Generative LLMs for Context-Aware Data Leakage Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data leakage protection (DLP) systems rely heavily on keyword matching, leading to high false positives and false negatives, especially for data in motion, as they struggle to understand the context and intent of the data.
Innovation Solution
Implementing generative large language models (LLMs) and generative artificial intelligence (AI) to enhance DLP systems, allowing for deeper understanding of content context and intent, generating intelligent rules to reduce false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If keyword matching is used for data leakage detection, then the system is simple to implement and processes data quickly, but it produces high false positives and false negatives due to inability to understand context
Solution Approach 1:
The system dynamically selects between rule-based detection and LLM-based detection based on the characteristics of the data being analyzed. For structured data with clear patterns, rule-based detection is used for speed. For unstructured data requiring context understanding, LLM-based detection is invoked to improve accuracy, thus adapting the detection approach to the specific situation.
Solution Approach 2:
The LLM acts as an intermediary between simple keyword matching and complex contextual understanding. It receives the output from rule-based detection and refines it by analyzing context, intent, and semantics, thereby reducing false positives and false negatives without requiring complete replacement of the fast rule-based system.
2Measurement precision
If LLM-based detection is used for all data, then detection accuracy improves through context understanding, but processing latency increases
Solution Approach 1:
Instead of applying LLM-based detection to all data uniformly, the system applies it partially - only to cases where rule-based detection is inconclusive or where contextual understanding is particularly needed. This selective application maintains high accuracy for critical cases while avoiding the latency penalty for routine detections.
Solution Approach 2:
The detection process is segmented into two stages: first, fast rule-based detection handles obvious cases; second, LLM-based detection handles ambiguous cases requiring context. This segmentation allows the system to achieve high overall accuracy while minimizing the time spent on LLM processing to only when necessary.
3Loss of time
If rule-based detection with pre-built categories is used, then the system processes data quickly with low latency, but it cannot detect sensitive data that falls outside predefined patterns
Solution Approach 1:
The LLM component provides universal detection capability that can identify sensitive data across multiple categories and contexts without requiring pre-defined rules for each specific case. It complements the rule-based system by handling diverse, unstructured, and emerging data types that fall outside predefined patterns, thereby expanding overall detection coverage.
Data Source
AI summary
Mechanisms are provided for automatically detecting data leakages and generating data leakage detection rules for a rules engine. The rules engine is configured with rules for identifying first sensitive data patterns in input data, and a large language model (LLM) is trained to identify second sensitive data patterns in input data. New input data is processed via the rules engine to determine whether it comprises any of the first sensitive data patterns. In response to the rules engine making a negative determination, the LLM is executed on the new input data to determine whether the new input data comprises any of the second sensitive data patterns. Responsive to a positive determination by the LLM, the rules engine is updated with a new rule based on the at least one second data pattern.