Zero-Day DLP File Upload Cache Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Data Loss Prevention (DLP) systems face challenges in monitoring file uploads through browsers without causing delays, particularly due to lack of standardization in specifying file names and frequent changes in web application behaviors with browser versions, leading to risks of losing sensitive data.
Innovation Solution
The implementation of a zero-day DLP protection system using point-based detection methods, including capturing file upload context, generating a file upload cache, and processing file open calls to intercept and classify uploads, ensuring compliance with DLP policies, regardless of browser versions or upload techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HTTPS-based traffic monitoring is used to capture file upload context, then data protection capability is improved, but processing delay increases
Solution Approach 1:
The system captures file upload context information (file paths, URLs, process identifiers) in advance before the actual file upload occurs. By pre-processing and storing this contextual data in a cache structure, the system prepares classification information ahead of time, so that when the actual upload happens, the DLP decision can be made quickly using the pre-prepared context without causing significant processing delays.
2Measurement precision
If well-known attributes are used to specify file names, then monitoring accuracy is improved, but adaptability to non-standard protocols deteriorates
Solution Approach 1:
The system uses multiple file identification methods simultaneously rather than relying on a single well-known attribute. It combines traditional methods (file names, paths) with alternative approaches (process identifiers, URL parameters, contextual information) to universally identify files across different protocols and browser versions. This multi-functional approach ensures the system works with both standard and non-standard protocols.
Solution Approach 2:
The system dynamically changes the parameters used for file identification based on the detected protocol and context. When well-known attributes are available, it uses them for precise monitoring. When dealing with non-standard protocols, it switches to alternative parameters such as process IDs, URL structures, or contextual markers, thereby adapting to different protocol requirements while maintaining monitoring effectiveness.
3Measurement precision
If file upload context is captured and cached for every upload, then classification accuracy is improved, but system complexity increases
Solution Approach 1:
The system applies different levels of context capture and caching to different upload scenarios rather than uniformly processing all uploads the same way. For high-risk uploads or those containing sensitive data patterns, it captures comprehensive context information. For low-risk uploads, it uses simplified context capture. This localized approach to quality ensures high classification accuracy where needed while reducing unnecessary complexity for routine uploads.
Data Source
AI summary
Systems and methods for Zero-day Data Loss Protection (DLP) having enhanced file upload processing are provided. One method may include capturing and sending file upload context (e.g. folder name, metadata, an active URL, etc.) associated with the scheduled file or folder upload to a DLP filesystem driver. For example, the method may include detecting whether a single/multi-file upload, a folder upload, or a drag-and-drop operation exists, through interception of the shell dialog API, the browse folder API, or the drop process interface, respectively. Further, the method may include generating a file upload cache including the file upload context, prior classification entries, and a timestamp indicating when the scheduled file or folder upload was last modified; such that, the DLP filesystem driver may intercept and process the file open call based upon the file upload cache. Accordingly, the file may be processed in accordance with a prior file classification, file/domain filter, or DLP policy.