Data Leak Detection

Abstract

Detecting data leakage by detecting a user input in a first form, the user input satisfying a set of requirements, storing the user input in a memory, generating a composite input satisfying the set of requirements, transmitting a second form including the composite input, searching a resource for the composite input, determining whether the composite input is present in the resource according to the search, and acting based on the determination.

Description

[Technical Field]

[0001] FIELD OF THE DISCLOSURE The present disclosure relates generally to detecting local data leaks, and more particularly to detecting local password data leaks. [Background technology]

[0002] Computer system data, including user password data, can be compromised at a local level by malicious software. Such software captures the data and provides it to malicious actors. Submission of the data over network resources further exposes the data. Such exposure can also lead to capture of the data by malicious code monitoring network data transfers. Summary of the Invention

[0003] The following presents a summary to provide a basic understanding of one or more embodiments of the present disclosure. This summary is not intended to identify key or critical elements or to delineate the scope of particular embodiments or the claims. Its sole purpose is to present concepts in a simplified form as a prelude to the more detailed description that is presented later. In one or more embodiments described herein, a device, system, computer-implemented method, apparatus, and / or computer program product enables data leakage detection.

[0004] Aspects of the present invention disclose methods, systems, and computer-readable media associated with detecting data leakage by detecting user input in a first form, the user input meeting a set of requirements, storing the user input in a memory, generating a composite input meeting the set of requirements, transmitting a second form including the composite input, searching a resource for the composite input, determining whether the composite input is present in the resource according to the search, and acting based on the determination.

[0005] According to one aspect, a computer-implemented method for detecting data leakage is provided, the method comprising: one or more computer processors detecting user input in a first form, the user input satisfying a set of requirements; one or more computer processors storing the user input in a memory; one or more computer processors generating a composite input that satisfies the set of requirements; one or more computer processors transmitting a second form including the composite input; one or more computer processors searching a resource for the composite input; one or more computer processors determining, according to the search, whether the composite input is present in the resource; and one or more computer processors acting based on the determination.

[0006] According to another aspect, there is provided a computer program product for detecting data leakage, the computer program product comprising one or more computer-readable storage devices and program instructions collectively stored on the one or more computer-readable storage devices, the stored program instructions including: program instructions for detecting user input in a first form, the user input satisfying a set of requirements; program instructions for storing the user input in a memory; program instructions for generating a composite input satisfying the set of requirements; program instructions for transmitting a second form including the composite input; program instructions for searching resources for the composite input; program instructions for determining, following the search, whether the composite input is present in the resources; and program instructions for acting based on the determination.

[0007] According to another aspect, there is provided a computer system for detecting data leakage, the computer system comprising: one or more computer processors; one or more computer-readable storage devices; and program instructions stored on the one or more computer-readable storage devices for execution by the one or more computer processors, the stored program instructions including: program instructions for detecting user input in a first form, the user input satisfying a set of requirements; program instructions for storing the user input in a memory; program instructions for generating a composite input that satisfies the set of requirements; program instructions for transmitting a second form including the composite input; program instructions for searching resources for the composite input; program instructions for determining, following the search, whether the composite input is present in the resources; and program instructions for acting based on the determination. [Brief explanation of the drawings]

[0008] The above and other objects, features, and advantages of the present disclosure will become more apparent through a more detailed description of several embodiments of the present disclosure in the accompanying drawings, in which like reference numerals generally refer to like components in the embodiments of the present disclosure.

[0009] [Figure 1] 1 provides a schematic diagram of a computing environment according to one embodiment of the present invention.

[0010] [Figure 2] 1 provides a flow chart illustrating a sequence of operations according to one embodiment of the present invention.

[0011] [Figure 3] 1 illustrates a cloud computing environment according to one embodiment of the present invention.

[0012] [Figure 4] 1 illustrates an abstraction model layer according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0013] Some embodiments will now be described in more detail with reference to the accompanying drawings, which illustrate embodiments of the present disclosure. However, the present disclosure may be implemented in various ways and therefore should not be construed as limited to the embodiments disclosed herein.

