According to some embodiments, generator505may be implemented with a long short-term memory (LSTM) network. LSTM is one type of recurrent neural network (RNN). A traditional artificial neural network (ANN) with standard feedforward and backpropagation updates parameters, such as weights and biases, every epoch with new input. However, this does not perfectly mimic a human being’s language learning process because he/she may understand semantics of a word based on the word itself as well as its prior words (or prior context). Unlike traditional ANNs, a LSTM network may capture temporal context information by passing a hidden state from one memory cell to another. The LSTM network may also include input gate, output gate and/or forget gate to further control what new information may be acquired, what candidate may be passed onto output, and/or what old information may be remembered or forgot.

FIG.7shows an example LSTM network used to implement generator505, according to some embodiments. As shown inFIG.7, LSTM network700may include first memory cell705, second memory layer710, and third memory layer715. In some embodiments, cells705,710and715may have substantially similar structures. InFIG.7, x may represent an input vector. In the context of named entity recognition, x may represent a sequence of characters from record samples. According to some embodiments, the sequence of characters may first be transformed into machine-readable vectors of a uniform format, such as word embeddings of the characters, according to Word2Vec or GloVe. For example, if a record sample is a sequence of characters corresponding to a person’s name, such as “John Alice Adams”, x may be {[0.4, 23.4, -0.6], [9.7, 5.4, -1.2], [-0.7, -5.2, -0.9]}. LSTM network700may process characters in the sequence of characters x, one by one. For instance, LSTM network700may take [0.4, 23.4, -0.6] as xtand send it to 1stcell705to generate output yt; take [9.7, 5.4, -1.2] as xt+1to 2ndcell710to generate output yt+1; and take [-0.7, -5.2, -0.9] as xt+1to 3rdcell715to generate output yt+2. h may represent hidden states of cells705,710and715, and c may represent memory states of cells705,710and715. As shown inFIG.7, each cell may take hidden states h and memory states c from a previous cell as part of input to produce its own hidden state and memory state. InFIG.7, hidden states h and memory states c of cells705,710and715may be configured with initial values, such as random values, at the beginning of the training of LSTEM network700. In training, hidden states h and memory states c may be updated, for instance, according to equations (1) - (5) as described below. By passing characters to cells705,710and715sequence-to-sequence, connections between cells705,710and715may form a directional temporal loop. The hidden states h may carry information about what LSTM700has seen over the time and supply it to the present time such that a loss function is not just dependent upon the data it is seeing in this time instant, but also, what it has seen historically. For instance, 2ndcell710may produce output yt+1based on information of a current character xt+1as well as a previous character xt(passed by ht), and similarly 3rdcell715may produce output yt+2based on a current character xt+2but also a previous character xt+1(through ht+1). In other words, LSTM network700learns semantics from each work and prior context. Memory state may represent selective memory of the past and current instants. In particular, a cell may use respective input gate, forget gate and output gate to control what new information to acquire, what old information to remember and what candidate to pass onto output. For instance, 1stcell705may comprise pointwise multiplication operators745associated with i, f and o, respectively. Each multiplication operator745may form a gate which may control passing of information. For instance, multiplication operator745associated with ftmay multiple vectors ct-1and ftelement-by-element. Assuming that ct-1equals to [0.3, 0.7] and ftequals to [1, 0], the pointwise multiplication of ct-1and ftproduces [0.3, 0]. Thus, pointwise multiplication operator745passes the first element of ct-1(i.e., 0.3) and blocks the second element (i.e., 0.7). In other words, ftmay represent a gate weight vector. Accordingly, i and o may each represent a gate weight vector for respective multiplication operators745.

1stcell705may also include pointwise addition operator750which may add input vectors element-by-element to produce a sum. Moreover, activation operators720,725,730,735,740and770may each represent operations of an internally-connected network as shown at the lower corner ofFIG.7. For instance, activation operator720may include internally-connected network760and logistic sigmoid function765. Given input, activation operator720may produce: output = sigmoid (weights° input + biases) where symbol “°” represents a pointwise multiplication and sigmoid() indicates a sigmoid function. Note that the activation operators in cells705,710and715may employ different numbers of neurons, albeit they may have similar structures. In light of the above description andFIG.7, operations of 1stcell705, may be described according to equations (1) - (6):

