Patent ID: 12197603

DETAILED DESCRIPTION

As mentioned above, there are numerous malicious actors in the world that are seeking to get their hands on valid login credentials (e.g., corresponding {username, password} tuples) of users of myriad types of systems, including systems operated by financial-services institutions. These credentials could be those of employees of the financial-services institution, customers of the financial-services institution, contractors of the financial-services institution, and/or the like. Moreover, while the examples that are primarily described herein relate to financial-services institutions, it should be understood that this is by way of example and not limitation, and that individuals as well as any other types of institutions, organizations, groups, and/or the like would benefit from embodiments of the present disclosure.

It can often occur that a given user that is creating or revising a document (e.g., composing an email, revising a word-processor document, etc.) is perhaps less careful than they could be or should be with their login credentials (and/or with those of one or more other users) to a given system. As used herein, “document” is a broad term that includes examples such as plaintext (a.k.a. “clear text”) files, word-processor documents, presentations (e.g., “slide decks”), emails, other types of unstructured data files, and the like. In one example scenario, a user may send another user an email in which the first user provides either their own or the second user's username and password in clear text (e.g., unencrypted) in the email. In another example, a user may type the username and password of one or more accounts into a document, and then store that document on, e.g., a network drive, or the user may attach that document to an email, and so forth.

If a malicious actor obtains a given user's username or password (but not both), that is certainly a problem worth addressing. It is significantly more problematic, however, if a malicious actor obtains both a valid username and valid password of a given user for a given system. Placing both pieces of information together in a given document is, therefore, not a best practice from a security standpoint—a security risk that is amplified by the given document being a plaintext document.

Accordingly, disclosed herein are embodiments of methods and systems for textual-pattern searching for login credentials. As is known in the art, one commonly used type of textual search pattern is known as a “regular expression” (or “regex,” for short). In embodiments of the present disclosure, a textual search pattern is a string of characters that specifies a search pattern that can be used on, for example, a single document, a corpus of documents, and/or the like. In an embodiment, a three-segment structure is implemented within a single textual search pattern: a username segment, a proximity segment, and a password segment. In various different embodiments, a single textual search pattern is formed by concatenating the username segment, the proximity segment, and the password segment in left-to-right order. In at least one embodiment, the username segment and proximity segment are separated by at least one character or term in the textual search pattern. Similarly, in at least one embodiment, the proximity segment and the password segment are separated by at least one character or term in an implemented textual search pattern.

In most of this written description, regular expressions (a.k.a. “regexes”) are the example types of textual search patterns that are described by way of example. In general, however, any suitable type of textual search pattern can be used in implementing embodiments of the present disclosure. Besides regexes, some example types of textual search patterns include basic regular expressions, extended regular expressions, and Perl-compatible regular expressions (PCRLs), the latter of which is further discussed below in connection with various examples. Moreover, various different embodiments use textual search patterns developed using any one or more of the following:a String-Oriented Symbolic Language (SNOBOL) language;the Icon Language;symbolic expressions (i.e., “Ess Expressions”) in Lisp-type languages;finite state machines (FSMs);finite-state intersection grammars;parsing expression grammars (PEGs);the parse mode of the Relative Expression-Based Object Language (REBOL);augmented Backus-Naur form (ABNF); andprobability-based parsing.
It is explicitly noted that the above list is intended to be illustrative but not comprehensive.

The username segment may specify a search pattern that includes what is referred to herein as a “precursor” (or “precursor word,” etc.) that indicates that an actual username may be present in close proximity after the precursor. Such a precursor in this disclosure is referred to at times as a “username precursor” (or “username-precursor word,” etc.). As used in this disclosure, a username-precursor word could include more than one actual word (i.e., it could be a short phrase). For example, “user name” could be a username-precursor word, as could “username,” “user identifier,” “login,” and so forth. The username segment may further look for (i.e., specify in the search pattern) a delimiter—that is referred to herein at times as a “username delimiter”—following the username precursor, and may further look for an actual username following the username delimiter. The username may be referred to herein at times using terms such as “username string,” “username character string,” “username-string segment,” and/or the like. Many different types of delimiters could be specified, one example of which is a colon (:), another example of which is an equals sign (=), and yet another example of which is a particular word such as “is,” “equals,” or the like.

The proximity segment may specify that no more than a certain number of characters be present between the username segment and the password segment. In some embodiments, a proximity parameter equal to or on the order of 150 characters is used. The password segment may have a structure that is similar to that of the username segment. As such, the password segment may specify a sequence of a “password precursor” (or “password-precursor word,” etc.), a delimiter such as those that are discussed above (and referred to herein at times as a “password delimiter”), and an actual password (referred to herein at times using terms such as “password string,” “password character string,” “password-string segment,” and/or the like).

Returning now to using regexes as an example type of textual search pattern to illustrate examples of embodiments of the present disclosure, in various different implementations, a given document that is being examined using a regex in accordance with embodiments of the present disclosure could be a document that is “at rest” or “in motion.” As used herein, a “document at rest” refers generally to a document that is residing in a given storage location at the time that it is being examined. In other words, the document is not—at least at that moment—being transmitted from one location to another. Examples of such storage locations include a folder on a network drive, a folder on a cloud account, and the like. Moreover, as used herein, a “document in motion” is one that is being actually transmitted from one location to another at the time that it is being examined (e.g., at least temporarily held up to be examined). Examples of documents in motion include sent emails, sent-email attachments, documents being sent via an instant messaging application, documents being uploaded to or downloaded from a server, and so forth.

In many examples, the type of analysis that is conducted when examining a given document is quite similar whether the document happens to be at rest or in motion. In some cases, the response to identifying a document that contains at least one text sequence that matches the regular expression may differ depending on whether the document is at rest or in motion. As examples, a matching document at rest may be listed on a report, may have its filename altered in some way (e.g., prepended with a sequence such as “review—”) so that it can be more easily found (for further review) using a search and/or sort function, may have a metadata security property set to a certain value (e.g., password protected), may be encrypted, may have its permissions changed such that it can only be accessed by certain personnel, and/or the like. A matching document in motion may be quarantined, discarded, returned (e.g., “bounced back”) to the sender, and/or the like. Some matching documents in motion could be encrypted before being sent on their way to make them less likely to be compromised. And certainly many other responsive actions could be taken and will occur to those of skill in the art having the benefit of this disclosure.

One embodiment takes the form of a method that is performed by a computer system executing instructions on at least one hardware processor. The method includes obtaining a document, and also includes using a textual-pattern-matching engine to search the document for a portion of the document that matches a contiguous textual search pattern. The contiguous textual search pattern includes a username segment, a proximity segment that is positioned after the username segment, and a password segment that is positioned after the proximity segment. The method also includes taking one or more match-triggered actions in response to finding at least one portion of the document that matches the contiguous textual search pattern.