[0014] There are multiple ways that passwords can be compromised from the local system where they were exposed. Many existing techniques for preventing password leakage prevent passwords from being compromised "on the wire" while they are being transmitted to a remote party in a man-in-the-middle attack, but do not ensure that the destination location to which they are being sent is valid and that the password has not been compromised on the local system. Existing techniques for preventing local attacks include detecting malicious code being executed through program signatures and detecting known malicious behavior. The disclosed embodiments enable data leakage detection in a more targeted manner, reducing the need to detect signatures on the program itself. Instead, the disclosed embodiments detect specific behaviors associated with the compromise of sensitive data.

[0015] Aspects of the present invention generally relate to detecting data leaks in networked computing environments. Such environments include multiple computer systems connected by one or more network communication technologies. System users provide user password data to access system resources. Compromised network and system resources may capture user password data and share such captured data with one or more malicious actors. Malicious software captures user password data when it is entered by a user or when it is submitted across or received by a network resource. Such code stores the captured code for further transmission and use by malicious actors. The disclosed embodiments enable detection of data leaks, including leaks associated with malicious software.

[0016] Embodiments detect a user's input of password data in completing a login form. Embodiments store the user data entry form and generate a synthetic replacement of the user data. The user data and the synthetic replacement each meet the requirements of the user password data. Embodiments transmit a second version of the data entry form, this version including the synthetic data rather than the actual sensitive user data. Concurrent with the generation and submission of the synthetic data, the disclosed embodiments begin monitoring local and networked resources, including network data traffic. The monitoring also includes scanning memory resources for variants including the synthetic data and commands for writing the synthetic data to memory resources or transmitting the synthetic data over communication channels. Embodiments compile detected attempts to exfiltrate the synthetic data in a report for the user and / or system administrator and alert the user that transmitting the user password data is insecure. For example, if resource and transmission monitoring fails to detect an attempt to exfiltrate data, embodiments transmit a stored form including the actual sensitive user password data to facilitate user authentication and enable the user access to desired resources.

[0017] According to an aspect of the present invention, there is a method for automatically detecting data leakage. The method includes monitoring system activity to detect an attempt by a user to submit sensitive data, such as password data, as part of a network interaction. A user may fill out an authentication form by entering their user ID and password data. The method detects the input form and password data. The method locally captures and stores the completed authentication form. The method generates synthetic password data and submits a second version of the authentication form, this version including the synthetic data. The method monitors local memory resources and network resources, including network transmissions, for variants of the synthetic data. Detection of the synthetic data in the local memory resources and / or network resources provides an indication of a potential data leakage. Analysis of the detected data determines whether an attempt to leak data has occurred or whether the detected data represents normal data usage. The occurrence of a leakage is reported to system users and administrators. Failure to detect an abnormal occurrence of synthetic data provides an indication that no attempt to leak data has occurred. The system passes the stored form including the authenticated user password data for user access authentication.

[0018] Aspects of the present invention provide an improvement in the art of data leakage detection by receiving authenticated user data, generating a composite set of data meeting arbitrary data requirements, and transferring the composite data using normal communication channels. The method withholds the authenticated user data from disclosure at this point in the processing timeline. Monitoring system activity reveals attempts to leak sensitive data without exposing the actual sensitive data. Detected attempts are summarized and reported, and disclosure of the authentication data is withheld pending resolution of the compromised system aspects. Successful transmission of the synthetic data, i.e., without detection of data leakage, results in transmission of the authenticated user data for authentication, enabling user access.

[0019] Aspects of the present invention also provide improvements to computer functionality. In particular, implementations of the present invention are directed to specific improvements to the way data communication channels are verified as secure. The disclosed method verifies such channels by submitting data entry forms containing synthetic data rather than actual sensitive data, and monitoring system activity, including memory write operations and data transmissions, for evidence that the synthetic data has been mishandled or otherwise compromised. Detecting data mishandling leads to identifying compromised system aspects, and uncovering these compromised aspects results in a secure communication channel.

[0020] In one embodiment, one or more components of the system may employ hardware and / or software to solve problems that are highly technical in nature (e.g., detecting user input of sensitive information in a first form, generating synthetic information that meets a set of requirements associated with the sensitive information, transmitting a second version of the form that includes the synthetic information rather than the sensitive information, monitoring system and network activity for traces of the synthetic information, acting on the results of the monitoring activities, etc.). These solutions are not abstract and cannot be implemented as a set of human mental acts due, for example, to the processing power required to facilitate data leak detection. Furthermore, some of the processes implemented may be performed by a computer dedicated to performing defined tasks related to detecting sensitive data leaks. For example, a dedicated computer may be employed to perform tasks related to data leak detection, etc.

