Patent Description:
<CIT> discloses a data classification method and apparatus for labelling unknown objects. The disclosed data classification system employs a learning algorithm that adapts through experience. The system classifies objects in domain datasets using data classification models having a corresponding bias and evaluates the performance of the data classification. The performance values for each domain dataset and corresponding model bias are processed to initially identify (and over time modify) one or more rules of experience. The rules of experience are then subsequently used to generate a model for data classification. Each rule of experience specifies one or more characteristics for a domain dataset and a corresponding bias that should be utilized for a data classification model if the rule is satisfied.

<NPL>, discloses two novel document-centered approaches that are capable of making tag recommendations in real scenarios. The first, graph-based, method represents the tagged data in two bipartite graphs, (document, tag) and (document, word), then finds document topics by leveraging graph partitioning algorithms. The second, prototype-based, method aims at finding the most representative documents within the data collections and advocates a sparse multiclass Gaussian process classifier for efficient document classification.

<NPL>, mentions recommendations about automatically updating SharePoint Content Types based on the presence of corporate defined metadata that has been automatically tagged to digital assets contained in SharePoint.

<NPL>, mentions a software which can scrape drives and tag files that contain sensitive information: automatically tag files using smart rules based on extendable regular expressions. Tag files with one click via the Explorer Context menu. Enable the team to see what files are confidential (or not) in Windows Explorer at a glance.

It is the object of the present invention to provide an improved method for data classification using data flow analysis.

Described herein is a system utilizing data flow analysis to perform data classification, comprising: a processing system comprising a processor and a memory having computer-executable instructions stored thereupon which, when executed by the processor, cause the processing system to: receive a source dataset storing data in one or more fields, at least one of the fields having one or more tags, each tag having an associated confidence; generate a derived dataset by performing an action on the source dataset; for each of the one or more fields having at least one tag: calculate a flow confidence for the particular field using an adaptive algorithm in accordance with the action performed and the generated derived dataset; for each tag associated with the particular field, calculate an associated derived confidence for the particular tag in accordance with the associated confidence and the flow confidence; for each tag associated with the particular field: when the associated derived confidence is greater than or equal to a first threshold, copying the particular tag to the derived dataset; when the associated derived confidence is less than the first threshold and greater than the second threshold: identify an action to be taken with respect to the particular tag for the derived dataset; receive a response to the action to be taken with respect to the particular tag for the derived dataset; and modify the adaptive algorithm in accordance with the received response.

Various technologies pertaining to performing data classification using data flow analysis are now described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing one or more aspects. Further, it is to be understood that functionality that is described as being carried out by certain system components may be performed by multiple components. Similarly, for instance, a component may be configured to perform functionality that is described as being carried out by multiple components.

The subject disclosure supports various products and processes that perform, or are configured to perform, various actions regarding performing data classification using data flow analysis. What follows are one or more exemplary systems and methods.

Aspects of the subject disclosure pertain to the technical problem of classifying data upon which data processing operation(s) have been performed. The technical features associated with addressing this problem involve receiving a source dataset storing data in field(s), at least one of the fields having tag(s), each tag having an associated confidence. A derived dataset is generated by performing action(s) on the source dataset. For each of the field(s) having at least one tag: calculating a flow confidence for the particular field using an adaptive algorithm in accordance with the action performed and the generated derived dataset; for each tag associated with the particular field, calculating an associated derived confidence for the particular tag in accordance with the associated confidence and the flow confidence; for each tag associated with the particular field: when the associated derived confidence is greater than or equal to a first threshold, copying the particular tag to the derived dataset; when the associated derived confidence is less than or equal to a second threshold, not copying the particular tag to the derived dataset; when the associated derived confidence is less than the first threshold and greater than the second threshold: identifying an action to be taken with respect to the particular tag for the derived dataset; receiving a response to the action to be taken with respect to the particular tag for the derived dataset (e.g., reviewed by a human reviewer); and modifying the adaptive algorithm in accordance with the received response. Accordingly, aspects of these technical features exhibit technical effects of reducing time spent by a human reviewer in order to classify data, reducing compliance costs associated with requirement(s), and/or reducing the likelihood of failing to comply with the requirement(s).