As described herein, one or more embodiments of the present disclosure take the form of methods that include multiple operations. One or more other embodiments take the form of systems that include at least one hardware processor and that also include one or more non-transitory computer-readable storage media containing instructions that, when executed by the at least one hardware processor, cause the system (e.g., the at least one hardware processor) to perform multiple operations (that in some embodiments do and in other embodiments do not correspond to operations performed in a herein-disclosed method embodiment). Still one or more other embodiments take the form of one or more non-transitory computer-readable storage media (CRM) containing instructions that, when executed by at least one hardware processor, cause the at least one hardware processor to perform multiple operations (that, similarly, in some embodiments do and in other embodiments do not correspond to operations performed in a herein-disclosed method embodiment and/or operations performed by a herein-disclosed system embodiment).

Furthermore, a number of variations and permutations of embodiments are described herein, and it is expressly noted that any variation or permutation that is described in this disclosure can be implemented with respect to any type of embodiment. For example, a variation or permutation that is primarily described in this disclosure in connection with a method embodiment could just as well also or instead be implemented in connection with a system embodiment and/or a CRM embodiment. Furthermore, this flexibility and cross-applicability of embodiments is present in spite of any slightly different language (e.g., processes, methods, methodologies, steps, operations, functions, and/or the like) that may be used in the present disclosure to describe and/or characterize such embodiments and/or any element or elements thereof. Lastly, it is explicitly noted that, although often used as an abbreviation for the three-word phrase “computer-readable medium (or media),” “CRM” is used in this disclosure as an abbreviation for “one or more non-transitory computer-readable storage media.”

FIG.1illustrates an example network arrangement100that may be employed by an example financial-services institution, in accordance with at least one embodiment. The network arrangement100is provided here by way of example and not limitation, as a network arrangement used by a given financial-services institution could have different numbers, types, and/or arrangements of devices, systems, networks, and/or the like. Moreover, the present disclosure is not limited in applicability to financial-services institutions: embodiments of the present disclosure could be applied by one or more individuals, groups, and/or in the context of one or more other types of organizations.

In the network arrangement100, a number of different devices, systems, and the like are communicatively connected via respective communication links with a public network102and/or a private network104. The devices, systems, etc. that are depicted as being connected to the public network102include an ATM106, an ATM108, an ATM110, a laptop computer112, a laptop computer114, a mobile device116, an external server system118, and a gateway server system120. In the network arrangement100, the gateway server system120is also communicatively connected with the private network104, as are a database system122, an internal server system124, a laptop computer126, and a desktop computer128. In at least one embodiment, only a subset of the devices, systems, and networks that are depicted inFIG.1are operated and managed by the aforementioned example financial-services institution. An example such subset includes the private network104, the ATM106, the ATM108, the ATM110, the gateway server system120, the database system122, the internal server system124, the laptop computer126, and the desktop computer128. And certainly additional and/or different devices, systems, and/or the like could be connected with the public network102and/or the private network104.

The public network102could be a data-communication network such as, including, or in communication with the Internet, and could operate according to a suite of communication protocols such as the Transmission Control Protocol (TCP) over the Internet Protocol (IP) (collectively, TCP/IP), the User Datagram Protocol (UDP) over IP (UDP/IP), and/or others. Moreover, the example financial-services institution could operate the private network104as a private IP network. The gateway server system120could, perhaps in addition to other functions, provide network-access-server (NAS) functions, gateway services, firewall protections, and/or the like for the private network104with respect to the public network102. Any of the devices in communication with the public network102, such as one or more of the ATM106, the ATM108, the ATM110, the laptop computer112, the laptop computer114, the mobile device116, and the external server system118, could communicate via the public network102and the gateway server system120with one or more entities on the private network104, in some cases doing so via a virtual private network (VPN) and/or another type of secure-tunneling communication protocol, connection, and/or the like.

Any of the devices, systems, and the like that are depicted inFIG.1and/or in any of the other figures could have a hardware architecture similar to that depicted in and described below in connection with the example computer system600ofFIG.6and could contain and execute software having a software architecture similar to that depicted in and described below in connection with the example software architecture702ofFIG.7. Moreover, any of the communication links depicted inFIG.1and/or in any of the other figures could be or include one or more wired-communication links (e.g., Ethernet, fiber optic, Universal Serial Bus (USB), and/or the like) and/or one or more wireless-communication links (e.g., Wi-Fi, LTE, NFC, Bluetooth, Bluetooth Low Energy, and/or the like). Any one or more of the communication links could include one or more intermediate devices such as one or more routers, bridges, servers, access points, base stations, and/or the like. Additionally, any communication link could include one or more VPNs and/or other tunneling-type connections.

Moreover, although pictured inFIG.1as a data-storage container, the database system122could include—in addition to one or more data-storage containers, devices, units, and/or the like—one or more database servers that operate to serve requests to carry out database operations with respect to the database system122, where such database operations could include retrieving data, extracting data, modifying data, updating data, removing data, and/or the like. Moreover, although the database system122is shown as being at a single network location in the network arrangement100, the database system122could include multiple different servers, data silos, and/or the like in multiple different geographic and/or network-topology locations. Those of skill in the art having the benefit of the present disclosure will understand that the example network arrangement100could be varied in many other ways in addition to and/or instead of one or more of the ways mentioned herein.

FIG.2illustrates an example information-flow diagram200, in accordance with at least one embodiment, it which it can be seen that a computing device202includes a regular-expression engine204. Although any suitable type of textual pattern matching could be used in various different embodiments of the present disclosure, the examples described in connection withFIG.2and the ensuing figures are largely presented in terms of regular expressions. This is for illustration and not by way of limitation.

The computing device202could be a computing device similar to the computer system600that is depicted inFIG.6, and could have a software architecture of the type that is depicted as the software architecture702inFIG.7. The regular-expression engine204could be implemented as software and/or firmware executing on hardware, and also can be implemented as hardware. As shown inFIG.2, the regular-expression engine204receives one or more documents210from one or more document sources212. Most of the examples that are described herein involve examination of one document210at a time, though multiple documents210could be examined in parallel, among other options.

Each of the documents210could be a plaintext document such as a text file, the body of an email, an email attachment, a text message, a word-processor document, a presentation, a spreadsheet, and/or the like. The one or more document sources212could include one or more servers, one or more databases, one or more computers (such as the depicted laptop), one or more mobile devices (e.g., smartphone, tablet, netbook, etc.), and/or one or more other document sources of any other type deemed suitable by those of skill in the art for a given implementation or in a given context.

The regular-expression engine204is depicted as receiving a regular expression206from a regular-expression storage208, the latter of which could be a database or other computing system or device. In some embodiments, the regular expression206is received via a user interface. Among other options, the regular expression206could be a Perl Compatible Regular Expression (PCRE). And while a single regular expression206is depicted inFIG.2by way of example, the regular-expression engine204could receive and apply multiple regular expressions206to one or more of the documents210. Moreover, the regular-expression engine204is depicted as producing a regular-expression-engine output214, some options for which are described herein.

Generally speaking, the regular-expression-engine output214could represent an action (e.g., an instruction to quarantine a document210), a report (that may list, e.g., one or more identifiers for one or more documents210deemed by the regular-expression engine204to match the regular expression206), a user-interface display (with, e.g., one or more matching portions of the document210highlighted or otherwise denoted), and/or the like. Further details regarding some example structures of the regular expression206, some examples of the internal functioning of the regular-expression engine204, and forms that the regular-expression-engine output214could take are further discussed herein, among other aspects of the present disclosure.

