Dynamic Document Tracing via Runtime Instrumentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures are inadequate in preventing data leaks by authorized users, such as disgruntled employees with administrative privileges, as they can exploit their permissions to exfiltrate sensitive data, and basic users with limited privileges can still access and leak sensitive information, posing a significant risk.
Innovation Solution
Implementing dynamic tracing of document data leaks through application instrumentation by inserting tracing data into documents that causes a client to send a web request for a URL associated with identification information, allowing for real-time monitoring and identification of suspicious data mining activities, and enforcing data mining policies to target suspected users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures (encryption, MFA, access policies) are implemented, then external threats are prevented, but authorized users can still exploit their permissions to exfiltrate sensitive data
Solution Approach 1:
The system performs preliminary actions by inserting instrumentation code into the application before data access occurs. This code establishes tracing capabilities and identification mechanisms in advance, so that when authorized users access documents, their actions are automatically tracked and identified, enabling detection of data exfiltration attempts before they complete
Solution Approach 2:
The system introduces an intermediary tracing mechanism between the authorized user and the sensitive data. The instrumentation code acts as a mediator that monitors and tracks user interactions with documents, capturing transaction data and generating identification information without blocking the legitimate access flow, thus maintaining reliability while detecting harmful actions
2Object-affected harmful factors
If access policies restrict user permissions, then data protection is improved, but legitimate user operations may be blocked
Solution Approach 1:
The system implements feedback by continuously monitoring user transactions through instrumentation code and comparing them against data mining policies. When suspicious patterns are detected, the system provides feedback through alerts to administrators, enabling dynamic adjustment of access restrictions based on actual behavior rather than static permission settings, thus protecting data while maintaining ease of operation for legitimate users
Solution Approach 2:
The system transitions from static access policies to dynamic monitoring and response. The instrumentation code enables real-time tracking of user transactions, and the system dynamically generates identification information and triggers alerts based on observed behavior patterns, allowing access controls to adapt to actual user actions rather than relying solely on pre-configured permission levels
3Loss of information
If comprehensive monitoring of all user transactions is implemented, then data leaks are detected, but system complexity and performance overhead increase
Solution Approach 1:
The system extracts only the essential monitoring functionality needed for data leak detection by inserting focused instrumentation code that captures specific transaction data relevant to document access. Rather than implementing comprehensive monitoring of all system operations, the extraction approach targets only the critical paths where data exfiltration could occur, reducing system complexity while maintaining effective detection capability
Solution Approach 2:
The system uses copying by generating identification information that references transaction data without duplicating the entire data set. The instrumentation code creates lightweight traces and identification records that can be analyzed for security purposes without requiring complex storage and processing of complete transaction logs, thus reducing system complexity
Data Source
AI summary
In one embodiment, a device obtains transaction data regarding a user account of an application performing a transaction within the application to access a particular document. The transaction data is captured by instrumentation code inserted into the application at runtime. The device identifies, based on the transaction data, a data mining policy for the transaction. The device generates, based on the data mining policy, identification information associated with the user account and the particular document. The device inserts, via the instrumentation code, tracing data into the particular document that causes a client that opens the particular document to send a web request for a uniform resource locator (URL) associated with the identification information.