Information leakage prevention system and information leakage prevention method

Abstract

The invention relates to computing. An information leakage prevention system comprises a server, wherein an intercept subsystem is set up for each data transfer channel, and each intercepted message transfer event or document access event is transmitted to a data extraction subsystem which constructs a parse tree of the event. The root of said parse tree is comprised of the intercepted document, and the other nodes contain information transmitted in the intercepted document, the information in which is in text or image form. The result obtained by the event data extraction subsystem is transmitted to an event data analysis subsystem which analyzes the received data using analysis technologies. The result obtained by the event data analysis subsystem is transmitted to a security policy application subsystem, where security policies apply a security policy configuration to the properties of the intercepted data by comparing policy values with the data analysis result and other event attributes. The technical result consists in reducing the time taken to identify a complete scenario of the development of events that are potentially capable of leading to the leakage of sensitive information.

Description

[0001] Information leakage prevention system and information leakage prevention method

[0002] AREA OF TECHNOLOGY

[0003] The invention relates to computing technology and the field of information security through the use of a subsystem for intercepting transmitted data in a system for preventing information leakage, while dividing events into groups and forming new groups of events for automatically determining types of violations.

[0004] LEVEL OF TECHNOLOGY

[0005] The prior art includes means for protecting the perimeter of a local (corporate) computer network, hardware and software systems that monitor and filter network packets passing through them in accordance with specified rules for the security of services provided over the network and, in particular, perform the detection of documents and images, protection against the loss of documents, and identification based on images when using security services.

[0006] An analogue of the proposed solution is the "System for protecting computer networks from unauthorized access" disclosed in patent RU 2763115, IPC G06F 21 / 55, G06N 20 / 00, published on 27.12.2021. In this case, a method for adjusting the parameters of a machine learning model to determine false positives and information security incidents (hereinafter referred to as incidents), in which the verdicts for a certain part of information security events (hereinafter referred to as the first set of events) with the verdict "false positive" are changed to "incident" verdicts, where the verdicts for events are determined using a machine learning model to determine false positives and / or incidents, wherein the first set of events is selected, in particular, randomly from among the events with the verdict "false positive", and such a number of events of the first set are selected that does not exceed the second threshold, which is a parameter of the machine learning model;sending at least a portion of the events of the first set of events to the analytical center for analysis; using the results of the analysis, containing the verdicts made on the events sent for analysis, adjusting the parameters of the machine learning model to identify false positives and / or incidents.

[0007] A data loss prevention system "Data loss prevention expression building for a DLP engine" is known, disclosed in patent US 11455407, IPC G06F 21 / 62, GO6F 21 / 60, published on 20.10.2003, which describes methods and systems that include obtaining an expression for a data loss prevention (DLP) engine, wherein the expression includes one or more DLP dictionaries providing an assessment for comparison with an appropriate threshold, and one or more logical operators used to combine assessments of one or more DLP dictionaries; storing the expression in a database associated with a DLP service; monitoring traffic from one or more users; assessing traffic using the DLP engine and the expression; and determining a DLP trigger based on the result of the expression, which is a logical value.

[0008] For the analysis of text data, the following methods are known from the prior art: a) copyright analysis of text data assumes the presence of reference documents in a database (e.g., important contracts), and solves the problem of searching for quotations in traffic, which will be the result of this analysis. There are several variants of copyright analysis, each of which focuses on different information features; for example, the analysis of database extracts is oriented towards processing tabular data. Examples of the use of copyright analysis are disclosed in patent documents RU2581766C2, RU2013122217A, RU2474870C1, US9852122B2; b) a text classifier solves the problem of describing the topics of the analyzed data. Typically, this description is formed using a collection of documents on a single topic (e.g., financial reports). Based on this collection, the classifier is trained and, during analysis, can assign the obtained text to one of the specified categories.An example of using a text classifier is disclosed in patent application RU2012102484A; c) text analysis using pattern matching is disclosed in patent application RU2012104987A. With this approach, the subsystem identifies text patterns of interest to the security officer. Patterns are defined using regular expressions. For example, a pattern could be defined that describes all possible entries for a credit card number. A unique feature of the system is the ability to write a verification function. The resulting set of digits, which resembles a credit card number, can be passed to the verification function, which will calculate a checksum for the given card using the Luhn algorithm (an algorithm for calculating the check digit of a plastic card number in accordance with the ISO / IEC 7812 standard) and compare it with the last digit of the card number; they must match.To analyze binary files (all file formats except text and graphic, including those that the system was unable to identify), a copyright analysis is performed, for example, as in patent document RU2014107495A, which assumes that the user has specified a set of binary (not text and not graphic) reference files to the system, the search for fragments of which is performed in the intercepted data analysis subsystem during the analysis of intercepted traffic.