As used herein, the terms "component" and "system," as well as various forms thereof (e.g., components, systems, sub-systems, etc.) are intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to being, a process running on a processor, a processor, an object, an instance, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a computer and the computer can be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers. Further, as used herein, the term "exemplary" is intended to mean serving as an illustration or example of something, and is not intended to indicate a preference.

Compliance with governmental regulation(s) and/or business requirement(s) regarding storage and/or use of data can be difficult for entities such as corporations, governments, etc. In order to comply with these regulation(s) and/or requirement(s), all or portion(s) of data can be classified using one or more schemas. For example, data can be classified as being European Union General Data Protection Regulation (GDPR) sensitive or not.

Newly created resource(s) such as table(s), file(s), etc. are generally required to be classified and tagged. Classification and tagging can be needed even when the newly created resource(s) are derived from other resource(s) which have been classified and tagged. Performing processing operation(s) on data further complicates compliance with these regulation(s) and/or requirement(s). In some embodiments, processing operation(s) can result in some or all classification(s) flowing from a source dataset to a dataset derived from the source dataset. For example, copying a portion (e.g., column) from the source dataset can result in copying classification(s) associated with the field. However, in some embodiments, processing operation(s) can result in some or no classification(s) appropriately flowing from the source dataset to the derived dataset. For example, performing a hash operation on a field (e.g., column) from the source dataset can under certain circumstances (e.g., based upon the regulation(s) and/or requirement(s)) result in classification(s) associated with the field not flowing to the derived dataset (e.g., GDPR sensitive information removed by processing operation).

Described herein is a system and method for using data flow analysis to perform data classification. As noted, a significant portion of data (e.g., derived dataset) can be a result of transformation of other data (e.g., source dataset(s)), which have already classified. In some embodiments, when lineage of data is known with a high degree of confidence, it can be utilized by an adaptive algorithm to determine the classification of derived data from classification of source data automatically (e.g., without involving human labor). However, due to compliance requirement(s), regulation(s) and/or associated risk(s), in some embodiments, when the confidence calculated by the adaptive algorithm is not greater than or equal to a first threshold or less than or equal to a second threshold, the adaptive algorithm can identify action(s) (e.g., human input) to be taken to confirm or reject automatically generated classification(s). Response(s) to the action(s) can be utilized to modify the adaptive algorithm.

Referring to <FIG>, a system utilizing data flow analysis to perform data classification <NUM> is illustrated. The system <NUM> can classify data upon which data processing operation(s) have been performed by calculating a flow confidence for field(s) using an adaptive algorithm. Tag(s) associated with the field(s) can be copied, not copied and/or an action identified to be taken with respect to particular tag(s). In some embodiments, each tag can have an associated confidence (e.g., numerical value in the range of zero (no confidence) to one (complete confidence)). The adaptive algorithm can be modified in accordance with a response received with respect to the identified action to be taken. Tag(s) can be utilized to search and identify data corresponding to particular tag(s) and/or particular record(s) within tagged dataset(s).

The system <NUM> includes a data classification component <NUM> that receives information regarding a source dataset <NUM> and information regarding a derived dataset <NUM>. The derived dataset <NUM> is generated from the source dataset <NUM> using processing operation(s) <NUM>. In some embodiments, a single source dataset <NUM> is employed to generated the derived dataset <NUM>. In some embodiments, the derived dataset <NUM> can be generated based upon all or portions of a plurality of source datasets <NUM>.

In some embodiments, the data classification component <NUM> can receive information regarding the processing operation(s) <NUM>. In some embodiments, the information can comprise flow hint(s) which describe action(s) taken by the processing operation(s) <NUM> with respect to the source dataset <NUM>. For example, the processing operation(s) <NUM> can include one or more database operation(s) (e.g., SQL operations such as select, join, insert, delete), arithmetic operation(s), logical operation(s) and/or bitwise operation(s).