FIG.3illustrates an example regular-expression structure300, in accordance with at least one embodiment. The regular-expression structure300includes a username segment302, a proximity segment304that is positioned after the username segment302, and a password segment306that is positioned after the proximity segment304. It is noted that these segments need not border on one another in the regular-expression structure300—i.e., there could be one or more segments between the username segment302and the proximity segment304, and/or there could be one or more segments in between the proximity segment304and the password segment306. In most of the examples that are described herein, however, a regular expression is utilized that has the regular-expression structure300without intervening terms between the username segment302and the proximity segment304, and also without intervening terms between the proximity segment304and the password segment306.

The username segment302includes a username-precursor segment308, a username-delimiter segment310that is positioned after the username-precursor segment308, and a username-string segment312that is positioned after the username-delimiter segment310. The username-precursor segment308may be configured to match a username-precursor word in the document. Some example username-precursor words include “user,” “username,” “user name,” “user ID,” “userID,” “login,” and the like. Thus, the username-precursor segment308may be configured to match, in the document, a username-precursor word from among a set of one or more username-precursor words.

The username-delimiter segment310may be configured to match a username delimiter in the document. In some embodiments, the username-delimiter segment is configured to match, in the document, a delimiter in a set of one or more delimiters. Some example username delimiters include “:”, “−”, “-”, “—”, “→”, “=”, “is”, “are”, “equals”, etc. Both the username-precursor segment308and the username-delimiter segment310may be implemented as non-capture groups in the regular-expression structure300. Furthermore, the username-string segment312may be configured to match an actual username in the document. In some embodiments, a username takes the form of a string of characters; in some such cases, the string of characters is one that meets a set of username requirements, rules, or the like. Some example username requirements include that the username be no less than a minimum number of characters, no more than a maximum number of characters, not include any so-called special characters (e.g., $, &, #, etc.), and so forth.

An example of a username segment302of an example regex is shown below:(?i)\b(?:username|login)(?::|:|=|=| is)\s*(?−1)(?:(?:[{circumflex over ( )}\s\&\; ]{5,50}))
In that example username segment302, the username-precursor segment308is:\b(?:username|login)
while the username-delimiter segment310is(?::|:|=|=| is)
and the username-string segment312is(?:(?:[{circumflex over ( )}\s\&\; ]{5,50}))

The start of the username segment302being “(?i)” and the end being “(?−i)” indicates that case-insensitive matching is used for the portion of the regex in between those endpoints. This example username-precursor segment308of the example username segment302will match on either of “username” or “login” as the username-precursor word, and will match on any one of “:”, “:” (i.e., a space followed by “:”), “=”, “=” (i.e., a space followed by “=”), and “is” (i.e., the word “is” followed by a space) as the username delimiter. Moreover, in the above example, the username-string segment312corresponds with matching on any string of at least 5 characters and no more than 50 characters up until (but not including) a space, an ampersand, or a semi-colon. That string in that run of the regex represents an actual username (or at least a suspected or possible username) such as:user345
or the like. In some embodiments, the username-string segment312is configured to match on a string of characters that meets a given set of username requirements such as requirements that the username is no less than a minimum number of characters, is no more than a maximum number of characters, does not include any special characters, and/or the like.

The proximity segment304may be configured to match, in the document, a consecutive sequence of between a minimum-proximity number (e.g., 1) and a maximum-proximity number (e.g., a number on the order of 100, 150, or the like) of characters, inclusive. An example of a proximity segment304is:(?s). {1,150}?(?−s)

In some implementations, the fact that the example proximity segment304starts with “(?s).” and ends with “(?-s)” signifies that an option sometimes referred to as a “dot-all” or “dotall” option is being used. When that option is used, the “dot” (.) character, which in a regex typically represents any character other than certain characters such as a newline (\n) or carriage return (\r), does also match on the ‘\n’ and ‘\r’ characters for the processing that occurs after “(?s).” and before (?-s) in the regex. Moreover, in that example, the minimum-proximity number is 1 and the maximum-proximity number is 150.

An example of a password segment306of an example regex is shown below:(?i)\b(?:password|pwd)(?::|:|=|=| is)(?:(?:[{circumflex over ( )}\s\&\; ]{5,50})))
In that example password segment306, the password-precursor segment314is:\b(?:password|pwd)
while the password-delimiter segment316is:(?::|:|=|=| is)
and the password-string segment318is:(?:(?:[{circumflex over ( )}\s\&\; ]{5,50})))

As is the case above with respect to the example username segment302, the start of the password segment306being “(?i)” and the end being “(?−i)” indicates that, in this example, case-insensitive matching is used for the portion of the regex in between those endpoints. This example password-precursor segment314of the example password segment306will match on either of “password” or “pwd” as the password-precursor word, and will match on any one of the delimiters mentioned above with respect to the username-delimiter segment310, as the username-delimiter segment310and the password-delimiter segment316are the same in this example, though they need not be. Similarly, the password-string segment318is the same as the username-string segment312in this example, though again they need not be.

Thus, the password-string segment318is configured to match on any string of 5-50 characters that precedes a space, an ampersand, or a semi-colon. That string in that run of the regex represents an actual (or at least suspected or possible) password such as:G@m3ofThrone$
or the like. In some embodiments, the password-string segment318is configured to match on a string of characters that meets a given set of password requirements such as requirements that the password is no less than a minimum number of characters, is no more than a maximum number of characters, includes at least one lowercase letter, includes at least one uppercase letter, includes at least one numerical digit, includes at least one special character, and/or the like. There could also be a requirement that there not be more than two (or some other number of) matching characters in a row, among many other possible password requirements that could be listed here.

In some embodiments, the username-string segment312itself includes multiple segments. For example, in some instances, the username-string segment312includes what is referred to herein as a username-negative-lookahead segment followed by what is referred to herein as a username-string-selection segment. The latter of those two—i.e., the username-string-selection segment—may be what was described in the above as the (entire) username-string segment312. That is to say, a username-string-selection segment may specify a text pattern for a character string corresponding to the username. Thus, an example username-string-selection segment is:(?:(?:[{circumflex over ( )}\s\&\; ]{5,50}))
which matches the above example of an entire username-string segment312.

Moreover, the username-negative-lookahead segment may itself include one or more sub-tokens that each correspond to a different text pattern that, if found, results in a currently examined portion of the document being deemed to not match the contiguous regular expression206. One useful aspect of the username-negative-lookahead segment is that there may well be documents210in which a user has masked their username with a consecutive sequence of a masking character. Example masking characters include “⋅”, “*”, “−”, “x”, “z”, “q”, “0”, and the like. If a document includes a masked username, that may be considered to be far less of a security risk than a document in which an actual username appears.

An example username-negative-lookahead segment is shown below:(?![xqzy0_\. ⋅\*]{3,50}

This segment examines from the 3rd to the 50th characters after a located username delimiter to make sure that there is not (using the “?!” syntax) a sequence of between 3 and 50 consecutive bullets, asterisks, dashes, “x” characters, or any of the others specified above or in a given username-negative-lookahead segment of a given username-string segment312.

