Patent Issued for Dynamic system profiling based on data extraction (USPTO 11531765): Allstate Insurance Company

2023 JAN 09 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- From Alexandria, Virginia, NewsRx journalists report that a patent by the inventors Hurwitz, Joshua (Niles, IL, US), filed on July 16, 2020, was published online on December 20, 2022.

The patent’s assignee for patent number 11531765 is Allstate Insurance Company (Northbrook, Illinois, United States).

News editors obtained the following quote from the background information supplied by the inventors: “Applications and services may collect data, which in some cases may be sensitive information. In some instances, data collection may be utilized to provide certain features and/or functionalities to users. However, in other instances, data may be collected solely to facilitate targeted advertising and other marketing strategies. Furthermore, such collected data may be sold or otherwise provided to other companies. In some instances, there may be a risk of loss of data due to security vulnerabilities in a system.

“Application developers and service providers may generally disclose a type, nature, and/or amount of data collected by the software or service. However, end users may not be attentive to such disclosures. Furthermore, users may not understand the risks, and may sometimes forget what data is being collected, due to a large number of applications and services they may be using. Also, in some instances, users may not understand the full scope of any benefit provided by such data collection. Also, for example, parents may not fully understand an extent and/or type of data that may be collected by applications or services being used by their children.

“Accordingly, there may be an advantage to automatically analyze disclosures provided by application developers and service providers to determine risk profiles associated with applications and services. In some instances, it may be of significance to compare risk profiles for different applications or services that may provide similar functionalities. In some aspects, it may be advantageous to automatically identify and recommend applications and/or services that may carry a lower risk of unnecessary data collection.”

As a supplement to the background information on this patent, NewsRx correspondents also obtained the inventors’ summary information for this patent: “In light of the foregoing background, the following presents a simplified summary of the present disclosure in order to provide a basic understanding of some aspects of the invention. This summary is not an extensive overview of the invention. It is not intended to identify key or critical elements of the invention or to delineate the scope of the invention. The following summary merely presents some concepts of the invention in a simplified form as a prelude to the more detailed description provided below.

“Aspects of the disclosure address one or more of the issues mentioned above by disclosing methods, computer readable storage media, software, systems, and apparatuses for a dynamic system profiling based on data extraction.

“In some aspects, a privacy risk determination system may include a privacy risk processing system and a privacy risk analysis system. The privacy risk determination system may include at least one processor and a memory unit storing computer-executable instructions. In some embodiments, the computer-executable instructions may be stored in one or more non-transitory computer-readable media. The privacy risk determination system may be configured to, in operation, retrieve, via a computing device and over a network, information related to one or more characteristics of a particular application or service deployed in a computing environment. The privacy risk determination system may be configured to associate, via the computing device and based on the information, the particular application or service with a class of applications or services. The privacy risk determination system may be configured to determine, for each application or service in the associated class, a type of personal data collected. The privacy risk determination system may be configured to determine, for the particular application or service, a risk metric indicative of a type of personal data collected by the particular application or service in relation to the type of personal data collected by other applications or services in the associated class. The privacy risk determination system may be configured to recommend, via the computing device and based on the risk metric, an additional application or service with a lower risk than the particular application or service.

“In some aspects, the privacy risk determination system may be configured to determine, for the associated class, a composite risk metric indicative of a type of personal data collected by the applications or services in the associated class, where the composite risk metric is an aggregate of risk metrics of applications or services in the associated class. In some arrangements, the privacy risk determination system may be configured to, in operation, recommend the additional application or service is based on the composite risk metric.

“In some aspects, the privacy risk determination system may be configured to determine a probability that an application or service in the associated class collects personal data, and determine the risk metric based on the probability.”

The claims supplied by the inventors are:

“1. A method comprising: retrieving, via one or more computing devices and over a network, information related to one or more characteristics of a particular application stored or executing on the one or more computing devices; associating, via the one or more computing devices and based on the information, the particular application with a class of applications; determining, for one or more application in the associated class, a type of personal data collected; determining, for the particular application, a risk metric indicative of a type of personal data collected by the particular application in relation to the type of personal data collected by other applications in the associated class; and recommending, via the one or more computing devices and based on the risk metric, an additional application that collects the type of personal data collected by the particular application and has a lower risk than the particular application.

“2. The method of claim 1, further comprising: determining, for the associated class, a composite risk metric indicative of a type of personal data collected by the one or more application in the associated class, wherein the composite risk metric is an aggregate of a plurality of determined risk metrics of a plurality of applications in the associated class.

“3. The method of claim 2, wherein recommending the additional application is based on the composite risk metric.

“4. The method of claim 1, further comprising: determining a probability that an application in the associated class collects personal data, and wherein determining the risk metric is based on the probability.