The source dataset <NUM> and the derived dataset <NUM> store a collection of data. In some embodiments, the source dataset <NUM> and/or the derived dataset <NUM> comprise a relational database comprising one or more tables (e.g., relation(s)) of column(s) (e.g., attribute(s), field(s)) and row(s) (e.g., record(s)). Relationship(s) can logically connect tables to one another. In some embodiments, the source dataset <NUM> and/or the derived dataset <NUM> comprise object-oriented data structures, hierarchical data structures, and/or network data structures that store data according to schema(s).

In some embodiments, the source dataset <NUM> and the derived dataset <NUM> are based upon a common relational database and/or schema. In some embodiments, the source dataset <NUM> and the derived dataset <NUM> are based upon different relational databases and/or schema.

The information regarding the source dataset <NUM> received by the data classification component <NUM> can include organizational information, for example, name(s) of column(s) and/or name(s) within the schema. The information can further include tag(s) associated with portion(s) of the organizational information. "Tag" refers to relevant classification(s) associated with portion(s) of a particular dataset (e.g., column(s), table(s), and/or the dataset itself). In some embodiments, tag(s) are stored within the source dataset <NUM> and/or the derived dataset <NUM>. In some embodiments, tag(s) are stored separately from the source dataset <NUM> and/or the derived dataset <NUM> (e.g., in a database and/or file).

In some embodiments, the information regarding the source dataset <NUM> comprises organizational information (e.g., column name) and tag(s) (e.g., classification(s)). In some embodiments, the information regarding the source dataset <NUM> comprises hierarchically and/or complexly structured data.

In some embodiments, tag(s) are applied to the source dataset <NUM> and/or the derived dataset <NUM> at one or more levels of granularity. For example, tag(s) can apply to the entire source dataset <NUM> and/or the entire derived dataset <NUM> and/or tag(s) can apply to specific portion(s) (e.g., column(s) and/or field(s)) of the source dataset <NUM> and/or the derived dataset <NUM>.

In some embodiments, a tag comprises metadata including information based on a classification schema (e.g., personally sensitive information, highly sensitive information, no personally sensitive information). In some embodiments, a tag comprises a plurality of properties describing the tag and/or data associated with the tag, for example, a confidence level, how the tag was generated, a date and/or time of tag creation, a source of the generated tag, and/or a source of the associated data (e.g., search history).

In some embodiments, tag(s) are manually associated with the source dataset <NUM> based upon user input. For example, a user can review newly created resource(s), such as an additional column added to a table, and determined which classification(s), if any, apply to the newly created resource(s). The user can then apply tag(s) as appropriate to the newly created resource(s).

In some embodiments, tag(s) are automatically associated with the source dataset <NUM>, for example, by a classifier. In some embodiments, an automated system can classify and/or tag the newly created resource(s) based on rule(s). However, these automated systems have conventionally not been generally successful in reliably classifying/tagging particular categories of data, for example, speech data. Unlike, an email address and/or a phone number, which can have known pattern(s), speech data can appear like an arbitrary sequence of bytes, thus making automated classification difficult.

In some embodiments, the data classification component <NUM> can perform a data flow analysis for each data processing operation in order to analyze whether output data (e.g., derived dataset <NUM>) is derived directly or indirectly from data that was previously classified (e.g., source dataset <NUM>). For example, a comparison can be made between at least a portion of the derived dataset <NUM> and at least a portion of the source dataset <NUM> in order to infer action(s) performed by the processing operation(s) <NUM>. In instances in which the data classification component <NUM> determined that output data is derived directly or indirectly, the data classification component <NUM> can flow classification(s) from the source dataset <NUM> by calculating derived confidence for each tag (e.g., classification confidence) based on a flow confidence. In some embodiments, flow confidence is a numerical value in the range of zero (no confidence) to one (complete confidence). In some embodiments, tag(s) (e.g., classification(s)) that meet certain confidence threshold criteria are applied automatically. In some embodiments, human(s) are asked to confirm other classifications via "approval flow".