[0021] In overview, embodiments detect the leakage of local passwords or other sensitive information by temporarily inserting a "searchable" string into a field where this information is entered. After submitting the inserted input, a scan of local memory and outgoing network data packets begins looking for the inserted "searchable" string. The method generates reports and / or alerts based on the scan findings to determine whether any malicious attempts to siphon sensitive information to a third-party server or application have occurred on the user's local machine. The user may take corrective action based on the report to remove or quarantine malicious software, etc.

[0022] Unlike existing methods, the disclosed embodiments do not rely on detecting known signatures associated with keyloggers or viruses, or known hooks that attempt to connect to an operating system. The embodiments detect value leakage, where the leaked value constitutes only non-sensitive synthetic data, not sensitive user data. Data leakage can include writing captured data to memory and transmitting captured data using network resources.

[0023] In one embodiment, a computer-implemented method for detecting data leakage includes detecting user activity associated with entering sensitive data, such as user personal identification information or user authentication data, such as passwords and user ID data. Such user activity includes filling out one or more data entry forms with the sensitive data. In one embodiment, the method scans the user activity for keywords such as "user ID," "password," "account number," "social security number," etc., as indicators that the user is submitting sensitive data to an application.

[0024] As an example, the method detects a user completing a user login form that includes data entry fields labeled "User ID" and "Password" by entering the user's user ID and user password data into the login data entry form. In this example, the user data conforms to the field requirements associated with the user ID and user password. In this embodiment, the method detects the activity, captures the completed sensitive data entry form that includes the user data, and stores the completed data entry form for later use. In one embodiment, the method stores the completed data entry form in local memory.

[0025] The method generates synthetic data that corresponds to the sensitive user data and complies with any data field requirements. As an example, a user password must contain 16 characters, including uppercase letters, lowercase letters, numbers, and special characters. For this example, the method generates synthetic user password data that complies with the user password requirements. In one embodiment, the method analyzes the character composition of the user input and generates one or more random character strings that have the same composition in terms of number and type of characters as the sensitive user data string. For the above example, the analysis indicates that the user password contains 16 characters, including uppercase letters, lowercase letters, numbers, and special characters. The method then generates random character strings that have the characteristics discovered by the analysis. The method uses the synthetic data generated based on the characteristics of the sensitive user data to populate a blank copy of a data entry form (i.e., a login form). The method stores the values ​​of the generated synthetic data for use in scanning resources for data leaks.

[0026] In one embodiment, the method begins monitoring local system memory usage and network data transmissions when or after populating a data entry form with the synthetic data. The method monitors data packet content and write commands and memory locations targeted by the write commands, and evaluates data written to memory, prepared for transmission, and / or transmitted over one or more networks after monitoring begins and following populating and submitting the data entry form with the synthetic data.

[0027] In one embodiment, the method transmits the data entry form populated with the synthetic data using a standard communication channel for forms, such as Transmission Control Protocol (TCP) data packet transmission or other data communication protocol. In this embodiment, the method continues monitoring memory operations and data prepared for outbound transmission over the network. Following transmission of the form containing the synthetic data, the method scans for data leakage by monitoring memory write commands and outbound data packets for the synthetic data string.

[0028] The method scans system memory resources and network communication traffic until one of three things occurs. First, scanning stops after all relevant memory and communication resources have been scanned and no indication of malicious use of the synthetic string has been found. In such a case, the method then submits the original data entry form containing the user's sensitive data, such as to continue the user's attempt to authenticate the user's access to network resources. Second, scanning stops after a defined time limit deemed sufficient to detect a malicious attempt to utilize the synthetic data generated by the method and transmitted using an alternate data entry version of the form. In such a case, because the method has not detected a data leak, the method retransmits the original data entry form containing the sensitive user information. A third possibility involves detecting malicious use of the synthetic data string by detecting an attempt to write the string to local memory or the inclusion of the synthetic string in an outbound communication packet. In such a case, the method retains the original data entry form and the user's sensitive information rather than submitting the form as part of the authentication process. The user's sensitive data remains secure through the system and method. In one embodiment, the method alerts a user and / or system administrator to inform them of malicious attempts to capture synthetic strings and provides details regarding any such attempts. In this embodiment, the method does not submit the original data entry form containing sensitive user data, thereby halting the authentication process. In one embodiment, the method maintains an ongoing log of all such attempts, along with details of the system resources involved in the attempt. In one embodiment, the method communicates the log to network management resources as well as local users. In one embodiment, the method further records the scan attempt, which did not detect synthetic data in the scanned resources, indicating no data was leaked.