Referring back toFIG.5, in training, LSTM network700(as used to implement generator505) may generate synthetic sensitive data based on training set, for instance, random seeds. For instance, LSTM700may produce output y ({yt, yt+1, yt+2}) which correspond to words “Michael”, “Apple”, and “Blue” according to equations (1) - (5). LSTM network700may provider as synthetic sensitive data to discriminator510. discriminator510may take the synthetic sensitive data (with positive examples) as input and classify whether the synthetic sensitive data are real sensitive data, such as an employee’s name, and accordingly assign a loss to LSTM network700. In this example, discriminator510may classify that the synthetic sensitive data “Michael Apple Blue” is not a real name and thus assign a high loss to LSTM network700. Based on the assigned loss, LSTM network700may update weights W and/or biases b, for instance, with backpropagation based on decent gradients. For instance, (a new value of weight) = (an old value of the weight) - (learning rate) × (partial gradient of loss with respect to the weight).

FIG.8shows an example bidirectional LSTM network used to implement discriminator510, according to some embodiments. Unlike a unidirectional LSTM network, a bidirectional LSTM network may learn semantics not only from prior context but also posterior context. As shown inFIG.8, bidirectional LSTM network800may include 1stcell805, 2ndcell810and 3rdcell815. Cells805,810and815may be implemented substantially similar to cells705,710and715ofFIG.7. Operations of bidirectional LSTM network800may include a forward pass and a backward pass. The forward pass may be substantially similar to operations of LSTM network700, as described above with regards toFIG.7. For instance, 1stcell805may calculate hidden state

and memory state

based on xt,

and pass

to 2ndcell810; 2ndcell810may then take

and xt+1as input to calculate hidden state

and memory state

and pass

to 3rdcell815; and 3rdcell815may next calculate hidden state

and memory state

based on xt+2,

for instance, according to equations (1) - (5). As described above, this forward pass may allow bidirectional LSTM network800to learn semantics from prior context by passing hidden states hFfrom 1stcell805→ 2ndcell810→ 3rdcell815. Besides the forward pass, LSTM network800may also include a backward pass, as shown inFIG.8. The backward pass may be viewed as a copy of the forward pass but in a reverse sequence. For instance, 3rdcell815may calculate hidden state ht+2Band memory state

based on xt+2,

and pass

to 2ndcell810; 2ndcell810may then take

and xt+1as input to calculate hidden state

and memory state

and pass

to 1stcell805; and 1stcell805may next calculate hidden state

and memory state

based on xt,

Because hidden states hBare passed in the reverse sequence from 3rdcell815→ 2ndcell810→ 1stcell805, the backward pass of bidirectional LSTM network800may allow bidirectional LSTM network800to learn semantics from posterior context, as well. In short, bidirectional LSTM network800may learn words from what it sees at the present instant, prior history and posterior context. Once hidden states h are calculated in both directions, the two sequences of hidden states hFand hBmay then be used together to produce output of the bidirectional LSTM network.

According to some embodiments, bidirectional LSTM network800may also include a convolutional operation and a highway gated operation on top of the above described LSTM operations in forward and backward passes. For instance, for each element of the sequence of input x, e.g., xi, its embedding e(xi) may be concatenated with the left context cxtl(xi) and right context cxtr(xi) to form a context-dependent representation x̃i= [cxtl(xi), e(xi), cxtr(xi)]. The left context cxtl(xi) may be a vector which is recursively computed by adding (1) the previous left context cxtl(xi-l) multiplied by a weight matrix Wland (2) the embedding of the current left element e(xi-1) multiplied by a left “semantic” weight matrix Wsl, for instance, according to equation (7). Similarly, the right context cxtr(xi) may be a vector which is recursively computed by adding (1) the previous right context cxtr(xi+1) multiplied by a weight matrix Wrand (2) the embedding of the current right element e(xi+1) multiplied by a right “semantic” weight matrix Wsr, for instance, according to equation (8).

The context-dependent representation x̃ may be reduced to a lower dimensional space and max-pooled to produce semantic word-context features, for instance, according to equations (9) - (11). The extracted features xi2may be provided to bidirectional LSTM800to replace original input x to generate output y.

