DLP Search Using Record Sampling and Category Likelihoods
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data loss prevention (DLP) tools inefficiently scan large volumes of data, missing significant amounts of sensitive information due to cumbersome scanning processes, especially with varying data structures or types within databases.
Innovation Solution
Select a statistically representative subset of records, scan these for sensitive information, compute likelihoods of sensitive information presence, and then selectively search through a subset of categories based on computed likelihoods to enhance detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DLP tools scan through large databases and central repositories to detect sensitive data, then the reliability of data loss prevention is improved, but the time and resources required for scanning increase significantly
Solution Approach 1:
The patent segments the data scanning process into two phases: first scanning a representative subset of records to identify sensitive data categories, then using those categories to guide the scanning of remaining records. This segmentation reduces the overall scanning time while maintaining detection reliability by focusing resources on the most relevant data areas.
Solution Approach 2:
The patent performs preliminary scanning of a representative subset of records before scanning the entire dataset. This preliminary action identifies sensitive data categories that are then used to guide the subsequent scanning process, making the overall operation more efficient while ensuring reliable detection.
2Productivity
If DLP tools scan only a part of the data to reduce resource consumption, then the time and resources required are reduced, but the risk of not detecting sensitive data increases
Solution Approach 1:
The patent applies partial action by scanning a representative subset of records rather than the entire dataset in the first phase. This partial scanning approach identifies sensitive data categories efficiently, and then those categories are used to guide the scanning of remaining records, ensuring comprehensive detection while maintaining high scanning efficiency.
Solution Approach 2:
The preliminary scanning of a representative subset establishes the basis for identifying sensitive data categories. This preliminary action enables the system to then focus on scanning only the relevant categories in the remaining records, thereby maintaining detection reliability while improving overall scanning efficiency.
3Ease of operation
If DLP tools use keyword searches or rule based searches to detect sensitive data, then the detection process is simplified, but the ability to detect sensitive data in varied structures decreases
Solution Approach 1:
The patent performs preliminary scanning of a representative subset of records to identify sensitive data categories before applying keyword searches or rule-based searches to the entire dataset. This preliminary action adapts the search strategy to the actual data structures present, improving detection coverage while maintaining the simplicity of keyword and rule-based searching.
Solution Approach 2:
The patent changes the parameters of the search process by first identifying sensitive data categories from a representative subset, then using those categories to guide subsequent searches. This parameter change enables the system to adapt to varied data structures while maintaining the simplicity of keyword and rule-based searching methods.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Method for data loss prevention in data, wherein the data are structured and/or semi-structured data with a plurality of records and a plurality of categories, wherein each record comprises a plurality of fields each belonging to a different one of the categories, the method comprising the following steps: selecting, in a processor, a subset of records of the data, wherein the selected subset comprises at least two records between which the data comprise a plurality of records which are not included in the subset; scanning, in the processor, the fields of the selected subset of categories for sensitive information; computing, in the processor, for each category a likelihood to contain the sensitive information on the basis of the scanning result; selecting, in the processor, a subset of categories on the basis of the computed likelihoods of the categories to contain the sensitive information; and searching, in the processor, the sensitive information in the selected subset of categories.