[0029] In one embodiment, a user attempts to submit a data entry form after correcting issues identified in a provided alert and / or malicious activity report. In this embodiment, when or after the user resubmits the data entry form, the method detects the attempt to submit sensitive data, captures the original data entry form, generates synthetic data, populates a second version of the data entry form, begins monitoring system memory and communication resources, submits the second version of the form including the synthetic non-sensitive data, and, depending on the results of the monitoring, proceeds as described above.

[0030] Concurrent with generating synthetic data, populating a data entry form with the synthetic data, and submitting the populated data entry form, the method begins monitoring system resources correlated with malicious data capture activity. Such resources include memory resources, network communication resources and traffic content, and processor command stacks. Resources may be checked sequentially or prioritized according to associated commands, such as write or transmit commands. After discovering a synthetic data string through monitoring, the method evaluates the details of the detection against expected system activity. As an example, submitting a password as part of a user authentication process has an expected data handling progression associated with it. The entered data follows a defined path associated with authentication, such as a forked web browser containing a data entry field. Detection of synthetic data in a location other than a communication channel and memory location associated with the authentication application's known, defined data path triggers an alert associating the detected synthetic data with malicious activity. Scanning continues until all resources have been scanned or the scan period reaches a defined scan time limit.

[0031] In one embodiment, the method scans network stack resources. For example, the method scans buffers and / or packets transmitted after submission of a second form containing the composite data. In one embodiment, the method monitors data transmitted over a network by the local system after submitting the form.

[0032] Detection of synthetic strings in buffers, packets, or otherwise in network data traffic triggers alert, reporting, and logging functions, as described above. In one embodiment, the method validates detected transmissions of synthetic data against transmission expectations associated with the associated authentication application. Deviations from the expected transmission of data trigger alert, reporting, and logging functions. A detected data leak further triggers a sub-process that collects relevant information about the detected synthetic string, the associated application, and the data dump that includes the initiated synthetic string.

[0033] The disclosed embodiments may be configured to detect user password entry as well as entry of other sensitive information such as user personal identity data or financial data such as user financial account data. The disclosed embodiments may be integrated with password management applications to better define expected data handling of password data after submission and prevent false triggering of alerts for data mishandling.

[0034] FIG. 1 provides a schematic diagram of exemplary network resources associated with practicing the disclosed invention. The invention may be practiced in any processor of the disclosed elements that processes instruction streams. As shown in the figure, networked client device 110 wirelessly connects to server subsystem 102. Client device 104 wirelessly connects to server subsystem 102 via network 114. Client devices 104 and 110 include a data leak detection program (not shown) along with sufficient computing resources (processor, memory, network communications hardware) to execute the program. Client devices 104 and 110 provide user access to the data leak detection program, which may be locally connected to these devices when the user interacts with additional networked resources shown in the figure. As shown in FIG. 1, server subsystem 102 includes server computer 150. FIG. 1 illustrates a block diagram of components of server computer 150 within networked computer system 1000, according to one embodiment of the present invention. It should be understood that FIG. 1 provides only an example of one implementation and does not imply any limitation with regard to the environments in which different embodiments may be implemented. Many modifications can be made to the environment shown.

[0035] Server computer 150 may include processor 154, memory 158, persistent storage 170, communications unit 152, input / output (I / O) interface 156, and communications fabric 140. Communications fabric 140 provides communication between cache 162, memory 158, persistent storage 170, communications unit 152, and input / output (I / O) interface 156. Communications fabric 140 may be implemented with any architecture designed to pass data and / or control information between a processor (such as a microprocessor, communications and network processor), system memory, peripheral devices, and any other hardware components in the system. For example, communications fabric 140 may be implemented using one or more buses.