In some embodiments, the username-negative-lookahead segment may also include some shorter-length (but common (e.g., default)) passwords that would not be picked up by the {5,50} search that is done in the above example username-string-selection segment of an example username-string segment312. As an example, “sa” is often the default username and password for SQL implementations. As such, this can be accounted for with a slightly expanded username-negative-lookahead segment such as:(?:sa; |sa|?![xqzy0_\. ⋅\*]{3,50})
which, in addition to matching on a sequence of consecutive repeated (particular) characters as described above, will also match on “sa:” or “sa” appearing after the username delimiter. This is an example of accounting for a special case that presents itself during examination of a number of documents in accordance with embodiments of the present disclosure. Furthermore, characters that may not typically be present in a username can be identified by adding another term, e.g.:(?:sa; |sa|?![xqzy0_\. ⋅\*]{3,50}|?![#\$ %])
which will consider the appearance of a “#”, “$”, or “%” (prior to a space, ampersand, or semi-colon due to the above example username-string-selection segment of an example username-string segment312) to disqualify that particular portion of that document from being a match to the regex.

Similarly, in some embodiments, the password-string segment318may include a password-negative-lookahead segment followed by a password-string-selection segment, the latter of which may just be similar to the example password-string segment318shown above. Thus, an example password-string-selection segment is:(?:(?:[{circumflex over ( )}\s\&\; ]{5,50})))
which matches the above example of an entire password-string segment318. The format and syntax of a password-negative-lookahead segment may be quite similar to that described above in connection with the username-negative-lookahead segment. Thus, it may consider particular short passwords such as “sa;” or “sa” to match, and it may consider the appearance of certain characters prior to a space, ampersand, or semi-colon, for example, to disqualify that portion of the document from being a potential match. Notably, characters such as “#”, “$”, “%”, and/or one or more others may not be included in such a disqualifying group, as those characters are very often allowed (and indeed encouraged) in passwords. An example password-negative-lookahead segment is:(?:sa; |sa|?![xqzy0_\. ⋅\*]{3,50}|?![\(\)\)><])
where “\ (” and “\)” are escape characters for the characters “(” and “)”, respectively. Note that this example includes masking characters similar to those described above in connection with the username-negative-lookahead segment. As with usernames, a masked password is not really a password, so it's not much of a security risk, unlike a plaintext password, of course.

Furthermore, in addition to or instead of a password-negative-lookahead segment, a given password-string segment318may include what is referred to herein as a password-negative-lookbehind segment. In many implementations that include both a password-negative-lookahead segment and a password-negative-lookbehind segment, the password-negative-lookbehind segment precedes the password-negative-lookahead segment in the regex structure. Once progress through the regex on a given portion of a document has proceeded past the password delimiter, a password-negative-lookbehind segment can be used to determine whether what is referred to herein as a disqualifying sequence (which could be one or more words, include other characters, and so on) is present at an earlier point in the portion of the document that is currently being scanned.

If a disqualifying sequence is found earlier in the document portion being scanned at that time, the currently scanned portion of the document is not deemed to match the regex. Some example disqualifying sequences include “\.unprotect password:”, “\.unprotect password:”, “\.protect password:”, and “\.protect password:”, just to name a few. In some cases, this sort of disqualifying sequence can appear in macro code (e.g., Visual Basic (VBA) macro code). An example password-negative-lookbehind segment—that addresses just those four example disqualifying sequences—is shown below:(?<!\.unprotect password:|\.unprotect password:|\.protect password:|\.protect password:)

Based on trial and error and/or other data-gathering methodologies, many of the lists of alternatives in the regular-expression structure300can be revised (e.g., added to, subtracted from, modified, etc.) over time. These lists include:username-precursor words in the username-precursor segment308(including optionally in multiple different languages);username delimiters in the username-delimiter segment310;allowed short-length usernames in the username-negative-lookahead segment (if present);disallowed username characters in the username-negative-lookahead segment (if present);password-precursor words in the password-precursor segment314;password delimiters in the password-delimiter segment316;allowed short-length passwords in the password-negative-lookahead segment (if present);password-masking characters in the password-negative-lookahead segment (if present); anddisqualifying sequences in the password-negative-lookbehind segment (if present).

Moreover, in some embodiments, the regular-expression structure300, and in particular the username segment302, includes what is referred to herein as a same-line segment between the username-delimiter segment310and the username-string segment312. In cases in which the username segment302includes a username-negative-lookahead segment, the same-line segment may be placed before the username-negative-lookahead segment. Here is an example same-line segment:(?=[{circumflex over ( )}\n\r]{5,5})

The function of this same-line segment is to verify that the five characters that come after the detected username delimiter (e.g., “:”) do not include a newline character (\n) and also do not include a carriage-return character (\r). If a newline or carriage return is found within those five characters, the regular-expression engine204will bail out of that matching attempt in connection with the currently examined portion of the document, and continue processing either another section of a current document (if there is one)) or a next document (if there is one).

The password segment306may also or instead include the same or a similar same-line segment between the password-delimiter segment316and the password-string segment318. As with the username segment302, in the context of a password segment306that includes either or both of a password-negative-lookbehind segment and a password-negative-lookahead segment, a same-line segment may be positioned just after the password-delimiter segment316, prior to any password-negative-lookbehind segment and a password-negative-lookahead segment that is present. A same-line segment just after the password-delimiter segment316in the password segment306functions to verify, prior to proceeding further, that none of the five characters following the detected password delimiter is a newline or a carriage return.

Putting all of the above examples together (including the most cumulative of those for which several options are presented) gives the following example regular expression206(that comports with the regular-expression structure300):(?i)\b(?:username|login)(?::|:|=|=| is)(?=[{circumflex over ( )}\n\r]{5,5})\s*(?:sa; |sa|?![xqzy0_\. ⋅\*]{3,50}|?![#\$ %])(?−i)(?:(?:[{circumflex over ( )}\s\&\; ]{5,50}))(?s). {1,150}?(?−s)(?i)\b(?:password|pwd) (?::|:|=|=| is)(?=[{circumflex over ( )}\n\r]{5,5})\s*(?<!\.unprotect password:|\.unprotect password:|\.protect password:|\.protect password:)(?:sa; |sa|?![xqzy0_\. ⋅\*]{3,50}|?![\(\)><])(?:(?:[{circumflex over ( )}\s\&\; ]{5,50})))

It is noted that, in at least some embodiments that do not include a same-line segment such as that shown above in either the username segment302or the password segment306, text such as the following would be considered to match the regular expression206above.username:user345password:G@m3ofThrone$

In at least some embodiments that include a same-line segment in both the username segment302and the password segment306as described above, the four-line text example above would not match the regular expression206above. The following text, would match, however:username: user345password: G@m3ofThrone$
as would the following text:Here's my username: user345 and here is mypassword: G@m3ofThrone$.

Other username-delimiter segments310can be developed that include additional delimiter options such as “is”, “are”, “=”, “=”, and the like, to capture common conversational forms such as:My username is user345 and my password isG@m3ofThrone$ for the server.

FIG.4illustrates an example method, in accordance with at least one embodiment. Broadly speaking, the method400could be performed by any one or any combination of devices, systems, and/or the like that are programmed and/or otherwise arranged to perform the operations described herein. By way of example and not limitation, the method400is described herein as being performed by the regular-expression engine204, which is executing on the computing device202. Certainly many other possibilities could be listed here as well and will occur to those of skill in the art having the benefit of this disclosure.