In some embodiments, the data classification component <NUM> can utilize an adaptive algorithm to calculate a flow confidence in accordance with the action performed and the generated derived dataset <NUM>. In some embodiments, the adaptive algorithm can be trained using a machine learning process that utilizes various features present in datasets with the adaptive algorithm representing an association among the features. In some embodiments, the adaptive algorithm is trained using one or more machine learning algorithms including linear regression algorithms, logistic regression algorithms, decision tree algorithms, support vector machine (SVM) algorithms, Naive Bayes algorithms, a K-nearest neighbors (KNN) algorithm, a K-means algorithm, a random forest algorithm, dimensionality reduction algorithms, Artificial Neural Network (ANN), and/or a Gradient Boost & Adaboost algorithm. The adaptive algorithm can be trained in a supervised, semi-supervised and/or unsupervised manner.

In some embodiments, the data classification component <NUM> can, for each of the field(s) of the source dataset having at least one tag, calculate a flow confidence for the particular field using an adaptive algorithm in accordance with the action performed and the generated derived dataset. For each tag associated with the particular field, an associated derived confidence for the particular tag can be calculated in accordance with the associated confidence and the flow confidence.

For each tag associated with the particular field, when the associated derived confidence is greater than or equal to a first threshold, copying the particular tag to the derived dataset. When the associated derived confidence is less than or equal to a second threshold, the particular tag is not copied to the derived dataset.

When the associated derived confidence is less than the first threshold and greater than the second threshold, an action to be taken with respect to the particular tag for the derived dataset can be identified. In some embodiments, the action to be taken is for a human reviewer to determine whether or not the particular tag should flow to the derived dataset <NUM> (e.g., providing the particular tag to the human reviewer). In some embodiments, the action to be taken is for an automatic process to review at least a portion of the data in the derived dataset <NUM> to determine whether or not the particular tag should flow to the derived dataset <NUM>.

A response to the action to be taken with respect to the particular tag for the derived dataset can be received (e.g., reviewed by a human reviewer and/or automatic process). In some embodiments, the adaptive algorithm can be modified in accordance with the received response. In this manner, the adaptive algorithm can be adjusted to better calculate flow confidence resulting in action (e.g., human review and/or automatic process) being taken in fewer instances.

Thus, while in some embodiments, human labor may still be required to confirm or reject automatic classification when the calculated associated derived confidence is not high enough for the system <NUM> to apply the classification. However, in some embodiments, human labor can be significantly reduced, as only a small number of cases requires human labor, and even in these cases rather than requiring a human to classify, the proposed classification(s) can simply be confirmed or rejected.

In some embodiments, the data classification component <NUM> can modify the first threshold (e.g., value) and/or the second threshold (e.g., value) in accordance with the received response. Accordingly, the data classification component <NUM> can be adapted to more effectively analyze data flow in order to perform data classification. In some embodiments, the first threshold (e.g., value) and/or the second threshold (e.g., value) is a function of a compliance requirement and an associate risk (e.g., a cost/benefit based analysis).

In some embodiments, when classifications flow from a source dataset <NUM> to a derived dataset <NUM>, conflicting tags may be applied to the derived dataset <NUM>. In some instances, this can result in set(s) of classification(s) that don't make sense together. These cases can be handled by an optional set of rules <NUM> (e.g., hierarchical, customizable) that can be applied by the data classification component <NUM>. In this manner, the data classification component <NUM> can determine resulting tag(s) by applying the set of rules <NUM>. In some embodiments, property(ies) of the tag can be utilized by the data classification component <NUM> when applying the set of rules <NUM> to conflicting tags. In some embodiments, the data classification component <NUM> can identify an action to take with respect to the conflicting tags (e.g., human interaction), for example, based upon the set of rules <NUM>.

In some embodiments, tag(s) can be applied to field(s) based upon pre-defined template(s). For example, a source dataset <NUM> can be based upon periodically generated data (e.g., hourly, daily, weekly) with the content changing, but the structure and corresponding tag(s) being static. Property(ies) associated with the tag(s) can reflect that the tag(s) were applied based upon pre-defined template(s). This information can be utilized when resolving conflicting tags. For example, more specifically applied tag(s) (e.g., applied by a human reviewer) can take precedent over more generally applied tag(s) (e.g., tag(s) based upon the pre-defined template(s)).

Turning to <FIG>, a data classification component <NUM> is illustrated. The data classification component <NUM> includes a flow confidence component <NUM> and a tag component <NUM>.