[0036] Memory 158 and persistent storage 170 are computer-readable storage media. In this embodiment, memory 158 includes random access memory (RAM) 160. Generally, memory 158 may include any suitable volatile or non-volatile computer-readable storage medium. Cache 162 is high-speed memory that enhances the performance of processor 154 by holding recently accessed and near-recently accessed data from memory 158.

[0037] Program instructions and data used to practice embodiments of the present invention, such as data leak detection program 175, are stored in persistent storage 170 for execution and / or access by one or more of the respective processors 154 of server computer 150 via cache 162. In this embodiment, persistent storage 170 includes a magnetic hard disk drive. Alternatively, or in addition to a magnetic hard disk drive, persistent storage 170 may include a solid-state hard drive, a semiconductor storage device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0038] The media used by persistent storage 170 may also be removable. For example, a removable hard drive may be used for persistent storage 170. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer to another computer-readable storage medium that is also part of persistent storage 170.

[0039] Communications unit 152 provides for communication with other data processing systems or devices, including resources of client computing devices 104 and 110, in these examples. In these examples, communications unit 152 includes one or more network interface cards. Communications unit 152 may provide communication through the use of either or both physical and wireless communications links. Software distribution programs and other programs and data used in implementing the present invention may be downloaded to persistent storage 170 of server computer 150 via communications unit 152.

[0040] I / O interface 156 allows for the input and output of data with other devices that may be connected to server computer 150. For example, I / O interface 156 may provide connection to external devices 190, such as a keyboard, keypad, touchscreen, microphone, digital camera, and / or any other suitable input device. External devices 190 may also include portable computer-readable storage media, such as thumb drives, portable optical or magnetic disks, and memory cards. Software and data used to practice embodiments of the present invention, such as data leak detection program 175 on server computer 150, may be stored on such portable computer-readable storage media and loaded into persistent storage 170 via I / O interface 156. I / O interface 156 also connects to display 180.

[0041] Display 180 provides a mechanism for displaying data to a user and may be, for example, a computer monitor. Display 180 may also function as a touch screen, such as the display of a tablet computer.

[0042] 2 provides a flowchart 200 illustrating exemplary activities associated with practicing the present disclosure. After program initiation, at block 210, a data leak detection program 175 executing through a computing environment such as that shown in FIG. 1 detects user entry of sensitive information, such as user password information, through a first copy of a data entry form. In one embodiment, the method monitors user activity to enable detection of such attempted data entry. In one embodiment, the data leak detection program 175 executes as a shell program under the operating system that monitors user interaction with other running applications.

[0043] At block 220, the method of the data leak detection program 175 generates synthetic data corresponding to the user sensitive data and meeting any requirements of the sensitive data. The method uses the generated synthetic data to populate a second copy of the data entry form. The method tracks the value of the generated synthetic data for use in scanning resources for leak detection.

[0044] At block 230, the method begins monitoring system resources, such as system processor commands, system memory contents, and network traffic contents, for the presence of the synthetic data string. At block 240, concurrent with the initiation of resource monitoring, the method transmits a second copy of the data entry form including the synthetic data.

[0045] At block 250, the methods of the data leak detection program 175 determine whether synthetic data is present in monitored resources, such as system processor commands, memory resources, and network traffic. The methods scan the resources for data that matches the generated synthetic data string. In one embodiment, scanning continues until all methods have scanned all relevant resources or until a predetermined scan period has expired.

[0046] At block 260, the method takes appropriate action based on detecting the presence of the generated synthetic data string in the scanned resource. For example, the method evaluates the detected synthetic data against expected activity for data entered through a form. The method notes expected application and network traffic associated with legitimate use of the entered data without triggering an alert for malicious activity. For data activity other than expected activity, the method captures details about the activity, such as the nature of the associated application and network traffic, i.e., sender and recipient, for inclusion in an alert and activity log to the user and / or system administrator.

[0047] For example, if the method fails to detect synthetic data after scanning all relevant resources or after scanning for a defined scanning period, the method submits a saved original copy of the data entry form, including the sensitive information entered by the user. In such cases, the method optionally further updates an event log indicating the occurrence of the scan without detecting synthetic data.