[0009] For the analysis of graphic data in vector images, the prior art includes, for example, methods of copyright analysis disclosed in patents RU2633156C1, EA201700283A1 and an algorithm similar to those described above.

[0010] Graphic data in raster images, as described in the prior art, for example in patent documents RU2633159C1, EA201700282A1, can also be analyzed using copyright analysis.

[0011] Searching for a small image in a large one is described in patent document EA040186B1, which discloses searching for payment system logos in all images and allows for the detection of the transfer of credit card photographs.

[0012] Patent document RU2556461C2 discloses a technology for searching for seals in images, which involves loading reference seals and searching for them across all intercepted traffic.

[0013] Thus, well-known data collection methods include the use of dictionaries and DLP mechanisms. These approaches are used to detect precise data matches by tagging specific keywords and data classes. For example, DLP can detect social security numbers and credit card numbers based on the data format, such as in structured documents. DLP can also detect specific keywords in DLP dictionaries. However, DLP has difficulty working with unstructured documents. Unstructured documents are precisely what is critical for information leaks, as they are typically free-form and lack a predetermined structure.

[0014] The main drawback of known analogs is that they do not additionally use event grouping to prevent leaks of unstructured documents, nor do they create new groups to automatically identify violation types. This allows for thematic event groups with varying levels of accuracy and the assignment of events not previously reflected in security policies to these groups. This improves the level of information leak prevention.

[0015] DISCLOSURE OF THE INVENTION

[0016] The technical result of the invention consists in expanding the arsenal of technical means and systems for preventing information leakage (hereinafter referred to as the DLP system) through the use of dividing events into groups and forming new groups of events for automatically determining types of violations.

[0017] The specified technical result is achieved by a data leakage prevention system, which contains:

[0018] - at least one server on which the server part of the DLP system is installed, connected to at least one terminal device;

[0019] - the DLP system contains:

[0020] - a subsystem for intercepting events on the user's terminal device and / or the server part of the DLP system; - a subsystem for extracting data from intercepted events on the user's terminal device and / or the server part of the DLP system;

[0021] - a subsystem for analyzing intercepted data from events on the user’s terminal device and / or the server part of the DLP system;

[0022] - a subsystem for storing intercepted data and the results of applying policies on the user's terminal device and / or the server part of the DLP system

[0023] - a subsystem for grouping intercepted data on the server part of the DLP system;

[0024] - a subsystem for applying security policies to intercepted data on the user’s terminal device and / or the server part of the DLP system;

[0025] - a database for storing intercepted data on the server side of the DLP system; a user interface subsystem for displaying the results of the DLP system's operation and its configuration on the server side of the DLP system; in this case, the servers of the data leak prevention system must be available for sending analyzed data, and an interception subsystem is configured for each data transmission channel.

[0026] Each intercepted message transmission or document access event is passed to the data extraction subsystem, which constructs an event parse tree. The root of the parse tree is the intercepted document, and the remaining nodes contain the information transmitted within the intercepted document, which represents text or an image. The results of the event data extraction subsystem are passed to the event data analysis subsystem, which analyzes the received data using analysis technologies.

[0027] The results of the event data analysis subsystem are transferred to the security policy application subsystem, where security policies apply the security policy configuration to the properties of the intercepted data by comparing the policy values ​​with the results of the data analysis and other event attributes.

[0028] In a preferred embodiment, the data leak prevention system obtains additional attributes that subsequently make it possible to quickly search for similar texts or quickly group similar documents to identify new categories of information or clarify existing ones.

[0029] In a preferred embodiment, the data leakage prevention system transmits the results of the security policy application subsystem to the subsystem for storing intercepted data and policy application results.

