Patent ID: 8005908

Claim:
A system to detect if an outbound e-mail of a plurality of outbound e-mails sent by an employee of a plurality of employees of an enterprise is leaking critical information using a plurality of non-sensitive attributes and a plurality of employee-specific models with the aim of reducing false positives and false negatives said system is adapted to execute a method comprising of: determining of said plurality of non-sensitive attributes based on a plurality of possible attributes associated with said plurality of outbound e-mails; obtaining of said plurality of employee-specific attributes based on said plurality of employees and said plurality of outbound e-mails; and determining of said plurality of employee-specific models based on said plurality of employee-specific attributes, wherein, determining of said plurality of non-sensitive attributes comprises: obtaining of a plurality of clean e-mails based on said plurality of outbound e-mails; obtaining of a plurality of suspect e-mails based on said plurality of outbound e-mails; extracting of said plurality of possible attributes based on said plurality of outbound e-mails; generating of a plurality of cumulative fraction data plots based on each of said plurality of possible attributes; determining of a plurality of clean cumulative fraction data points based on said plurality of cumulative fraction data plots and said plurality of clean e-mails; determining of a plurality of suspect cumulative fraction data points based on said plurality of cumulative fraction data plots and said plurality of suspect e-mails; generating of a plurality of clean uniformity measures by applying a Kolmogorov-Smirnov test for uniformity on said plurality of clean cumulative fraction data points; generating of a plurality of suspect uniformity measures by applying a Kolmogorov-Smirnov test for uniformity on said plurality of suspect cumulative fraction data points; selecting an attribute of said plurality of possible attributes if a clean uniformity measure of said plurality of clean uniformity measures associated with said attribute is less than a pre-defined threshold and a suspect uniformity measure of said plurality of suspect uniformity measures associated with said attribute is less than a pre-defined threshold; and making of said attribute a part of said plurality of non-sensitive attributes.