As a general matter, various different embodiments of the present disclosure (including the method400) provide advanced text searching (using a regular expression) of unstructured data (e.g., documents such as emails, word-processor documents, and others as described herein). Advantageously, embodiments of the present disclosure incorporate a username-focused segment and a password-focused segment into a single, contiguous textual search pattern. This approach helps to reduce the occurrence of false positives as compared the multiple-regex approaches that could be used. As such, embodiments of the present disclosure improve the detection accuracy of unencrypted credentials in unstructured data.

Moreover, although not discussed at length in this disclosure, the embodiments that are described could readily be adapted to other contexts in which it is desirable to identify and respond to a {precursor, delimiter, value} sequence for each of multiple, related data items in a given document. One example is the SSID and Wi-Fi password of one or more wireless networks. Another is personal data such as social security number, credit card numbers, bank-account numbers, and so forth. Other examples will occur to those of skill in the art having the benefit of the present disclosure.

Returning now toFIG.4, the method400begins at operation402with the regular-expression engine204obtaining the document210. This could be by way of a retrieval from data storage (e.g., sequential processing through files in various folders, directories, etc.), working through a provided queue of documents (e.g., emails and their respective attachments), receiving the document210from another computing device, and/or the like. In embodiments of the present disclosure, the document210is an unstructured-data document, as described above. The document210could be from a data-at-rest storage system or could be a document in motion, which may involve obtaining the document210from a communication path via which the document210is being transmitted.

At operation404, the regular-expression engine204searches (or the computing device202uses the regular-expression engine204to search, etc.) the document210for a portion of the document210that matches the contiguous regular expression206. Generally speaking, any sort of textual search pattern could be used, and it is only by way of example that regular expressions (and the regular expression206in particular) are described here. In various embodiments, the regular expression206may be structured according to the regular-expression structure300that is described above. Indeed, in this example, the regular expression206is the example regex that is provided above near the end of the description of the previous figure.

At decision box406, the regular-expression engine204determines whether the currently examined document includes at least one portion thereof that matches the regular expression206. If the answer at decision box406is “No,” then control proceeds to a decision box410, at which the regular-expression engine204determines whether another document is ready (e.g., downloaded, queued, etc.) to be searched/examined as described herein. If so, control returns to operation402. If not, the method400ends at a done block412. In some embodiments, instead of the done block412, a polling or waiting function may be implemented such that control keeps looping back to the decision box410until the answer there is “Yes,” at which point control returns to operation402.

If, however, the answer at decision box406is “Yes,” then at operation408, the regular-expression engine204takes (e.g., performs, initiates, causes, and/or the like) one or more of what are referred to in the present disclosure as match-triggered actions in response to finding at least one portion of the document210that matches the contiguous regular expression206. As described above, in at least one embodiment of the present disclosure, such a match occurs in the context of a document210that contains, in this order:1. a username precursor from the username-precursor segment308of the regular expression206followed by a delimiter from the username-delimiter segment310and then a username string captured by the username-string segment312of the regular expression206;2. all within the proximity range specified by the proximity segment304of the regular expression206; and3. a password precursor from the password-precursor segment314of the regular expression206followed by a delimiter from the password-delimiter segment316and then a password string captured by the password-string segment318of the regular expression206.

It is briefly noted here that, in at least one embodiment, prior to taking the one or more match-triggered actions, the regular-expression engine204searches a remainder of the document210for any one or more additional portions of the document that also match the contiguous regular expression206. In some embodiments, however, one match is enough to take action on that document and the regular-expression engine204proceeds to another document.

Examples of match-triggered actions include, with respect to a user associated with an identified username-and-password pair, freezing, blocking, or suspending an associated user's online account (e.g., their ability to log in to check their financial accounts via a website or app provided by the financial institution), alerting the user (via, e.g., a text message or phone call), increasing a required level of authorization (e.g., requiring 2-factor authentication (2FA)), and/or the like.

Other examples of match-triggered actions include:displaying each matching portion of the document210on a user interface (or at least some of the matching portions, where a user may need to scroll or advance to see later occurrences);displaying, on the user interface, a content of the document210with each matching portion of the document210highlighted or otherwise marked, emphasized, noted, and/or the like;including an identifier of the document210in a stored list of identifiers of documents that contain at least one matching portion (which could involve adding the identifier to the stored list, making sure that it's already on the stored list, and/or the like;including, in a stored list of identified pairs of usernames and passwords, the corresponding username and password from each matching portion in the document (which similarly could involve adding a given username-and-password pair to the list, checking that it's already on the list, etc.);blocking the document210from being transmitted;at least temporarily quarantining the document210;modifying (e.g., heightening) at least one security setting pertaining to authorized access to the document210;modifying (e.g., heightening) at least one security setting on an account associated with a username and password;sending, to at least one user, at least one notification pertaining to finding at least one portion of the document210that matches the contiguous regular expression206;notifying one or both of a user associated with the username and at least one other user;notifying an author of the document; andnotifying an owner of the document.

FIG.5illustrates an example regular-expression structure500, in accordance with at least one embodiment. The regular-expression structure500that is depicted inFIG.5is associated with an alternate approach, referred to herein a tab-delimited approach. The segments present in the regular-expression structure500make up a subset of the segments present in the regular-expression structure300, and thus are not described in detail here. In embodiments of the present disclosure that employ a tab-delimited approach, the regular-expression engine204uses a regex that is structured according to or similar to the regular-expression structure500ofFIG.5. In at least some such embodiments, documents are not searched for actual usernames and passwords, consistent with the regular-expression structure500not including parallels to the username-string segment312and the password-string segment318of the regular-expression structure300. Below is an example regex that is structured according to the regular-expression structure500.(?i)\t(?:user|user name|username)(?:\:|=|=|){0,1}\t(?:password|passwd)(?:\:|=|=|){0,1}\t(?−i)

This example regex is essentially looking for two horizontally aligned cells (in e.g., a spreadsheet, a table, comma separated values (CSV) file, and/or the like) in which the left-hand cell includes a username precursor and delimiter, and in which the right-hand cell includes a password precursor and delimiter. This order could be reversed, and the delimiters could also be omitted, among other modifications that could be made.

FIG.6illustrates an example computer system600within which instructions602(e.g., software, firmware, a program, an application, an applet, an app, a script, a macro, and/or other executable code) for causing the computer system600to perform any one or more of the methodologies discussed herein may be executed. In at least one embodiment, execution of the instructions602causes the computer system600to perform one or more of the methods described herein. In at least one embodiment, the instructions602transform a general, non-programmed computer system into a particular computer system600programmed to carry out the described and illustrated functions. The computer system600may operate as a standalone device or may be coupled (e.g., networked) to and/or with one or more other devices, machines, systems, and/or the like. In a networked deployment, the computer system600may operate in the capacity of a server and/or a client in one or more server-client relationships, and/or as one or more peers in a peer-to-peer (or distributed) network environment.