[0030] In a preferred embodiment, the data leak prevention system stores the results of subsystem operation, settings, configurations, and event responses in a database.

[0031] In one embodiment, the system includes a graphical user interface to which work results are sent for review by a system administrator.

[0032] A server-based data leak prevention method involves configuring an interception subsystem for each data transmission channel. Each message transmission or document access event is intercepted and fed into a data extraction subsystem, which constructs a parse tree for the event. The root of the parse tree is the intercepted document, and the remaining nodes contain the information transmitted within the intercepted document, which contains text or images.

[0033] The result of the work of the event data extraction subsystem is transferred to the event data analysis subsystem, which analyzes the received data by applying analysis technologies.

[0034] The results of the event data analysis subsystem are transferred to the security policy application subsystem, where security policies apply the security policy configuration to the properties of the intercepted data by comparing the policy values ​​with the results of the data analysis and other event attributes.

[0035] In a preferred embodiment, the method for preventing data leakage includes an additional step in which additional event attributes are obtained, which subsequently make it possible to quickly search for similar texts or quickly group similar documents to identify new categories of information or clarify existing ones.

[0036] In a preferred embodiment, the method for preventing data leakage comprises an additional step of transmitting the result of the operation of the security policy application subsystem to the subsystem for storing intercepted data and policy application results.

[0037] In a preferred embodiment, the data leak prevention method includes an additional step of storing subsystem performance results, settings, configurations, and event responses in a database. In one embodiment, the data leak prevention method includes an additional step of transmitting analytical reports on system operation to a graphical user interface for review by a system administrator.

[0038] The use of a data leak prevention system and method allows for a significant reduction in the time it takes to identify a full scenario of events that could potentially lead to the leakage of sensitive information beyond the controlled perimeter of an enterprise's information security.

[0039] BRIEF DESCRIPTION OF DRAWINGS

[0040] Fig. 1 The figure shows a block diagram of an information leakage prevention system.

[0041] IMPLEMENTATION OF THE INVENTION

[0042] The invention comprises a hardware and software system for implementing a data leak prevention (DLP) system in accordance with Fig. 1. It comprises DLP servers deployed within and outside the enterprise's corporate network. An interception subsystem 1 is configured for each data transmission channel. After an event is intercepted, it is transmitted to a data extraction subsystem 2, which constructs an event parsing tree. The root of the parsing tree is the intercepted object. The remaining nodes contain the information transmitted within the intercepted object. A data analysis subsystem 3 analyzes the received data using analysis technologies. At the next stage, in the security policy enforcement module 4, a verdict is issued for each intercepted event.After this, the subsystem for recording intercepted data and the results of applying security policies 5 saves the event and the attributes assigned to it are saved in the database 7. The event tagging is subsequently used to filter events by type of violation, to notify the security officer about critical events.

[0043] Grouping subsystem 6, which retrieves additional attributes, enables quick searches for similar texts or rapid grouping of similar documents to identify new categories of information or refine existing ones. The event interception subsystem contains event interception modules on the user's terminal device and / or the server side of the DLP system. Each interception module is responsible for one data transmission channel. The data transmission channels are:

[0044] - email;

[0045] - cloud data storage;

[0046] - FTP data storage;

[0047] - removable storage devices (phones, flash drives, etc.);

[0048] - applications for transferring messages and files;

[0049] - and other communication channels.

[0050] Each interception module is configured depending on the company's infrastructure and interception goals.

[0051] The module is configured as follows:

[0052] 1) each installed module has a configuration file with information about the infrastructure of the channels from which the module intercepts events;

[0053] 2) a connection is established between the module and the device (an example of a device that provides a stream of events, intercepted data, is, for example, a mail server) by configuring the device in order to direct the stream of events from the device to the interception module.

[0054] Depending on the device configuration, the device:

[0055] 1) or transmits a copy of events to the interception module and does not stop the flow of data within the company’s infrastructure;

[0056] 2) or transfers the data stream to the interception module, stopping further processing of data and its transmission (after analysis, the DLP system either independently directs events according to their route or blocks the transmission of data);

[0057] 3) or transmits a copy of the event to the interception module and waits for a signal from the interception module confirming the continuation of data movement along the previously specified route or blocking such movement.