where:tanh(): hyperbolic tangent function;maxpool (): Maxpooling function;W1: a diagonal weight matrix;b1: a bias vector; andn: the number of words in the sequence of input characters x, e.g., n = 3.Bidirectional LSTM network800may also use a highway-gated operation to achieve faster and better convergence of LSTM. For instance, bidirectional LSTM network800may use a transform gate Tto calculate output y according to equations (12) - (13):

where:T: transform gate. When T = 1, y = H(x2, WH); when T = 0, y = x2meaning that input x2is passed directly to y as an information “highway”;H: affine transform of bidirectional LSTM with memory cells described in equations (1) - (6);WT: a diagonal weight matrix;bT: a bias vector; andσ. a logistic sigmoid function, e.g., a sigmoid or hyperbolic tangent function.A final output layer may provide a classification probability as a loss. Referring back toFIG.5, bidirectional LSTM network800(as used to implement discriminator510) may use a cross-entropy as the loss function, for instance, according to equations (14) - (15). Bidirectional LSTM network800may update its parameters, such as weights and biases, with backpropagation based on descent gradients of the cross-entropy loss function.

where:Wo: a diagonal weight matrix;bo: a bias vector;σ. a logistic sigmoid function, e.g., a sigmoid or hyperbolic tangent function;ŷfinal: a wrongly assumed probability corresponding to yfinal;L (yfinal, ŷfinal): a cross-entropy; andlogo: a logarithm function.

According to some embodiments, sensitive data detection system145may implement data store classifier175with a supervised artificial neural network (ANN), as shown inFIG.9. As shown inFIG.9, ANN900(as used to implement data store classifier175) may include input layer905, hidden layer(s)910and output layer915. Layers905,910and915may each comprise one or more neurons920,925and930. neurons920of input layer905may receive input, such as data simulating extracted features provided by feature engineering module170. neurons920of input layer905may provide the input to neurons of hidden layer(s)910through connections935. Each connection935may be associated with a weight. neurons925of hidden layer910may calculate an intermediate output based on respective activation functions. For instance, if 1stneuron925of 1sthidden layer910receives input x having four elements, [x1,x2,x3,x4], from neurons920of input layer905. 1stneuron925may produce an intermediate output z1based on the activation function of 1stneuron925. For instance, z1= tanh (w11×x1+ w12×x2+ w13×x3+ w14×x4+ b1), where w11, w12, w13, and w14each correspond to a weight associated with one connection935between one neuron920of input layer905and 1stneuron925of 1sthidden layer910, b1represents a bias to 1stneuron925of 1stneuron910, and tanh() refers to a hyperbolic tangent function. This activation operation may repeat on each neuron925of 1sthidden layer910with respective weights and biases. The set of intermediate output z1may then be passed from 1sthidden layer910to a next hidden layer910through inter-hidden-layer connections940and taken as input by neurons of the next hidden layer910to calculate a next set of intermediate output z2. The operations may repeat until the last hidden layer910may pass the last set of intermediate output znto output layer915(through connections945) which may then calculate output y. For purposes of illustration, output layer915may include one single neuron930because data store classifier175may provide only one single value - a confidence score indicating a probability for the data store to be classified as a sensitive data store. In training, input layer905may take a training set to calculate y. Output layer915may receive a desired output associated with the training set to calculate a loss. For instance, when y matches the desired output, output layer915may assign a low loss; while when y does not match the desired output, output layer915may assign a high loss. ANN900may then update parameters, for instance, weights and/or biases associated with the above connections and activation functions, based on the loss and descent gradients. Once trained, ANN900may be deployed to classify a data store, for instance, based on extracted features provided by feature engineering module170ofFIG.1. The extracted feature may comprise information representing identification of named entity types as well as associated context. For example, the extracted features may include a percentage of records from a record set or cluster which have a given entity type, a mean number of labels of a given type from a given field of records in a record set or cluster, approximation of heat maps used to statistically test if a given sample comes from a given distribution characterizing a named entity, etc. Based on the extracted features, ANN900(as used to implement data store classifier175) may detect whether a data store contains sensitive data with an assigned confidence score.

FIG.10is a block diagram showing providing sensitive data detection as a provider network service, according to some embodiments. InFIG.10, provider network1000may be a private or closed system or may be set up by an entity such as a company or a public sector organization to provide one or more services (such as various types of cloud-based storage) accessible via the Internet and/or other networks to one or more client(s)1000. Provider network1000may be implemented in a single location or may include numerous data centers hosting various resource pools, such as collections of physical and/or virtualized computer servers, storage devices, networking equipment and the like (e.g., computing system1100described below with regard toFIG.11), needed to implement and distribute the infrastructure and storage services offered by provider network1000. In some embodiments, provider network1000may implement various computing resources or services, such as a data storage service(s)1010(e.g., object storage services, block-based storage services, or data warehouse storage services), sensitive data detection service1015, as well as other service(s)1020, which may include a virtual compute service, data processing service(s) (e.g., map reduce, data flow, and/or other large scale data processing techniques), and/or any other type of network based services (which may include various other types of storage, processing, analysis, communication, event handling, visualization, and security services not illustrated).