The computer system600may be or include, but is not limited to, one or more of each of the following: a server computer or device, a client computer or device, a personal computer (PC), a tablet, a laptop, a netbook, a set-top box (STB), a personal digital assistant (PDA), an entertainment media system, a cellular telephone, a smartphone, a mobile device, a wearable (e.g., a smartwatch), a smart-home device (e.g., a smart appliance), another smart device (e.g., an Internet of Things (IoT) device), a web appliance, a network router, a network switch, a network bridge, and/or any other machine capable of executing the instructions602, sequentially or otherwise, that specify actions to be taken by the computer system600. And while only a single computer system600is illustrated, there could just as well be a collection of computer systems that individually or jointly execute the instructions602to perform any one or more of the methodologies discussed herein.

As depicted inFIG.6, the computer system600may include processors604, memory606, and I/O components608, which may be configured to communicate with each other via a bus610. In an example embodiment, the processors604(e.g., a central processing unit (CPU), a Reduced Instruction Set Computing (RISC) processor, a Complex Instruction Set Computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a radio-frequency integrated circuit (RFIC), another processor, and/or any suitable combination thereof) may include, as examples, a processor612and a processor614that execute the instructions602. The term “processor” is intended to include multi-core processors that may include two or more independent processors (sometimes referred to as “cores”) that may execute instructions contemporaneously. AlthoughFIG.6shows multiple processors604, the computer system600may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiples cores, or any combination thereof.

The memory606, as depicted inFIG.6, includes a main memory616, a static memory618, and a storage unit620, each of which is accessible to the processors604via the bus610. The memory606, the static memory618, and/or the storage unit620may store the instructions602executable for performing any one or more of the methodologies or functions described herein. The instructions602may also or instead reside completely or partially within the main memory616, within the static memory618, within machine-readable medium622within the storage unit620, within at least one of the processors604(e.g., within a cache memory of a given one of the processors604), and/or any suitable combination thereof, during execution thereof by the computer system600. In at least one embodiment, the machine-readable medium622includes one or more non-transitory computer-readable storage media.

Furthermore, also as depicted inFIG.6, I/O components608may include a wide variety of components to receive input, produce and/or provide output, transmit information, exchange information, capture measurements, and/or the like. The specific I/O components608that are included in a particular instance of the computer system600will depend on the type of machine. For example, portable machines such as mobile phones may include a touch input device or other such input mechanisms, while a headless server machine may not include such a touch input device. Moreover, the I/O components608may include many other components that are not shown inFIG.6.

In various example embodiments, the I/O components608may include input components632and output components634. The input components632may include alphanumeric input components (e.g., a keyboard, a touchscreen configured to receive alphanumeric input, a photo-optical keyboard, and/or other alphanumeric input components), pointing-based input components (e.g., a mouse, a touchpad, a trackball, a joystick, a motion sensor, and/or one or more other pointing-based input components), tactile input components (e.g., a physical button, a touchscreen that is responsive to location and/or force of touches or touch gestures, and/or one or more other tactile input components), audio input components (e.g., a microphone), and/or the like. The output components634may include visual components (e.g., a display such as a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, and/or a cathode ray tube (CRT)), acoustic components (e.g., speakers), haptic components (e.g., a vibratory motor, resistance mechanisms), other signal generators, and so forth.

In further example embodiments, the I/O components608may include, as examples, biometric components636, motion components638, environmental components640, and/or position components642, among a wide array of possible components. As examples, the biometric components636may include components to detect expressions (e.g., hand expressions, facial expressions, vocal expressions, body gestures, eye tracking, and/or the like), measure biosignals (e.g., blood pressure, heart rate, body temperature, perspiration, brain waves, and/or the like), identify a person (by way of, e.g., voice identification, retinal identification, facial identification, fingerprint identification, electroencephalogram-based identification and/or the like), etc. The motion components638may include acceleration-sensing components (e.g., an accelerometer), gravitation-sensing components, rotation-sensing components (e.g., a gyroscope), and/or the like.

The environmental components640may include, as examples, illumination-sensing components (e.g., a photometer), temperature-sensing components (e.g., one or more thermometers), humidity-sensing components, pressure-sensing components (e.g., a barometer), acoustic-sensing components (e.g., one or more microphones), proximity-sensing components (e.g., infrared sensors, millimeter-(mm)-wave radar) to detect nearby objects), gas-sensing components (e.g., gas-detection sensors to detect concentrations of hazardous gases for safety and/or to measure pollutants in the atmosphere), and/or other components that may provide indications, measurements, signals, and/or the like that correspond to a surrounding physical environment. The position components642may include location-sensing components (e.g., a Global Navigation Satellite System (GNSS) receiver such as a Global Positioning System (GPS) receiver), altitude-sensing components (e.g., altimeters and/or barometers that detect air pressure from which altitude may be derived), orientation-sensing components (e.g., magnetometers), and/or the like.

Communication may be implemented using a wide variety of technologies. The I/O components608may further include communication components644operable to communicatively couple the computer system600to one or more networks624and/or one or more devices626via a coupling628and/or a coupling630, respectively. For example, the communication components644may include a network-interface component or another suitable device to interface with a given network624. In further examples, the communication components644may include wired-communication components, wireless-communication components, cellular-communication components, Near Field Communication (NFC) components, Bluetooth (e.g., Bluetooth Low Energy) components, Wi-Fi components, and/or other communication components to provide communication via one or more other modalities. The devices626may include one or more other machines and/or any of a wide variety of peripheral devices (e.g., a peripheral device coupled via a universal serial bus (USB) connection).

Moreover, the communication components644may detect identifiers or include components operable to detect identifiers. For example, the communication components644may include radio frequency identification (RFID) tag reader components, NFC-smart-tag detection components, optical-reader components (e.g., an optical sensor to detect one-dimensional bar codes such as Universal Product Code (UPC) bar codes, multi-dimensional bar codes such as Quick Response (QR) codes, Aztec codes, Data Matrix, Dataglyph, MaxiCode, PDF417, Ultra Code, UCC RSS-2D bar codes, and/or other optical codes), and/or acoustic-detection components (e.g., microphones to identify tagged audio signals). In addition, a variety of information may be derived via the communication components644, such as location via IP geolocation, location via Wi-Fi signal triangulation, location via detecting an NFC beacon signal that may indicate a particular location, and/or the like.

One or more of the various memories (e.g., the memory606, the main memory616, the static memory618, and/or the (e.g., cache) memory of one or more of the processors604) and/or the storage unit620may store one or more sets of instructions (e.g., software) and/or data structures embodying or used by any one or more of the methodologies or functions described herein. These instructions (e.g., the instructions602), when executed by one or more of the processors604, cause performance of various operations to implement various embodiments of the present disclosure.

The instructions602may be transmitted or received over one or more networks624using a transmission medium, via a network-interface device (e.g., a network-interface component included in the communication components644), and using any one of a number of transfer protocols (e.g., the Session Initiation Protocol (SIP), the HyperText Transfer Protocol (HTTP), and/or the like). Similarly, the instructions602may be transmitted or received using a transmission medium via the coupling630(e.g., a peer-to-peer coupling) to one or more devices626. In some embodiments, IoT devices can communicate using Message Queuing Telemetry Transport (MQTT) messaging, which can be relatively more compact and efficient.