[0058] The event data extraction subsystem consists of two main modules on the user's terminal device and / or the server part of the DLP system:

[0059] 1. The format detection module is responsible for determining the format of the intercepted file based on so-called "magic characters." These characters are typically referred to as the format signature, which is usually located at the beginning of the file. This approach to file format detection allows for accurate format detection even when the file extension is misspelled or missing. The module also implements format refinement functionality. For example, a .docx file is actually a regular zip archive, but the file structure within such an archive allows one to determine that the file actually entered the system as a .docx file, and further processing can be based on this data (simply unzipping such a file will not extract meaningful text; it will instead be a collection of XML files).Format detection is performed as follows: the module receives a link to the intercepted file, which is located in the Data Storage, opens the file using system calls and, by reading the first bytes of the file, searches for known signatures that were loaded into the module when it was launched.

[0060] 2. The text and image extraction module extracts text and images from the data stream for easy file content analysis. Text and image extraction is performed as follows: when the module is installed, it is configured by loading information about the extractor's relationship with the file formats it can process, as well as loading methods for launching this extractor. The module receives information about the intercepted file format and a link to the Data Storage from the Format Detection Module, opens the file using system calls, and uses the extractor required for the file format to extract text and images.

[0061] The extracted text and image are placed in the subsystem for storing intercepted data and policy application results.

[0062] The data analysis subsystem consists of two modules implementing the algorithms of the analysis technologies installed on the user's terminal device and / or the server part of the DLP system. The data reading module receives a link to a specific file in the Data Storage, opens the file using system calls, reads it into RAM, and transfers it to the data analysis module. The data analysis module analyzes the received data using analysis technologies. During the data analysis process, it receives the data analysis technology configuration from the DLP system and the intercepted data for analysis. The security policy enforcement subsystem consists of two modules installed on the user's terminal device and / or the server part of the DLP system.

[0063] The Policy Enforcement Data Preparation Module receives a link to the Data Warehouse or data from the DLP system's Database, which the module accesses using the event identifier and opens a file (or loads data into RAM from the Database). Upon startup, the Security Policy Enforcement Module loads the security policy configuration from configuration files previously installed in the DLP system. Security policies represent a file (or structure in the Database) in which policies are described. During operation of the DLP system, the policy configuration may change. Each time this configuration changes, the Security Policy Enforcement Module receives a notification and reloads the new configuration. The Security Policy Enforcement Module applies the security policy configuration to the properties of the intercepted data by comparing the policy values ​​with the intercepted data.

[0064] The DLP system's web interface creates rules for information security policies. These rules can specify information about the analysis technologies applied to intercepted data, the information transfer channels, and which user groups (groups can be defined, for example, based on the company's organizational structure) can or cannot transmit information. For example, for the accounting department, a policy can be created specifying that the accounting department can transmit to the bank and tax office any information that the analysis technologies have classified as financial based on various criteria (the presence of an account number, the corresponding vocabulary in documents, and other criteria). However, other company employees who transmit such information will be subject to the control of a security officer.

[0065] Based on the results of the analysis for compliance with information security policy rules, the Security Policy Enforcement Module issues a verdict, which is a database entry associated with the intercepted event and used for displaying, filtering, and generating notifications about information security events. The verdict is generated by applying the conditions described in the information security policy to the event metadata (including, at a minimum, information about the data transmission channel, the event initiator, the purpose of the data transmission, and the results of the data analysis) and is sent to the database.

[0066] The subsystem for storing intercepted data and policy application results consists of the following modules.

[0067] 1) A data storage module installed on the server side of the DLP system. The data storage receives various data from all DLP system modules, which only need to be stored for the duration of a specific intercepted event. The storage transfers data upon request to other DLP system modules for processing the intercepted data. The final data processing results are transferred from the submodule to the Database;

[0068] 2) Database Transfer Request Generation Module. After all previous modules have processed the captured data, this module initiates a request to the data storage module to transfer all processed information to the database module. The database transfer request generation module, having received information about transfer readiness from the data storage module, generates SQL queries to the database for data transfer. The query contains the event data to be saved. The query is transmitted to the data storage module via remote procedure calls over the enterprise's local area network.