As discussed previously with respect to <FIG>, the data classification component <NUM> receives information regarding a source dataset <NUM> and information regarding a derived dataset <NUM>. The derived dataset <NUM> is generated from the source dataset <NUM> using processing operation(s) <NUM>. In some embodiments, the data classification component <NUM> can receive information regarding the processing operation(s) <NUM>. The source dataset <NUM> can store data in field(s), with at least one of the fields have tag(s), each tag having an associated confidence.

The flow confidence component <NUM> can, for each of the field(s) having at least one tag, calculate a flow confidence for the particular field using an adaptive algorithm in accordance with the action performed and the generated derived dataset.

The tag component <NUM> can, for each of the field(s) having at least one tag: for each tag associated with the particular field, calculate an associated derived confidence for the particular tag in accordance with the associated confidence and the flow confidence. For each tag associated with the particular field: when the associated derived confidence is greater than or equal to a first threshold, the particular tag can be copied to the derived dataset. When the associated derived confidence is less than or equal to a second threshold, the particular tag is not copied to the derived dataset. When the associated derived confidence is less than the first threshold and greater than the second threshold: an action can be identified to be taken with respect to the particular tag for the derived dataset.

The data classification component <NUM> can receive a response to the action to be taken with respect to the particular tag for the derived dataset. In some embodiments, the data classification component <NUM> can further modify the adaptive algorithm of the flow confidence component <NUM> in accordance with the received response. In some embodiments, the data classification component <NUM> can modify a value of the first threshold and/or a value of the second threshold in accordance with the received response. Accordingly, the data classification component <NUM> can be adapted to more effectively analyze data flow in order to perform data classification.

<FIG> illustrate exemplary methodologies relating to utilizing data flow analysis to perform data classification. While the methodologies are shown and described as being a series of acts that are performed in a sequence, it is to be understood and appreciated that the methodologies are not limited by the order of the sequence. For example, some acts can occur in a different order than what is described herein. In addition, an act can occur concurrently with another act. Further, in some instances, not all acts may be required to implement a methodology described herein.

Moreover, the acts described herein may be computer-executable instructions that can be implemented by one or more processors and/or stored on a computer-readable medium or media. The computer-executable instructions can include a routine, a sub-routine, programs, a thread of execution, and/or the like. Still further, results of acts of the methodologies can be stored in a computer-readable medium, displayed on a display device, and/or the like.

Referring to <FIG> and <FIG>, a method of utilizing data flow analysis to perform data classification <NUM> is illustrated. In some embodiments, the method <NUM> is performed by the system <NUM>.

At <NUM>, a source dataset is received with the source dataset storing data in one or more fields. At least one of the fields has one or more tags with each tag having an associated confidence.

At <NUM>, a derived dataset is generated by performing an action on the source dataset. At <NUM>, a flow confidence is calculated for a particular field using an adaptive algorithm in accordance with the action performed and the generated derived data set. At <NUM>, an associated derived confidence is calculated for a particular tag in accordance with the associated confidence and the flow confidence.

At <NUM>, a determination is made as to whether the associated derived confidence is greater than or equal to a first threshold. If the determination at <NUM> is YES, at <NUM>, the particular tag is copied to the derived dataset and processing continues at <NUM>. If the determination at <NUM> is NO, at <NUM>, a determination is made as to whether the associated derived confidence is less than or equal to a second threshold. If the determination at <NUM> is YES, at <NUM>, the particular tag is not copied to the derived dataset and processing continues at <NUM>.

If the determination at <NUM> is NO, at <NUM>, an action to be taken with respect to the particular tag for the derived dataset is identified. At <NUM>, a response to the action to be taken with respect to the particular tag for the derived dataset is received. At <NUM>, the adaptive algorithm is modified in accordance with the response.

At <NUM>, a determination is made as to whether there are more tags associated with the particular field. If the determination at <NUM> is YES, processing continues at <NUM>. If the determination at <NUM> is NO, at <NUM>, a determination is made as to whether there are more fields having at least one tag. If the determination at <NUM> is YES, processing continues at <NUM>. If the determination at <NUM> is NO, no further processing occurs.