“5. The method of claim 1, wherein the class of applications includes at least one of: a gaming application, a productivity application, or a music application.

“6. The method of claim 1, wherein the one or more characteristics include at least one of: whether the particular application enables sharing with other users over the network; whether the particular application incorporates opportunities to purchase other products or services; or whether the particular application enables an offering of a commercial advertisement.

“7. The method of claim 1, wherein the one or more characteristics comprises a content rating for the particular application.

“8. The method of claim 1, further comprising: extracting the information related to the one or more characteristics from at least one of a description or a review of the particular application.

“9. The method of claim 1, wherein the additional application is in the associated class with the particular application.

“10. An apparatus comprising: a processor; and a memory unit storing computer-executable instructions, which when executed by the processor, cause the apparatus to: retrieve, via one or more computing devices and over a network, information related to one or more characteristics of a plurality of applications stored or executing on the one or more computing devices; cluster, via the one or more computing devices and based on the information, the plurality of applications into a plurality of classes; associate, in a database, one or more application of the plurality of applications with a class of the plurality of classes, the associated class including at least one of a gaming application, a virtual or enhanced reality application, a productivity application, a word processing application, a graphic design application, a presentation application, a graphic design application, a data management application, a spreadsheet application, an educational application, a violent content application, or a music-related application; determine, for the one or more application in the associated class, a type of personal data collected; determine, for a particular application in the associated class, a risk metric indicative of a type of personal data collected by the particular application in relation to the type of personal data collected by other applications in the associated class; and recommend, via the one or more computing devices and based on the risk metric, an other application in the associated class with a lower risk than the particular application.

“11. The apparatus of claim 10, wherein the computer-executable instructions, when executed by the processor, cause the apparatus to: determine, for the associated class, a composite risk metric indicative of a type of personal data collected by the one or more application in the associated class, wherein the composite risk metric is an aggregate of a plurality of risk metrics of a plurality of applications in the associated class.

“12. The apparatus of claim 11, wherein recommending the other application is based on the composite risk metric.

“13. The apparatus of claim 10, wherein the computer-executable instructions, when executed by the processor, cause the apparatus to: determine a probability that an application in the associated class collects personal data, and wherein determining the risk metric is based on the probability.

“14. The apparatus of claim 10, wherein the one or more characteristics include at least one of: whether the particular application enables sharing with other users over the network; whether the particular application incorporates opportunities to purchase other products or services; or whether the particular application enables an offering of a commercial advertisement.

“15. The apparatus of claim 10, wherein the one or more characteristics comprise a content rating for the particular application.

“16. The apparatus of claim 10, wherein the computer-executable instructions, when executed by the processor, cause the apparatus to: extract the information related to the one or more characteristics from at least one of a description or a review of the particular application.

“17. One or more non-transitory computer-readable media storing instructions that, when executed by a computing device, cause the computing device to: detect, via one or more computing devices and over a network, a particular application stored or executing on the one or more computing devices; retrieve, via the one or more computing devices and over the network, information related to one or more characteristics of the particular application, the one or more characteristics including at least one of: whether the particular application enables sharing with other users over the network; whether the particular application incorporates opportunities to purchase other products or services; whether the particular application enables an offering of a commercial advertisement; whether the particular application accesses a camera, a camera roll, a text messaging application, a phone application, a calendar application, or a microphone associated with the one or more computing devices; a content rating of the particular application; or location data associated with the particular application; associate, via the one or more computing devices and based on the information, the particular application with a class of applications; determine, for one or more application in the associated class, a type of personal data collected; determine, for the particular application, a risk metric indicative of a type of personal data collected by the particular application in relation to the type of personal data collected by other applications in the associated class; and recommend, via the one or more computing devices and based on the risk metric, an additional application with a lower risk than the particular application.

“18. The one or more non-transitory computer-readable media of claim 17, wherein the instructions cause the computing device to: determine, for the associated class, a composite risk metric indicative of a type of personal data collected by the one or more application in the associated class, wherein the composite risk metric is an aggregate of a plurality of risk metrics of a plurality of applications in the associated class.

“19. The one or more non-transitory computer-readable media of claim 18, wherein recommending the additional application is based on the composite risk metric.

“20. The one or more non-transitory computer-readable media of claim 17, wherein the instructions cause the computing device to: determine a probability that an application in the associated class collects personal data, and wherein determining the risk metric is based on the probability.”

For additional information on this patent, see: Hurwitz, Joshua. Dynamic system profiling based on data extraction. U.S. Patent Number 11531765, filed July 16, 2020, and published online on December 20, 2022. Patent URL (for desktop use only): https://ppubs.uspto.gov/pubwebapp/external.html?q=(11531765)&db=USPAT&type=ids

(Our reports deliver fact-based news of research and discoveries from around the world.)