[0069] The grouping subsystem consists of the following modules:

[0070] 1. The text preparation module is responsible for receiving texts, tokenizing them, calculating statistics, and generating a feature vector. This module is software installed on the server side of the DLP system and communicates with the following subsystems and the DLP system as a whole via remote calls to public API functions.

[0071] 2. The grouping module is software installed on the server side of the DLP system and linked to the data storage system, web interface, and the DLP system as a whole. The grouping module groups documents by defining a vector of document attributes.

[0072] 3. Grouping interface - is a data grouping interface that allows you to obtain thematic groups with different levels of accuracy.

[0073] In the preferred implementation, the data leak prevention system implements a method in which, at the first stage, data received by the DLP system is sent to the event interception subsystem, where it is intercepted using modules responsible for a specific interception channel (email, instant messaging, file operations, etc.). The event interception subsystem generates an Event from the intercepted data. An interception event is the result of a user action in one of the data transmission channels. Events have basic attributes that can be expanded with attributes specific to the interception channel.

[0074] Basic event attributes: a) Interception channel; b) Time at which the event occurred; c) Event initiator identifier; d) Event recipient (e.g. for mail - these are the letter's addressees, for copying to a removable storage device - its identifier); e) Event size.

[0075] Extended attributes, for example for email, can be: a) the mail server through which the email was sent; b) the email headers; c) the subject of the email; d) and other attributes.

[0076] The event is then sent from the data interception subsystem to the event data extraction subsystem, where it is decomposed into its component parts and prepared for analysis. Any event is, by nature, a file. File formats can vary. For each format, the event data extraction subsystem has a corresponding extractor. To select the required extractor, the specified event data extraction subsystem has a file format detection module. If the file type is known to the event data extraction subsystem and an extractor exists for it, it is called. Each extractor accepts a file as input, and the output also contains files containing the data that make up the original file. For the resulting files, the event data extraction subsystem also determines the format and calls the appropriate extractors.The process stops when the event data extraction subsystem doesn't have an extractor for the received format, or the format is unknown to the event data extraction subsystem and it couldn't determine it, or when a text file is obtained as the extraction result. For example, when intercepting an archive, the event data extraction subsystem determines the archive type, calls the appropriate unzipper, then determines the format of the resulting files (for example, these are .docx documents), and calls the appropriate extractor for each file. The event data extraction subsystem may output a text file with the document body, as well as all inserts in an Office document (.xlsx, .jpeg, even .exe files). Some formats, such as images, don't support text. However, an image could be a scan of an important document.For such cases, the system has an extractor called Optical Character Recognition (OCR), which can be used to extract text even from an image.

[0077] The event data extraction subsystem constructs a parse tree for the event. The root of the parse tree is the intercepted document or message, and the remaining nodes contain the information transmitted within the intercepted document or message, which is either text or an image.

[0078] The extracted Event is sent to the data analysis subsystem. This data analysis subsystem performs copyright analysis on binary data (all file formats except text and graphic, including those the system was unable to identify). In this case, it is assumed that the user has specified a set of binary (not text or graphic) reference files, fragments of which the data analysis subsystem attempts to find in the intercepted traffic.

[0079] The data analysis subsystem utilizes the following analysis methods: a) copyright analysis. This method assumes that the subsystem contains reference documents (e.g., important contracts). Any matches found in traffic with these reference documents will serve as the analysis result. This method is applicable to the following document types: text, structured text, raster images, vector images, and binary data. It is used for analyzing each event if the corresponding reference documents are specified. b) data classifier. The subsystem is trained to classify data into specified categories and, during analysis, can assign the obtained data to one of the specified categories. It is used for analyzing each event if the classifier is trained in the corresponding categories. c) pattern matching. This approach enables the subsystem to identify text patterns of interest to the security officer. The patterns are specified using regular expressions.For example, you can define a template describing all possible entries for a credit card number. A unique feature of the system is the ability to write a verification function. A found set of digits that resembles a credit card number can be passed to the verification function, which will calculate a checksum for the card using the Luhn algorithm and compare it with the last digit of the card number; they must match. These checksums are applied to each event if the corresponding templates are defined. The data analysis subsystem also includes a module for aggregating analysis results. Through the system configuration, you can create security objects that describe logical relationships between data analysis results. In the simplest case, one security object contains one possible analysis result—for example, the subject of information for a text. However, more complex relationships can be created using the logical operators "AND," "OR," and "NOT."This operational basis allows for the description of fairly complex trigger conditions for protected objects. For example, the "Supply Agreements" protected object should be triggered when the analysis results contain the "Agreement" category and the regular expression "Supply Agreement Number" (which describes the number format for this type of agreement). This approach allows for more precise system configuration and avoids false positives (when the system is triggered by an event containing a service agreement or an email event that mentions a supply agreement number).

