Time-based analysis of data streams

摘要

Techniques are disclosed for performing a time-based analysis on data streams in a computing network. For example, a method includes the following steps. Two or more data streams are accessed. The two or more data streams can be associated with two or more source devices, two or more application programs, or combinations thereof. A time-based analysis is performed on the two or more data streams. The time-based analysis determines whether or not a correlation exists between portions of the two or more data streams.

主权项

1. A method comprising the steps of:
identifying two or more data streams, wherein the two or more data streams are respectively associated with at least two of one or more source devices and one or more application programs associated with at least one network and attributable to at least one common user, wherein at least one of the identified two or more data streams is obtained from a historical data repository in which the data stream is logged; performing a time-based analysis on the two or more data streams, wherein the time-based analysis determines whether or not a correlation, based on an evaluation of content and context, exists between portions of the two or more data streams such that a determination is made as to whether or not the two or more data streams correspond to related content and whether or not correlated portions of the two or more data streams comprise a pattern having a given frequency of occurrence; and determining whether or not correlated portions of the two or more data streams are indicative of a violation of a policy applicable to the network, so as to modify at least one of the two or more data streams, before the data stream enters or leaves the network, when a violation is indicated, wherein modifying at least one of the two or more data streams comprises at least one of altering, masking and blocking at least a portion of data in the data stream being modified; wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.