FIG.7is a diagram700illustrating an example software architecture702, which can be installed on any one or more of the devices described herein. For example, the software architecture702could be installed on any device or system that is arranged similar to the computer system600ofFIG.6. The software architecture702may be supported by hardware such as a machine704that may include processors706, memory708, and I/O components710. In this example, the software architecture702can be conceptualized as a stack of layers, where each layer provides a particular functionality. The software architecture702may include layers such an operating system712, libraries714, frameworks716, and applications718. Operationally, using one or more application programming interfaces (APIs), the applications718may invoke API calls720through the software stack and receive messages722in response to the API calls720.

In at least one embodiment, the operating system712manages hardware resources and provides common services. The operating system712may include, as examples, a kernel724, services726, and drivers728. The kernel724may act as an abstraction layer between the hardware and the other software layers. For example, the kernel724may provide memory management, processor management (e.g., scheduling), component management, networking, and/or security settings, in some cases among one or more other functionalities. The services726may provide other common services for the other software layers. The drivers728may be responsible for controlling or interfacing with underlying hardware. For instance, the drivers728may include display drivers, camera drivers, Bluetooth or Bluetooth Low Energy drivers, flash memory drivers, serial communication drivers (e.g., USB drivers), Wi-Fi drivers, audio drivers, power management drivers, and/or the like.

The libraries714may provide a low-level common infrastructure used by the applications718. The libraries714may include system libraries730(e.g., a C standard library) that may provide functions such as memory-allocation functions, string-manipulation functions, mathematic functions, and/or the like. In addition, the libraries714may include API libraries732such as media libraries (e.g., libraries to support presentation and/or manipulation of various media formats such as Moving Picture Experts Group-4 (MPEG4), Advanced Video Coding (H.264 or AVC), Moving Picture Experts Group Layer-3 (MP3), Advanced Audio Coding (AAC), Adaptive Multi-Rate (AMR) audio codec, Joint Photographic Experts Group (JPEG or JPG), Portable Network Graphics (PNG), and/or the like), graphics libraries (e.g., an OpenGL framework used to render in two dimensions (2D) and three dimensions (3D) in graphic content on a display), database libraries (e.g., SQLite to provide various relational-database functions), web libraries (e.g., WebKit to provide web-browsing functionality), and/or the like. The libraries714may also include a wide variety of other libraries734to provide many other APIs to the applications718.

The frameworks716may provide a high-level common infrastructure that may be used by the applications718. For example, the frameworks716may provide various graphical-user-interface (GUI) functions, high-level resource management, high-level location services, and/or the like. The frameworks716may provide a broad spectrum of other APIs that may be used by the applications718, some of which may be specific to a particular operating system or platform.

Purely as representative examples, the applications718may include a home application736, a contacts application738, a browser application740, a book-reader application742, a location application744, a media application746, a messaging application748, a game application750, and/or a broad assortment of other applications generically represented inFIG.7as a third-party application752. The applications718may be programs that execute functions defined in the programs. Various programming languages may be employed to create one or more of the applications718, structured in a variety of manners, such as object-oriented programming languages (e.g., Objective-C, Java, C++, etc.), procedural programming languages (e.g., C, assembly language, etc.), and/or the like. In a specific example, the third-party application752(e.g., an application developed using the ANDROID™ or IOS™ software development kit (SDK) by an entity other than the vendor of the particular platform) could be mobile software running on a mobile operating system such as IOS™, ANDROID™, WINDOWS® Phone, and/or the like. Moreover, a third-party application752may be able to invoke the API calls720provided by the operating system712to facilitate functionality described herein.

In view of the disclosure above, a listing of various examples of embodiments is set forth below. It should be noted that one or more features of an example, taken in isolation or combination, should be considered within the disclosure of this application.

Example 1 is a method performed by a computer system executing instructions on at least one hardware processor, the method including: obtaining a document; using a textual-pattern-matching engine to search the document for a portion of the document that matches a contiguous textual search pattern, the contiguous textual search pattern including a username segment, a proximity segment that is positioned after the username segment, and a password segment that is positioned after the proximity segment; and taking one or more match-triggered actions in response to finding at least one portion of the document that matches the contiguous textual search pattern.

Example 2 is the method of Example 1, where: the username segment includes a username-precursor segment, a username-delimiter segment that is positioned after the username-precursor segment, and a username-string segment that is positioned after the username-delimiter segment; the username-precursor segment is configured to match a username-precursor word in the document; the username-delimiter segment is configured to match a username delimiter in the document; and the username-string segment is configured to match a username in the document.

Example 3 is the method of Example 2, where: the username-precursor segment being configured to match a username-precursor word in the document includes the username-precursor segment being configured to match, in the document, a username-precursor word from among a set of one or more username-precursor words; the username-delimiter segment being configured to match a username delimiter in the document includes the username-delimiter segment being configured to match, in the document, a delimiter in a set of one or more delimiters; and the username-string segment being configured to match a username in the document includes the username-string segment being configured to match, in the document, a character string corresponding to a username.

Example 4 is the method of Example 3, where: the username-string segment includes a username-negative-lookahead segment followed by a username-string-selection segment; the username-negative-lookahead segment includes one or more sub-tokens that each correspond to a different text pattern that, if found, results in a currently examined portion of the document being deemed to not match the contiguous textual search pattern; and the username-string-selection segment specifies a text pattern for the character string corresponding to the username.

Example 5 is the method of Example 3 or Example 4, where the proximity segment is configured to match, in the document, a consecutive sequence of between a minimum-proximity number and a maximum-proximity number of characters, inclusive.

Example 6 is the method of Example 5, where: the password segment includes a password-precursor segment, a password-delimiter segment that is positioned after the password-precursor segment, and a password-string segment that is positioned after the password-delimiter segment; the password-precursor segment is configured to match a password-precursor word in the document; the password-delimiter segment is configured to match a password delimiter in the document; and the password-string segment is configured to match a password in the document.

Example 7 is the method of Example 6, where: the password-precursor segment being configured to match a password-precursor word in the document includes the password-precursor segment being configured to match, in the document, a password-precursor word from among a set of one or more password-precursor words; the password-delimiter segment being configured to match a password delimiter in the document includes the password-delimiter segment being configured to match, in the document, a delimiter in the set of one or more delimiters; and the password-string segment being configured to match a password in the document includes the password-string segment being configured to match, in the document, a character string corresponding to a password.

Example 8 is the method of Example 7, where: the username-string segment being configured to match a character string corresponding to a username includes the username-string segment being configured to match a character string that satisfies each of one or more username requirements; and the password-string segment being configured to match a character string corresponding to a password includes the password-string segment being configured to match a character string that satisfies each of one or more password requirements.

Example 9 is the method of Example 7 or Example 8, where: the password-string segment includes a password-negative-lookahead segment followed by a password-string-selection segment; the password-negative-lookahead segment includes one or more sub-tokens that each correspond to a different text pattern that, if found in an ensuing part of the currently examined portion of the document, results in the currently examined portion of the document being deemed to not match the contiguous textual search pattern; and the password-string-selection segment specifies a text pattern for the character string corresponding to the password.

