Entity Engine Content Classification for Data Loss Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for identifying sensitive or confidential information in computing environments are not sufficiently accurate, leading to undetected data breaches and exfiltration attempts due to their reliance on word-by-word or phrase-by-phrase comparisons without context or logic, resulting in high false positives.
Innovation Solution
The implementation of an entity engine that classifies content using predefined entity definitions, which include regular expressions, terms, and dictionary entries, along with proximity windows and scoring systems, to accurately identify sensitive information by matching patterns and assigning confidence scores, thereby reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If word-by-word or phrase-by-phrase comparison with dictionary entries is used to identify sensitive information, then the identification process is simple and fast, but the accuracy is insufficient leading to high false positives
Solution Approach 1:
The patent segments the identification process into multiple stages: first checking for dictionary entries (simple matches), then applying regular expressions for pattern matching, and finally using entity definitions with proximity windows for contextual validation. This multi-layered segmentation allows the system to achieve high accuracy while maintaining efficiency by applying more complex methods only when simpler methods are insufficient.
Solution Approach 2:
The system changes parameters by introducing entity definitions that include proximity windows (specifying maximum distance between matched terms), scoring thresholds (minimum confidence scores), and contextual requirements. These parameter changes transform the identification from simple string matching to a multi-criteria evaluation system that significantly reduces false positives while maintaining manageable complexity through configurable thresholds.
2Reliability
If simple dictionary comparison is used, then the system is easy to operate and fast, but data breaches and exfiltration attempts remain undetected
Solution Approach 1:
The patent introduces entity definitions as intermediaries between simple dictionary matching and complex contextual analysis. These entity definitions act as mediators that incorporate proximity windows, scoring mechanisms, and contextual rules, thereby enhancing detection capability while abstracting the complexity away from users through a unified interface that requires no operational complexity.
Solution Approach 2:
The system performs preliminary actions by pre-defining entity definitions, proximity windows, and scoring thresholds before the actual identification process. This preliminary configuration allows the system to automatically handle complex detection logic without requiring users to operate complex parameters during runtime, thus improving reliability while maintaining ease of operation.
3Measurement precision
If contextual analysis with entity definitions and proximity windows is applied, then false positives are reduced, but the processing complexity and time increase
Solution Approach 1:
The identification process is segmented into hierarchical stages where simple dictionary matches are performed first (fast path), and only when those fail or are inconclusive does the system proceed to more time-consuming entity definition analysis with proximity windows. This segmentation reduces average processing time while maintaining high accuracy for challenging cases.
Solution Approach 2:
The system applies partial action by not always executing the full contextual analysis pipeline. Instead, it uses scoring thresholds to determine when entity definition matching is sufficient and when additional proximity window validation is needed. This selective application of complex processing reduces overall time loss while maintaining precision when it matters most.
Data Source
AI summary
Provided herein are systems and methods for classifying content to prevent data breach or exfiltration. An entity engine may receive content for classification into a content type for preventing data breach or exfiltration. The entity engine may determine that secondary data, defined by an operand of an entity definition, is present in the content. Each entity definition may correspond to one content type and may include a Boolean expression of operands. Each operand may include a matching element to be used for matching against content undergoing classification into one of the content types, upon secondary data defined by the operand being present in the content. The entity engine may classify the content into a content type of the content types, corresponding to the entity definition, based on matching the matching element of the operand to the content, and matching other operands of the entity definition to the content.