FIELD OF THE INVENTION

The present invention embraces a system for identifying, tagging, and monitoring data flow in a system environment.

BACKGROUND

Present conventional systems do not have the capability to track data or changes to data as data moves within an entity. For example, users associated with the entity may use data, move data, duplicate data, change data, and/or the like such that an origin of the data or changes made to the data are no longer identifiable. Access controls may be placed on data structures storing data, but, after a user moves the data, the access controls may no longer be in place.

SUMMARY

The following presents a simplified summary of one or more embodiments of the present invention, in order to provide a basic understanding of such embodiments. This summary is not an extensive overview of all contemplated embodiments and is intended to neither identify key or critical elements of all embodiments nor delineate the scope of any or all embodiments. This summary presents some concepts of one or more embodiments of the present invention in a simplified form as a prelude to the more detailed description that is presented later.

In one aspect, a system for identifying, tagging, and monitoring data flow in a system environment is presented. The system may include at least one non-transitory storage device and at least one processing device coupled to the at least one non-transitory storage device, where the at least one processing device is configured to receive data sets generated by applications for storage in data structures, generate unique identifiers for the data sets by generating, for each data set, a unique identifier including origin information of the data set, add the unique identifiers to the data sets by adding, to each data set, the unique identifier generated for the data set, monitor, based on the unique identifiers, access to and movement of the data sets by monitoring the applications accessing the data sets, movement of the data sets from the data structures to the applications, movement of the data sets between the applications, movement of the data sets from the applications to the data structures, and movement of the data sets between the data structures, generate, based on monitoring the access to and the movement of the data sets, flow data, generate, based on the flow data, a data flow model including inter-application relationships between the applications, application-data-structure relationships between the applications and the data structures, and inter-data-structure relationships between the data structures, and provide, to a user device, a graphical user interface for display by the user device, where the graphical user interface includes information based on the data flow model.

In some embodiments, the at least one processing device is configured to detect changes in one or more data sets of the data sets, generate, based on detecting the changes in the one or more data sets and for each data set of the one or more data sets, a new unique identifier including the origin information of the data set and information identifying an application, of the applications, that changed the data set, and add, to each data set of the one or more data sets, the new unique identifier generated for the data set.

In some embodiments, the at least one processing device is configured to detect a change in a first data set of the data sets, where a first application of the applications made the change to the first data set, generate, based on detecting the change in the first data set, a new unique identifier including the origin information of the first data set and information identifying the first application, and add the new unique identifier to the first data set.

In some embodiments, the at least one processing device is configured to, when monitoring, based on the unique identifiers, access to and movement of the data sets, inspect payloads of packets comprising the data sets to determine the unique identifiers in the payloads and determine, based on the unique identifiers and for each data set of the data sets, whether an access control is associated with the data set.

In some embodiments, the at least one processing device is configured to receive, from the user device, a query including a first set of applications from the applications, determine, based on the data flow model, first inter-application relationships between the first set of applications, first application-data-structure relationships between the first set of applications and a first set of data structures from the data structures with which the first set of applications has an application-data-structure relationship, and first inter-data-structure relationships between the first set of data structures, generate, based on determining the first inter-application relationships, the first application-data-structure relationships, and the first inter-data-structure relationships, a first data flow model for the first set of applications, and provide, to the user device, a first graphical user interface for display by the user device, where the first graphical user interface includes information based on the first data flow model.

In some embodiments, the unique identifier for each data set includes at least one of an application identifier of an application that generated the data set, information based on a time and date on which the data set was generated, or a randomly generated string of characters unique to the data set.

In some embodiments, the graphical user interface includes a visualization, based on the data flow model, depicting one or more of the applications, one or more of the data structures, one or more of the inter-application relationships, one or more of the application-data-structure relationships, and one or more of the inter-data-structure relationships.

In some embodiments, the at least one processing device is configured to receive, from the user device, a query including a first data set of the data sets and a time period, determine, based on the flow data, a first set of applications, from the applications, and a first set of data structures, from the data structures, where each of the first set of applications and the first set of data structures are associated with access to and the movements of the first data set during the time period, and provide, to the user device, a first graphical user interface for display by the user device, where the first graphical user interface includes information identifying the first set of applications and the first set of data structures.

In some embodiments, the at least one processing device is configured to determine, based on the data flow model, first inter-application relationships between the first set of applications, first application-data-structure relationships between the first set of applications and the first set of data structures, and first inter-data-structure relationships between the first set of data structures and generate, based on determining the first inter-application relationships, the first application-data-structure relationships, and the first inter-data-structure relationships, a first data flow model, and where the first graphical user interface includes information based on the first data flow model.