Turning to <FIG> and <FIG>, a method of utilizing data flow analysis to perform data classification <NUM> is illustrated. In some embodiments, the method <NUM> is performed by the system <NUM>.

If the determination at <NUM> is NO, at <NUM>, an action to be taken with respect to the particular tag for the derived dataset is identified. At <NUM>, a response to the action to be taken with respect to the particular tag for the derived dataset is received. At <NUM>, a value of the first threshold and/or a value of the second threshold is modified in accordance with the received response.

The system can include wherein the adaptive algorithm is trained using a machine learning process. The system can further include wherein the adaptive algorithm is trained using at least one of a linear regression algorithm, a logistic regression algorithm, a decision tree algorithm, a support vector machine (SVM) algorithm, a Naive Bayes algorithm, a K-nearest neighbors (KNN) algorithm, a K-means algorithm, a random forest algorithm, a dimensionality reduction algorithm, an Artificial Neural Network (ANN), or a Gradient Boost & Adaboost algorithm. The system can include wherein the action comprises providing the particular tag to a human reviewer.

The system can further include wherein the action to be taken comprises an automatic process to review at least a portion of the data in the derived dataset to determine whether or not the particular tag should flow to the derived dataset. The system can include wherein calculating the flow confidence for the particular field using the adaptive algorithm in accordance with the action performed and the generated derived dataset is further based upon a flow analysis of the derived dataset and the source dataset. The system can further include when the associated derived confidence is less than the first threshold and greater than the second threshold: modifying at least one of a value of the first threshold or a value of the second threshold in accordance with the received response.

The system can include wherein at least one of the first threshold and the second threshold is a function of a compliance requirement and an associated risk. The system can further include performing conflict resolution between conflicting tags of the derived dataset using a set of rules.

Described herein is a method of utilizing data flow analysis to perform data classification, comprising: receiving a source dataset storing data in one or more fields, at least one of the fields having one or more tags, each tag having an associated confidence; generating a derived dataset by performing an action on the source dataset; for each of the one or more fields having at least one tag: calculating a flow confidence for the particular field using an adaptive algorithm in accordance with the action performed and the generated derived dataset; for each tag associated with the particular field, calculating an associated derived confidence for the particular tag in accordance with the associated confidence and the flow confidence; for each tag associated with the particular field: when the associated derived confidence is greater than or equal to a first threshold, copying the particular tag to the derived dataset; when the associated derived confidence is less than the first threshold and greater than the second threshold: identifying an action to be taken with respect to the particular tag for the derived dataset; receiving a response to the action to be taken with respect to the particular tag for the derived dataset; and modifying at least one of a value of the first threshold or a value of the second threshold in accordance with the received response.

The method can include wherein the adaptive algorithm is trained using at least one of a linear regression algorithm, a logistic regression algorithm, a decision tree algorithm, a support vector machine (SVM) algorithm, a Naive Bayes algorithm, a K-nearest neighbors (KNN) algorithm, a K-means algorithm, a random forest algorithm, a dimensionality reduction algorithm, an Artificial Neural Network (ANN), or a Gradient Boost & Adaboost algorithm. The method can further include wherein the action comprises providing the particular tag to a human reviewer.

The method can include wherein the action to be taken comprises an automatic process to review at least a portion of the data in the derived dataset to determine whether or not the particular tag should flow to the derived dataset. The method can further include wherein calculating the flow confidence for the particular field using the adaptive algorithm in accordance with the action performed and the generated derived dataset is further based upon a flow analysis of the derived dataset and the source dataset.

The method can include when the associated derived confidence is less than the first threshold and greater than the second threshold: modifying the adaptive algorithm in accordance with the received response. The method can further include wherein at least one of the first threshold and the second threshold is a function of a compliance requirement and an associated risk. The method can include performing conflict resolution between conflicting tags of the derived dataset using a set of rules.