Data storage service(s)1010may implement different types of data stores for storing, accessing, and managing data on behalf of client(s)1005as a network-based service that enables one or more client(s)1005to operate a data storage system in a cloud or network computing environment. For example, data storage service(s)1010may include various types of database storage services (both relational and non-relational) or data warehouses for storing, querying, and updating data. Such services may be enterprise-class database systems that are scalable and extensible. Queries may be directed to a database or data warehouse in data storage service(s)1010that is distributed across multiple physical resources, and the database system may be scaled up or down on an as needed basis. The database system may work effectively with database schemas of various types and/or organizations, in different embodiments. In some embodiments, clients/subscribers may submit queries in a number of ways, e.g., interactively via an SQL interface to the database system. In other embodiments, external applications and programs may submit queries using Open Database Connectivity (ODBC) and/or Java Database Connectivity (JDBC) driver interfaces to the database system.

Data storage service(s)1010may also include various kinds of object or file data stores for putting, updating, and getting data objects or files, which may include data files of unknown file type. Such data storage service(s)1010may be accessed via programmatic interfaces (e.g., APIs) or graphical user interfaces. Data storage service(s)1010may provide virtual block-based storage for maintaining data as part of data volumes that can be mounted or accessed similar to local block-based storage devices (e.g., hard disk drives, solid state drives, etc.) and may be accessed utilizing block-based data storage protocols or interfaces, such as internet small computer interface (iSCSI).

In some embodiments, sensitive data detection service1015may inspect datasets per requests of client(s)1005. For instance, client(s)1005may send a request to provider network1000for sensitive data detection service1015of a dataset uploaded by client(s)1005. client(s)1005may upload the dataset to provider network1000which may store the dataset on one or more storage resources using data storage service(s)1010. Sensitive data detection service1015may launch appropriate computing resources to load a sensitive data detection system from a model repository (to create an instance of the corresponding model), as described above with regards toFIG.4. The sensitive data detection system may access and inspect the client’s uploaded dataset for sensitive data. The sensitive data detection may be performed following the processes described above inFIGS.1-9. Based on the detection, the sensitive data detection system may publish a sensitive data summary and optional recommendations of privacy policy to client(s)1005. After the dataset inspection is finished, sensitive data detection service1015may terminate the PII data detection system and release associated computing resources.

Other service(s)1020may include various types of data processing services to perform different functions (e.g., anomaly detection, machine learning, querying, or any other type of data processing operation). For example, in at least some embodiments, data processing services may include a map reduce service that creates clusters of processing nodes that implement map reduce functionality over data stored in one of data storage service(s)1010. Various other distributed processing architectures and techniques may be implemented by data processing services (e.g., grid computing, sharding, distributed hashing, etc.). Note that in some embodiments, data processing operations may be implemented as part of data storage service(s)1010(e.g., query engines processing requests for specified data).

Generally speaking, client(s)1005may encompass any type of client configurable to submit network-based requests to provider network1000via network1025, including requests for storage services (e.g., a request to create, read, write, obtain, or modify data in data storage service(s)1010, a request to perform on-demand PII detection at PII data detection service(s)1015, etc.). For example, a given client1005may include a suitable version of a web browser, or may include a plug-in module or other type of code module configured to execute as an extension to or within an execution environment provided by a web browser. Alternatively, a client1005may encompass an application such as a database application (or user interface thereof), a media application, an office application or any other application that may make use of storage resources in data storage service(s)1010to store and/or access the data to implement various applications. In some embodiments, such an application may include sufficient protocol support (e.g., for a suitable version of Hypertext Transfer Protocol (HTTP)) for generating and processing network-based services requests without necessarily implementing full browser support for all types of network-based data. That is, client1005may be an application configured to interact directly with provider network1000. In some embodiments, client(s)1005may be configured to generate network-based services requests according to a Representational State Transfer (REST)-style network-based services architecture, a document- or message-based network-based services architecture, or another suitable network-based services architecture.