[0048] Although this disclosure includes detailed descriptions related to cloud computing, it should be understood that implementation of the teachings recited herein is not limited to a cloud computing environment. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0049] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0050] The characteristics are as follows:

[0051] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed, without requiring human interaction with the provider of the service.

[0052] Wide network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs).

[0053] Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge over the exact location of the provided resources, although there is a type of location independence in that they may be able to specify location at a higher level of abstraction (e.g., country, state, or data center).

[0054] Rapid scalability: Capacity is provisioned quickly and elastically, sometimes automatically, and can be instantly scaled out or quickly released and instantly scaled in. To the consumer, the capacity available for provisioning often appears unlimited and can be purchased in any quantity at any point in time.

[0055] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of utilized services.

[0056] The service models are as follows: Software as a Service (SaaS): The consumer is offered the ability to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through a thin-client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS): The consumer is offered the ability to deploy consumer-created or acquired applications, created using programming languages ​​and tools supported by the provider, on the cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration. Infrastructure as a Service (IaaS): The ability provided to consumers is to provision processing, storage, network, and other basic computing resources, on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0057] Deployment models are as follows: Private Cloud: The cloud infrastructure operates solely for an organization. It may be managed by the organization or a third party and may exist on-premises or off-premises. Community Cloud: The cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It may be managed by those organizations or a third party and may exist on-premises or off-premises. Public Cloud: The cloud infrastructure is made available to the general public or large industry groups and is owned by an organization that sells cloud services. Hybrid Cloud: The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are joined by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0058] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0059] Referring now to FIG. 3, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers can communicate, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N. The nodes 10 may communicate with each other. They may be physically or virtually grouped (not shown) in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or a combination thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as a service for which cloud consumers do not need to maintain resources on their local computing devices. It is understood that the types of computing devices 54A-54N shown in FIG. 3 are intended to be illustrative only, and that the computing nodes 10 and the cloud computing environment 50 may communicate with any type of computerized device (e.g., using a web browser) over any type of network and / or network-addressable connection.

[0060] Referring now to Figure 4, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 3) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 4 are intended to be merely exemplary, and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0061] Hardware and software layer 60 comprises hardware and software components. Examples of hardware components include mainframe 61; RISC (reduced instruction set computer) architecture-based server 62; server 63; blade server 64; storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0062] The virtualization layer 70 provides an abstraction layer over which the following examples of virtual entities can be provided: virtual servers 71; virtual storage 72; virtual networks, including virtual private networks 73; virtual applications and operating systems 74; and virtual clients 75.

[0063] In one example, management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification of cloud consumers and tasks, as well as protection of data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides proactive provisioning and procurement of cloud computing resources in anticipation of future requirements according to SLAs.

[0064] The workload tier 90 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this tier include mapping and navigation 91; software development and lifecycle management 92; virtual classroom instructional delivery 93; data analytics processing 94; transaction processing 95; and data leak detection programs 175.

[0065] The present invention may be a system, method and / or computer program product integrated at any possible level of technical detail. The present invention may be advantageously practiced in any system, single or parallel, that processes instruction streams. A computer program product may include a computer-readable storage medium (or media) having stored thereon computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0066] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves in which instructions are recorded, and any suitable combination of the foregoing. Computer-readable storage medium or computer-readable storage device, as used herein, is not to be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted over a wire.

[0067] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may comprise copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium in the respective computing / processing device for storage.

[0068] The computer-readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, C++, etc., and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to perform aspects of the present invention.

[0069] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0070] These computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, when executed by the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored within a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner, such that the computer-readable storage medium on which the instructions are collectively stored comprises an article of manufacture containing instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0071] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be executed on the computer, other programmable apparatus, or other device to generate a computer-implemented process, whereby the instructions executing on the computer, other programmable apparatus, or other device implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0072] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may in fact be executed substantially concurrently, or in some cases, the blocks may be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified functions or operations, or that executes a combination of dedicated hardware and computer instructions.