In some embodiments, the first graphical user interface includes a visualization, based on the first data flow model, depicting the first set of applications, the first set of data structures, the first inter-application relationships, the first application-data-structure relationships, the first inter-data-structure relationships, and movements of the first data set during the time period.

In some embodiments, the visualization, when depicting movements of the first data set during the time period, depicts the first data set using an initial value of a visual characteristic and depicts, after the first data set is changed, the first data set using a second value of a visual characteristic.

In some embodiments, the at least one processing device is configured to, when monitoring access to and movement of the data sets, detect that a first user having a first access control level attempted to transmit a first data set to a second user having a second access control level, determine whether the second access control level is lower than the first access control level, prevent, based on determining that the second access control level is lower than the first access control level, transmission of the first data set to the second user, provide, to a third user, a notification requesting an authorization of the transmission, and permit, based on receiving the authorization from the third user, the transmission of the first data set to the second user.

In some embodiments, the at least one processing device is configured to, when adding the unique identifiers to the data sets, add, for each data set, the unique identifier generated for the data set to a payload for transmitting the data set.

In some embodiments, the at least one processing device is configured to detect a change in a first data set of the data sets, at least one of determine, based on the flow data, whether the change in the first data set is unexpected or determine, based on predetermined rules, whether the change in the first data set is not permitted, and provide, to a user and based on determining that the change in the first data set is unexpected or not permitted, a notification including information associated with the change in the first data set.

In some embodiments, the at least one processing device is configured to, when determining whether the change in the first data set is unexpected, determine, using artificial intelligence, whether the change in the first data set is unexpected.

In another aspect, a computer program product for identifying, tagging, and monitoring data flow in a system environment is presented. The computer program product may include a non-transitory computer-readable medium including code causing a first apparatus to receive data sets generated by applications for storage in data structures, generate unique identifiers for the data sets by generating, for each data set, a unique identifier including origin information of the data set, add the unique identifiers to the data sets by adding, to each data set, the unique identifier generated for the data set, monitor, based on the unique identifiers, access to and movement of the data sets by monitoring the applications accessing the data sets, movement of the data sets from the data structures to the applications, movement of the data sets between the applications, movement of the data sets from the applications to the data structures, and movement of the data sets between the data structures, generate, based on monitoring the access to and the movement of the data sets, flow data, generate, based on the flow data, a data flow model including inter-application relationships between the applications, application-data-structure relationships between the applications and the data structures, and inter-data-structure relationships between the data structures, and provide, to a user device, a graphical user interface for display by the user device, where the graphical user interface includes information based on the data flow model.

In some embodiments, the non-transitory computer-readable medium includes code causing the first apparatus to detect changes in one or more data sets of the data sets, generate, based on detecting the changes in the one or more data sets and for each data set of the one or more data sets, a new unique identifier including the origin information of the data set and information identifying an application, of the applications, that changed the data set, and add, to each data set of the one or more data sets, the new unique identifier generated for the data set.

In some embodiments, the non-transitory computer-readable medium includes code causing the first apparatus to detect a change in a first data set of the data sets, where a first application of the applications made the change to the first data set, generate, based on detecting the change in the first data set, a new unique identifier including the origin information of the first data set and information identifying the first application, and add the new unique identifier to the first data set.

In some embodiments, the non-transitory computer-readable medium includes code causing the first apparatus to, when monitoring, based on the unique identifiers, access to and movement of the data sets, inspect payloads of packets including the data sets to determine the unique identifiers in the payloads and determine, based on the unique identifiers and for each data set of the data sets, whether an access control is associated with the data set.

In yet another aspect, a method for identifying, tagging, and monitoring data flow in a system environment is presented. The method may include receiving data sets generated by applications for storage in data structures, generating unique identifiers for the data sets by generating, for each data set, a unique identifier including origin information of the data set, adding the unique identifiers to the data sets by adding, to each data set, the unique identifier generated for the data set, monitoring, based on the unique identifiers, access to and movement of the data sets by monitoring the applications accessing the data sets, movement of the data sets from the data structures to the applications, movement of the data sets between the applications, movement of the data sets from the applications to the data structures, and movement of the data sets between the data structures, generating, based on monitoring the access to and the movement of the data sets, flow data, generating, based on the flow data, a data flow model including inter-application relationships between the applications, application-data-structure relationships between the applications and the data structures, and inter-data-structure relationships between the data structures, and providing, to a user device, a graphical user interface for display by the user device, where the graphical user interface includes information based on the data flow model.

The features, functions, and advantages that have been discussed may be achieved independently in various embodiments of the present invention or may be combined with yet other embodiments, further details of which can be seen with reference to the following description and drawings.