[0080] The data analysis subsystem produces analysis results for each file, and for each event, the protection objects that were triggered.

[0081] The security policy enforcement subsystem receives the results of the data analysis subsystem and event attributes. This security policy enforcement subsystem can define security policies that specify a specific set of protected objects and event attributes, along with the security policy enforcement subsystem's response to this combination. The security policy enforcement subsystem's response to these combinations can vary, from simply assigning a threat level to immediately blocking event transmission outside the enterprise network with notification to the initiator, its manager, and the security officer. The subsystem for storing intercepted data and policy enforcement results stores events for subsequent search (by parameters or full-text), display, and reporting.

[0082] When events are stored in the intercepted data and policy results storage subsystem, the text components of these events are transferred to the grouping subsystem, where additional attributes are obtained. These attributes subsequently enable quick searches for similar texts or rapid grouping of similar documents to identify new information categories or refine existing ones. For example, a contract template will be repeated in all contracts, and it makes sense to assign all contracts generated from the same template to a single group. After this, a similarity measure (citation index) is determined for the documents in the group of transferred documents. The documents are grouped by similarity. The grouping subsystem then identifies the groups. For each document in the group, a characteristic is calculated that determines the document's proximity to the group center. This characteristic is saved in the document properties.A list of the most significant tags in each group is also generated for each group. The grouping results are saved in the Database.

[0083] The DLP system database is used to store event attributes.

[0084] The user interface is used to display the results of the DLP system and its settings.

[0085] In the preferred embodiment of the DLP system, the results of the grouping subsystem can be used: a) to search for similar documents by sample, b) to group documents from events into thematic groups, c) to prepare a training sample for text classification technology for the data analysis subsystem, d) to prepare policies for the security policy application subsystem, e) to track the emergence of new thematic groups in enterprise traffic.

[0086] In the preferred embodiment of the DLP system, the results of the work of the security policy application subsystem are transferred to the subsystem for storing intercepted data and policy application results.

[0087] In the preferred embodiment of the DLP implementation, the system stores the results of the subsystems, settings, configurations and responses to events in the Database.

[0088] In one implementation option of the DLP system, there is a graphical user interface to which the results of the work are sent for review by the system administrator.

[0089] One DLP system includes a subsystem for auditing and categorizing data on the organization's file shares. This scans network folders, workstations, and SharePoint storage, transmits detected files to the DLP system, and, based on content analysis and file location, detects violations related to information storage, as well as violations related to unauthorized access. Document categorization on file shares automatically groups data by meaning to identify new information assets requiring protection. File information with verdicts is stored in the DLP system.

[0090] One DLP system includes a subsystem that visualizes stored events in the form of diagrams, relationship graphs, and employee profiles. Another DLP system includes a subsystem that, based on data from the DLP system, monitors employee activity (websites visited, programs opened, text entered, activity categorization as work / non-work, and screenshots).

[0091] One DLP system includes a subsystem that identifies employees in different risk groups. Employees are assigned to specific risk groups based on the analysis of events over long periods of time and the identification of anomalies.

[0092] In one version of the DLP system, there is an application programming interface (API) that allows third-party systems to receive information about events registered by the DLP system, as well as to independently register events by the DLP system.

[0093] The diagram of information flows processed in the data leak prevention system provides for the collection of the following data:

[0094] - about traffic inside and outside the organization;

[0095] - about files on personal computers and servers;

[0096] - about the actions of employees at their workplaces.

[0097] Data streams from email messages, instant messaging, and other data transmission channels are recorded, and specialized extractors extract text and graphic information from events and files.

[0098] The events are then passed to products / modules for analysis.