[0073] References herein to "one embodiment," "one embodiment," "one exemplary embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but that not all embodiments necessarily include the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Furthermore, if a particular feature, structure, or characteristic is described in connection with one embodiment, it is believed to be within the knowledge of one skilled in the art to affect such feature, structure, or characteristic in connection with other embodiments, whether or not explicitly described.

[0074] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should be further understood that the terms "comprises" and / or "comprising," when used herein, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0075] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the present invention. The terms used herein have been selected to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. one or more computer processors detecting user input in a first form, said user input meeting a set of requirements; the one or more computer processors storing the user input in a memory; generating a synthetic input that satisfies the set of requirements; transmitting, by the one or more computer processors, a second form including the composite input; the one or more computer processors searching resources for the composite input; the one or more computer processors determining, according to the search, whether the composite input is present in the resource; and the one or more computer processors acting based on the determination.

1. A computer-implemented method for detecting data leakage, comprising:

2. The computer-implemented method of claim 1 , wherein the resources include resources selected from the group consisting of system memory resources, network communication resources, and combinations thereof.

3. The computer-implemented method of claim 1 or 2, wherein the set of requirements relates to user password requirements.

4. the one or more computer processors detecting the composite input in the resource; and generating an alert associated with the composite input among the resources by the one or more computer processors; The computer-implemented method of claim 1 or 2, further comprising:

5. The computer-implemented method of claim 4 , wherein the user input includes a user password, further comprising stopping a user authentication process.

6. the one or more computer processors failing to detect the composite input in the resource; and the one or more computer processors submitting the first form including the user input. The computer-implemented method of claim 1 or 2, further comprising:

7. 3. The computer-implemented method of claim 1, wherein retrieving a resource comprises retrieving a memory resource that is the target of a write command following submitting the first form including the composite input.

8. A computer processor comprising: detecting user input in a first form, said user input satisfying a set of requirements; storing the user input in a memory; generating synthetic inputs that satisfy said set of requirements; transmitting a second form including the composite input; searching resources for said synthesis input; determining whether the synthesis input exists in the resource according to the search; and A procedure for taking action based on the determination A computer program for detecting data leaks, for executing

9. 9. The computer program product of claim 8, wherein the resources include resources selected from the group consisting of system memory resources, network communication resources, and combinations thereof.

10. 10. A computer program according to claim 8 or 9, wherein the set of requirements relates to user password requirements.

11. the computer processor: detecting the synthesis input in the resource; and generating an alert associated with the synthetic input in the resource; 10. The computer program according to claim 8 or 9, further comprising:

12. The computer program product of claim 11 , wherein the user input includes a user password, further causing the computer processor to perform the steps of: stopping a user authentication process.

13. the computer processor: submitting the first form including the user input after failing to find the composite input in the resource.

10. The computer program according to claim 8 or 9, further comprising:

14. 10. A computer program product as claimed in claim 8 or 9, wherein the step of retrieving a resource comprises, following the step of submitting the first form including the composite input, a step of retrieving a memory resource that is the target of a write command.

15. one or more computer processors; one or more computer-readable storage devices; and program instructions stored on the one or more computer-readable storage devices for execution by the one or more computer processors; wherein the stored program instructions: program instructions for detecting user input in a first form, said user input meeting a set of requirements; program instructions for storing said user input in a memory; program instructions for generating a synthetic input that satisfies said set of requirements; program instructions for transmitting a second form including the composite input; program instructions for searching resources for said composite input; program instructions for determining whether the composite input exists in the resource according to the search; and program instructions for acting based on said determination; 1. A computer system for detecting data leakage, comprising:

16. 16. The computer system of claim 15, wherein the resources include resources selected from the group consisting of system memory resources, network communication resources, and combinations thereof.

17. 17. A computer system according to claim 15 or 16, wherein the set of requirements relates to user password requirements.

18. The stored program instructions include: program instructions for detecting the composite input in the resource; and program instructions for generating an alert associated with the composite input among the resources; 17. A computer system according to claim 15 or 16, further comprising:

19. 20. The computer system of claim 18, wherein the user input includes a user password, and further comprising a procedure for terminating a user authentication process.

20. The stored program instructions include: program instructions for submitting the first form including the user input after failing to find the composite input in the resource; 17. A computer system according to claim 15 or 16, further comprising:

Images