Described herein is a computer storage media storing computer-readable instructions that when executed cause a computing device to: receive a source dataset storing data in one or more fields, at least one of the fields having one or more tags, each tag having an associated confidence; generate a derived dataset by performing an action on the source dataset; for each of the one or more fields having at least one tag: calculate a flow confidence for the particular field using an adaptive algorithm in accordance with the action performed and the generated derived dataset; for each tag associated with the particular field, calculate an associated derived confidence for the particular tag in accordance with the associated confidence and the flow confidence; for each tag associated with the particular field: when the associated derived confidence is greater than or equal to a first threshold, copying the particular tag to the derived dataset; when the associated derived confidence is less than the first threshold and greater than the second threshold: identify an action to be taken with respect to the particular tag for the derived dataset; receive a response to the action to be taken with respect to the particular tag for the derived dataset; and modify the adaptive algorithm in accordance with the received response.

The computer storage media can include wherein the action to be taken comprises at least one of review by a human reviewer or an automatic process to review at least a portion of the data in the derived dataset to determine whether or not the particular tag should flow to the derived dataset. The computer storage media can further include wherein calculating the flow confidence for the particular field using the adaptive algorithm in accordance with the action performed and the generated derived dataset is further based upon a flow analysis of the derived dataset and the source dataset.

With reference to <FIG>, illustrated is an example processing system, general-purpose computer or computing device <NUM> (e.g., mobile phone, desktop, laptop, tablet, watch, server, hand-held, programmable consumer or industrial electronics, set-top box, game system, compute node, etc.). For instance, the computing device <NUM> may be used in a system utilizing data flow analysis to perform data classification <NUM>.

The computer <NUM> includes one or more processor(s) <NUM>, memory <NUM>, system bus <NUM>, mass storage device(s) <NUM>, and one or more interface components <NUM>. The system bus <NUM> communicatively couples at least the above system constituents. However, it is to be appreciated that in its simplest form the computer <NUM> can include one or more processors <NUM> coupled to memory <NUM> that execute various computer executable actions, instructions, and or components stored in memory <NUM>. The instructions may be, for instance, instructions for implementing functionality described as being carried out by one or more components discussed above or instructions for implementing one or more of the methods described above.

The processor(s) <NUM> can be implemented with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The processor(s) <NUM> may also be implemented as a combination of computing devices, for example a combination of a DSP and a microprocessor, a plurality of microprocessors, multi-core processors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. In one embodiment, the processor(s) <NUM> can be a graphics processor.

The computer <NUM> can include or otherwise interact with a variety of computer-readable media to facilitate control of the computer <NUM> to implement one or more aspects of the claimed subject matter. The computer-readable media can be any available media that can be accessed by the computer <NUM> and includes volatile and nonvolatile media, and removable and non-removable media. Computer-readable media can comprise two distinct and mutually exclusive types, namely computer storage media and communication media.

Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes storage devices such as memory devices (e.g., random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), etc.), magnetic storage devices (e.g., hard disk, floppy disk, cassettes, tape, etc.), optical disks (e.g., compact disk (CD), digital versatile disk (DVD), etc.), and solid state devices (e.g., solid state drive (SSD), flash memory drive (e.g., card, stick, key drive) etc.), or any other like mediums that store, as opposed to transmit or communicate, the desired information accessible by the computer <NUM>. Accordingly, computer storage media excludes modulated data signals as well as that described with respect to communication media.

Communication media embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.

Memory <NUM> and mass storage device(s) <NUM> are examples of computer-readable storage media. Depending on the exact configuration and type of computing device, memory <NUM> may be volatile (e.g., RAM), non-volatile (e.g., ROM, flash memory, etc.) or some combination of the two. By way of example, the basic input/output system (BIOS), including basic routines to transfer information between elements within the computer <NUM>, such as during start-up, can be stored in nonvolatile memory, while volatile memory can act as external cache memory to facilitate processing by the processor(s) <NUM>, among other things.

Mass storage device(s) <NUM> includes removable/non-removable, volatile/non-volatile computer storage media for storage of large amounts of data relative to the memory <NUM>. For example, mass storage device(s) <NUM> includes, but is not limited to, one or more devices such as a magnetic or optical disk drive, floppy disk drive, flash memory, solid-state drive, or memory stick.