Example 10 is the method of Example 9, where: the password-string segment further includes a password-negative-lookbehind segment before the password-negative-lookahead segment; and the password-negative-lookbehind segment includes one or more sub-tokens that each correspond to a different text pattern that, if found in a preceding part of the currently examined portion of the document, results in the currently examined portion of the document being deemed to not match the contiguous textual search pattern.

Example 11 is the method of any of the Examples 1-10, further including, prior to taking the one or more match-triggered actions, using the textual-pattern-matching engine to search a remainder of the document for any one or more additional portions of the document that also match the contiguous textual search pattern.

Example 12 is the method of Example 11, where the one or more match-triggered actions includes displaying each matching portion of the document on a user interface.

Example 13 is the method of Example 12, where displaying each matching portion of the document on the user interface includes displaying, on the user interface, a content of the document with each matching portion of the document highlighted.

Example 14 is the method of any of the Examples 1-13, where the one or more match-triggered actions includes on or both of: including an identifier of the document in a stored list of identifiers of documents that contain at least one matching portion; and including, in a stored list of identified pairs of usernames and passwords, the corresponding username and password from each matching portion in the document.

Example 15 is the method of any of the Examples 1-14, where the one or more match-triggered actions includes one or both of blocking the document from being transmitted and at least temporarily quarantining the document.

Example 16 is the method of any of the Examples 1-15, where the one or more match-triggered actions include one or both of: heightening at least one security setting pertaining to authorized access to the document; and heightening at least one security setting on an account associated with the username and password.

Example 17 is the method of any of the Examples 1-16, where the one or more match-triggered actions includes sending, to at least one user, at least one notification pertaining to finding at least one portion of the document that matches the contiguous textual search pattern.

Example 18 is a computer system including: at least one hardware processor; and data storage containing instructions that, when executed by the at least one hardware processor, cause the computer system to perform operations including: obtaining a document; using a textual-pattern-matching engine to search the document for a portion of the document that matches a contiguous textual search pattern, the contiguous textual search pattern including a username segment, a proximity segment that is positioned after the username segment, and a password segment that is positioned after the proximity segment; and taking one or more match-triggered actions in response to finding at least one portion of the document that matches the contiguous textual search pattern.

Example 19 is the computer system of Example 18, where: the username segment includes a username-precursor segment that is configured to match a username-precursor word in the document, a username-delimiter segment that is positioned after the username-precursor segment and that is configured to match a username delimiter in the document, and a username-string segment that is positioned after the username-delimiter segment and that is configured to configured to match a username in the document; the proximity segment is configured to match, in the document, a consecutive sequence of between a minimum-proximity number and a maximum-proximity number of characters, inclusive; and the password segment includes a password-precursor segment that is configured to match a password-precursor word in the document, a password-delimiter segment that is positioned after the password-precursor segment and that is configured to match a password delimiter in the document, and a password-string segment that is positioned after the password-delimiter segment and that is configured to match a password in the document.

Example 20 is one or more non-transitory computer-readable storage media containing instructions that, when executed by at least one hardware processor of a computer system, cause the computer system to perform operations including: obtaining a document; using a textual-pattern-matching engine to search the document for a portion of the document that matches a contiguous textual search pattern, the contiguous textual search pattern including a username segment, a proximity segment that is positioned after the username segment, and a password segment that is positioned after the proximity segment; and taking one or more match-triggered actions in response to finding at least one portion of the document that matches the contiguous textual search pattern.

Further examples include computer-system, and non-transitory-computer-readable-storage-media embodiments of the method Examples 2-17.

To promote an understanding of the principles of the present disclosure, various embodiments are illustrated in the drawings. The embodiments disclosed herein are not intended to be exhaustive or to limit the present disclosure to the precise forms that are disclosed in the above detailed description. Rather, the described embodiments have been selected so that others skilled in the art may utilize their teachings. Accordingly, no limitation of the scope of the present disclosure is thereby intended.

As used in this disclosure, including in the claims, phrases of the form “at least one of A and B,” “at least one of A, B, and C,” and the like should be interpreted as if the language “A and/or B,” “A, B, and/or C,” and the like had been used in place of the entire phrase. Unless explicitly stated otherwise in connection with a particular instance, this manner of phrasing is not limited in this disclosure to meaning only “at least one of A and at least one of B,” “at least one of A, at least one of B, and at least one of C,” and so on. Rather, as used herein, the two-element version covers each of the following: one or more of A and no B, one or more of B and no A, and one or more of A and one or more of B. And similarly for the three-element version and beyond. Similar construction should be given to such phrases in which “one or both,” “one or more,” and the like is used in place of “at least one,” again unless explicitly stated otherwise in connection with a particular instance.

Furthermore, in any instances in this disclosure, including in the claims, in which numeric modifiers such as “first,” “second,” “third,” etc. are used in reference to components, data (e.g., values, identifiers, parameters, and/or the like), and/or any other elements, such use of such modifiers is not intended to denote or dictate any specific or required order of the elements that are referenced in this manner. Rather, any such use of such modifiers is intended to assist the reader in distinguishing elements from one another, and should not be interpreted as insisting upon any particular order or carrying any other significance, unless such an order or other significance is clearly and affirmatively explained herein.

Moreover, one or more components of one or more devices, systems, and/or the like may be referred to in this disclosure as “modules” that perform (execute, carry out, etc.) various operations. If and as used in the present disclosure, a “module” includes both hardware and instructions. The hardware could include one or more processors, one or more microprocessors, one or more microcontrollers, one or more microchips, one or more application-specific integrated circuits (ASICs), one or more field programmable gate arrays (FPGAs), one or more graphical processing units (GPUs), one or more tensor processing units (TPUs), and/or one or more devices and/or components of any other type deemed suitable by those of skill in the art for a given implementation. In some cases, a module includes at least one functional component (e.g., an application or part of an application, a block of code, and/or the like) executing in whole or in part on one or more hardware processors.

The instructions for a given module are executable by the hardware for carrying out the one or more herein-described operations of the module, and could include hardware (e.g., hardwired) instructions, firmware instructions, software instructions, and/or the like, stored in any one or more non-transitory computer-readable storage media deemed suitable by those of skill in the art for a given implementation. Each such non-transitory computer-readable storage medium could be or include memory (e.g., random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM a.k.a. E2PROM), Flash memory, and/or one or more other types of memory) and/or one or more other types of non-transitory computer-readable storage media. A module could be realized as a single component or be distributed across multiple components as deemed suitable by those of skill in the art for a given implementation.

Moreover, consistent with the fact that the entities and arrangements that are described herein, including the entities and arrangements that are depicted in and described in connection with the drawings, are presented as examples and not by way of limitation, any and all statements or other indications as to what a particular element or entity in a particular drawing or otherwise mentioned in this disclosure “is” or “has,” and any and all similar statements that are not explicitly self-qualifying by way of a clause such as “In at least one embodiment,” and that could therefore be read in isolation and out of context as absolute and thus as a limitation on all embodiments, can only properly be read as being constructively self-qualified by such a clause. It is for reasons akin to brevity and clarity of presentation that this implied clause is not repeated ad nauseum in this disclosure.