[0099] The DLP system analyzes events and decides whether the transmitted information is protected or not. Using content analysis and data flow analysis technologies, it determines whether the information falls under any configured policy. Depending on the policy, the event is marked accordingly. If blocking mode is enabled in the policy, the transmission of sensitive data will be blocked.

[0100] Possibilities:

[0101] 1. Data leak protection;

[0102] 2. Possibility of integration with corporate systems and applications;

[0103] 3. Automated configuration of security policies;

[0104] 4. Creation of a secure container for working with confidential information on employees’ personal devices;

[0105] 5. Control over the movement of confidential information within the corporate infrastructure into inappropriate storage.

[0106] The DLP system enables auditing and categorization of data on an organization's file resources, scans network folders, workstations, and SharePoint storage, transfers detected files, and, based on content analysis and file location, detects violations related to information storage, as well as violations related to unauthorized access. Document categorization on file resources automatically groups data by meaning to identify new information assets requiring protection. File information with verdicts is stored in the DLP system.

[0107] Possibilities:

[0108] 1. Scanning personal computers and servers via SMB, SSH, DFS protocols and Microsoft SharePoint portals;

[0109] 2. Parallel processing by multiple nodes to distribute the load;

[0110] 3. Analyze only new files during rescanning;

[0111] 4. Identification of violations of storage rules;

[0112] 5. Finding hidden copies; 6. File inventory using metainformation analysis.

[0113] The DLP system allows you to visualize saved events in the form of diagrams, relationship graphs, and personal profiles. This feature will help you quickly conduct investigations and compile profiles on each employee.

[0114] Possibilities:

[0115] 1. A graph of connections between a company, departments or individuals;

[0116] 2. Routes for moving specific files or types of information;

[0117] 3. Summary statistics for the company and instant access to event details;

[0118] 4. Fast updating even on large data sets – processing 100,000 events per second;

[0119] 5. Delimitation of data visibility for separation of powers.

[0120] The DLP system monitors employee activity (websites visited, programs opened, text entered, activity categorized as work / non-work, screenshots). This data allows us to understand what the employee did before, during, and after an incident.

[0121] Possibilities:

[0122] 1. Accounting of working hours;

[0123] 2. Collection of statistics;

[0124] 3. Data collection - screenshots, search queries, visited web resources;

[0125] 4. Categorization of activity;

[0126] 5. Software composition and load on a personal computer.

[0127] The DLP system allows for the identification of employees belonging to different risk groups. Employees are assigned to specific risk groups based on the analysis of events over long periods of time and the identification of anomalies.

[0128] The application programming interface (API) allows third-party systems to receive information about events, as well as independently register events.

[0129] Possibilities:

[0130] 1. Analysis of employee behavior using machine learning;

[0131] 2. Dynamic patterns of behavior for each employee, not static templates;

[0132] 3. Formation of risk groups based on individual assessment;

[0133] 4. Risk assessment and alerts about the most dangerous trends.

[0134] A typical DLP system setup after deployment assumes that information from all intercepted channels is sent to a storage location, and this information must be tagged. The first step is to configure automatic information analysis. For this purpose, the following is determined:

[0135] 1. What topics of information are of interest to the user;

[0136] 2. What categories of information are sensitive for this organization;

[0137] 3. What documents should never leave the premises of the enterprise.

[0138] Most often, this is done by an analyst interviewing a potential user. This approach presents a number of challenges:

[0139] 1. The information may be so sensitive that the analyst cannot access it in any way, and if he can, this requires special clearance; 2. The user of the DLP system is not the owner of the information, and therefore has to delve into areas that are foreign to him and understand what is sensitive information and what is not;

[0140] 3. Quite often, there are no clearly defined owners of information in organizations, which greatly complicates its collection and analysis.

[0141] Over time, the structure of information topics circulating within an enterprise changes, making the initial configuration of the DLP system irrelevant.

[0142] Once the information has been collected, it's necessary to determine legitimate routes for transmitting information on a specific topic. To do this, information transmission policies are set up, defining the topics, volume, and user groups.

[0143] At this stage, the analyst identifies users or user groups who are allowed or prohibited from transmitting certain information. This knowledge is then formalized into security policies within the DLP system.