In various embodiments, network1025may encompass any suitable combination of networking hardware and protocols necessary to establish network-based-based communications between client(s)1005and provider network1000. For example, network1025may generally encompass the various telecommunications networks and service providers that collectively implement the Internet. Network1025may also include private networks such as local area networks (LANs) or wide area networks (WANs) as well as public or private wireless networks. For example, both a given client1005and provider network1000may be respectively provisioned within enterprises having their own internal networks. In such an embodiment, network1025may include the hardware (e.g., modems, routers, switches, load balancers, proxy servers, etc.) and software (e.g., protocol stacks, accounting software, firewall/security software, etc.) necessary to establish a networking link between given client1005and the Internet as well as between the Internet and provider network1000. It is noted that in some embodiments, client(s)1005may communicate with provider network1000using a private network rather than the public Internet.

Sensitive data detection system145, including topology inference module150, record sampling module155, entity type identifier160, structural clustering module165, feature engineering module170and data store classifier175described herein, may in various embodiments be implemented by any combination of hardware and software. For example, in one embodiment, sensitive data detection system145may be implemented by a computer system, for instance, a computer system as inFIG.11that includes one or more processors executing program instructions stored on a computer-readable storage medium coupled to the processors. In the illustrated embodiment, computer system1100includes one or more processors1110coupled to a system memory1120via an input/output (I/O) interface1130. Computer system1100further includes a network interface1140coupled to I/O interface1170. WhileFIG.11shows computer system1100as a single computing device, in various embodiments a computer system1100may include one computing device or any number of computing devices configured to work together as a single computer system1100.

In various embodiments, computer system1100may be a uniprocessor system including one processor1110, or a multiprocessor system including several processors1110(e.g., two, four, eight, or another suitable number). Processors1110may be any suitable processors capable of executing instructions. For example, in various embodiments, processors1605may be general-purpose or embedded processors implementing any of a variety of instruction set architectures (ISAs), such as the x86, PowerPC, SPARC, or MIPS ISAs, or any other suitable ISA. In multiprocessor systems, each of processors1605may commonly, but not necessarily, implement the same ISA.

System memory1120may be one embodiment of a computer-accessible medium configured to store instructions and data accessible by processor(s)1110. In various embodiments, system memory1120may be implemented using any non-transitory storage media or memory media, such as magnetic or optical media, e.g., disk or DVD/CD coupled to computer system1100via I/O interface1130. A non-transitory computer-accessible storage medium may also include any volatile or non-volatile media such as RAM (e.g. SDRAM, DDR SDRAM, RDRAM, SRAM, etc.), ROM, etc., that may be included in some embodiments of computer system1100as system memory1120or another type of memory. Further, a computer-accessible medium may include transmission media or signals such as electrical, electromagnetic, or digital signals, conveyed via a communication medium such as a network and/or a wireless link, such as may be implemented via network interface1140. In the illustrated embodiment, program instructions (e.g., code) and data implementing one or more desired functions, such as sensitive data detection described above inFIGS.1-10, are shown stored within system memory1130as code1126and data1127.

In one embodiment, I/O interface1130may be configured to coordinate I/O traffic between processor1110, system memory1120, and any peripheral devices in the device, including network interface1140or other peripheral interfaces. In some embodiments, I/O interface1130may perform any necessary protocol, timing or other data transformations to convert data signals from one component (e.g., system memory1120) into a format suitable for use by another component (e.g., processor1110). In some embodiments, I/O interface1130may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard, for example. In some embodiments, the function of I/O interface1130may be split into two or more separate components, such as a north bridge and a south bridge, for example. Also, in some embodiments some or all of the functionality of I/O interface1130, such as an interface to system memory1120, may be incorporated directly into processor1110.

Network interface1140may be configured to allow data to be exchanged between computer system1100and other devices1160attached to a network or networks1170, such as data store catalog305, sensitive data definitions registry315, privacy compliance rules registry320, and/or other computer systems or devices as illustrated inFIGS.3-4, for example. In various embodiments, network interface1140may support communication via any suitable wired or wireless general data networks, such as types of Ethernet network, for example. Additionally, network interface1140may support communication via telecommunications/telephony networks such as analog voice networks or digital fiber communications networks, via storage area networks such as Fiber Channel SANs, or via any other suitable type of network and/or protocol.

The various systems and methods as illustrated in the figures and described herein represent example embodiments of methods. The systems and methods may be implemented manually, in software, in hardware, or in a combination thereof. The order of any method may be changed, and various elements may be added, reordered, combined, omitted, modified, etc.

Although the embodiments above have been described in considerable detail, numerous variations and modifications may be made as would become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to embrace all such modifications and changes and, accordingly.