Memory <NUM> and mass storage device(s) <NUM> can include, or have stored therein, operating system <NUM>, one or more applications <NUM>, one or more program modules <NUM>, and data <NUM>. The operating system <NUM> acts to control and allocate resources of the computer <NUM>. Applications <NUM> include one or both of system and application software and can exploit management of resources by the operating system <NUM> through program modules <NUM> and data <NUM> stored in memory <NUM> and/or mass storage device (s) <NUM> to perform one or more actions. Accordingly, applications <NUM> can turn a general-purpose computer <NUM> into a specialized machine in accordance with the logic provided thereby.

All or portions of the claimed subject matter can be implemented using standard programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof to control a computer to realize the disclosed functionality. By way of example and not limitation, system <NUM> or portions thereof, can be, or form part, of an application <NUM>, and include one or more modules <NUM> and data <NUM> stored in memory and/or mass storage device(s) <NUM> whose functionality can be realized when executed by one or more processor(s) <NUM>.

In accordance with one particular embodiment, the processor(s) <NUM> can correspond to a system on a chip (SOC) or like architecture including, or in other words integrating, both hardware and software on a single integrated circuit substrate. Here, the processor(s) <NUM> can include one or more processors as well as memory at least similar to processor(s) <NUM> and memory <NUM>, among other things. Conventional processors include a minimal amount of hardware and software and rely extensively on external hardware and software. By contrast, an SOC implementation of processor is more powerful, as it embeds hardware and software therein that enable particular functionality with minimal or no reliance on external hardware and software. For example, the system <NUM> and/or associated functionality can be embedded within hardware in a SOC architecture.

The computer <NUM> also includes one or more interface components <NUM> that are communicatively coupled to the system bus <NUM> and facilitate interaction with the computer <NUM>. By way of example, the interface component <NUM> can be a port (e.g., serial, parallel, PCMCIA, USB, FireWire, etc.) or an interface card (e.g., sound, video, etc.) or the like. In one example implementation, the interface component <NUM> can be embodied as a user input/output interface to enable a user to enter commands and information into the computer <NUM>, for instance by way of one or more gestures or voice input, through one or more input devices (e.g., pointing device such as a mouse, trackball, stylus, touch pad, keyboard, microphone, joystick, game pad, satellite dish, scanner, camera, other computer, etc.). In another example implementation, the interface component <NUM> can be embodied as an output peripheral interface to supply output to displays (e.g., LCD, LED, plasma, etc.), speakers, printers, and/or other computers, among other things. Still further yet, the interface component <NUM> can be embodied as a network interface to enable communication with other computing devices (not shown), such as over a wired or wireless communications link.

Claim 1:
A system (<NUM>) utilizing data flow analysis to perform data classification, comprising:
a processing system comprising a processor (<NUM>) and a memory (<NUM>) having computer-executable instructions stored thereupon which, when executed by the processor, cause the processing system to:
receive (<NUM>) a source dataset (<NUM>) storing data in one or more fields, at least one of the fields having one or more tags, each tag having an associated confidence;
receive information regarding a derived dataset (<NUM>), the derived dataset having been generated by performing actions on the source dataset using one or more processing operations (<NUM>);
perform data flow analysis for each processing operation, wherein a comparison is made between at least a portion of the derived dataset and at least a portion of the source dataset in order to infer the actions performed by the one or more processing operations;
for each of the one or more fields having at least one tag:
calculate (<NUM>) a flow confidence for the particular field using an adaptive algorithm in accordance with the inferred actions performed and the derived dataset;
for each tag associated with the particular field, calculate (<NUM>) an associated derived confidence for the particular tag in accordance with the associated confidence and the flow confidence;
for each tag associated with the particular field:
when the associated derived confidence is greater than or equal to a first threshold, copying (<NUM>) the particular tag to the derived dataset;
when the associated derived confidence is less than the first threshold and greater than the second threshold:
identify (<NUM>) an action to be taken with respect to the particular tag for the derived dataset;
receive (<NUM>) a response to the action to be taken with respect to the particular tag for the derived dataset; and
modify (<NUM>) the adaptive algorithm in accordance with the received response.