[0144] Once security policies are configured, the DLP system is put into production mode. The main challenges with this approach are:

[0145] 1. The high cost of DLP products is due to the fact that developing security policies requires an analyst to analyze all of the client's business processes. Moreover, these processes can be variable, not formalized, and not accessible to the analyst (secrecy);

[0146] 2. Static configuration of the solution. New documents may emerge during operation in the enterprise's information environment that did not exist when the DLP system was configured. Also, some processes are periodic (e.g., seasonal): they are difficult to identify during the time allocated for implementing and configuring the DLP system. 3. High operating costs. Due to the constant need for manual fine-tuning of the DLP system, it is necessary to retain highly paid specialists.

Claims

CLAUSES OF THE INVENTION 1. The data leak prevention system contains: - at least one server on which the server part of the DLP system is installed, connected to at least one terminal device; - the DLP system contains: - a subsystem for intercepting events on the user’s terminal device and / or the server part of the DLP system; - a subsystem for extracting data from intercepted events on the user’s terminal device and / or the server part of the DLP system; - a subsystem for analyzing intercepted data from events on the user’s terminal device and / or the server part of the DLP system; - a subsystem for storing intercepted data and the results of applying policies on the user's terminal device and / or the server part of the DLP system - a subsystem for grouping intercepted data on the server part of the DLP system; - a subsystem for applying security policies to intercepted data on the user’s terminal device and / or the server part of the DLP system; - a database for storing intercepted data on the server side of the DLP system; at least one server is located within the enterprise's corporate network and configures an interception subsystem for each data transmission channel, wherein each intercepted event of message transmission or document access is transferred to the data extraction subsystem, which constructs an event parsing tree, wherein the root of the parsing tree is the intercepted document, and the remaining nodes contain information that was transmitted as part of the intercepted document, the information in which represents text or an image, the result of the work of the event data extraction subsystem is transferred to the event data analysis subsystem, which analyzes the received data by applying analysis technologies, the result of the work of the event data analysis subsystem is transferred to the security policy application subsystem, where security policies impose the configuration of security policies on the properties of the intercepted data by comparing the policy values ​​with the result of the data analysis and other event attributes.

2. The system according to claim 1, in which the collected data is transferred to a grouping subsystem, which produces additional attributes, with the help of which it becomes possible to quickly search for similar texts or quickly group similar documents to identify new categories of information or clarify existing ones.

3. The system according to claim 1, in which the results of the work of the security policy application subsystem are transmitted to the subsystem for storing intercepted data and policy application results.

4. The system according to paragraph 1 of the formula, in which the results of the operation of subsystems, settings, configurations and responses to events are stored in the database.

5. The system according to paragraph 1 of the formula, in which a user interface subsystem is additionally implemented for displaying the results of the DLP system operation and its configuration on the server part of the DLP system.

6. A method for preventing data leakage, implemented by means of the system according to paragraph 1 of the formula, in which at least one server located inside the corporate network of the enterprise ensures the execution of the stages, in which an interception subsystem is configured for each data transmission channel, each event of message transmission or access to a document is intercepted and placed in the data extraction subsystem, which builds a parsing tree of the event, wherein the root of the parsing tree is the intercepted document, and the remaining nodes contain information that was transmitted as part of the intercepted document, the information in which is text or an image, the result of the work of the data extraction subsystem from the event is transmitted to the data analysis subsystem from events, which analyzes the received data by applying analysis technologies, the result of the work of the data analysis subsystem from events is transmitted to the subsystem for applying security policies,where security policies impose security policy configuration on the properties of intercepted data by comparing policy values ​​with the result of data analysis and other event attributes.

7. The method according to claim 6, in which the collected data is transferred to a grouping subsystem, which produces additional attributes, with the help of which it becomes possible to quickly search for similar texts or quickly group similar documents to identify new categories of information or clarify existing ones.

8. The method according to claim 6, in which the results of the work of the security policy application subsystem are transmitted to the subsystem for storing intercepted data and policy application results.

9. The method according to paragraph 6 of the formula, in which the results of the operation of subsystems, settings, configurations and responses to events are stored in the database.

10. The method according to claim 6, in which a user interface subsystem is additionally implemented for displaying the results of the DLP system operation and its configuration on the server part of the DLP system.

Images