Data Exfiltration Monitoring Using Hash Values for Dark Web Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing enterprise systems struggle to efficiently identify exfiltrated data, particularly unstructured data such as plain text, drawings, and images, on the dark web due to resource-intensive key value searches, which are impractical for large data volumes.
Innovation Solution
A data protection service generates semantic descriptions of data volumes and iteratively refines these descriptions to query a monitoring service, narrowing the scope until a breach is identified, reducing the need for individual queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key value search is used to identify exfiltrated data on dark web, then data breach detection capability is improved, but computational resources and costs increase significantly for large data volumes
Solution Approach 1:
The patent extracts only the essential identifying features (semantic descriptions) from data items rather than searching for complete key values. By taking out and monitoring only the most distinctive semantic characteristics, the system achieves effective breach detection without the computational burden of processing entire data items or exhaustive key value searches.
Solution Approach 2:
The patent segments the data monitoring task into hierarchical levels: first monitoring broad semantic descriptions at the category level, then progressively refining to more specific descriptions only when breaches are detected. This segmentation allows the system to monitor large data volumes efficiently by focusing computational resources only on relevant segments.
2Measurement precision
If separate queries are submitted for each data item in a vast pool, then detection precision is improved, but time consumption and costs increase
Solution Approach 1:
The patent performs preliminary action by generating semantic descriptions and submitting them for monitoring before actual data breaches occur. This advance preparation allows the system to have detection capabilities ready, eliminating the need for time-consuming individual queries when breaches are suspected.
Solution Approach 2:
The patent creates universal semantic descriptions that can represent multiple data items simultaneously. A single semantic description query can monitor numerous data items with similar characteristics, making the monitoring service multi-functional and reducing the total number of queries needed while maintaining detection precision.
3Productivity
If semantic description queries are used to monitor data volumes, then resource efficiency is improved, but the complexity of generating and refining semantic descriptions increases
Solution Approach 1:
The patent implements dynamic semantic descriptions that can be progressively refined based on monitoring results. When breaches are detected, the system automatically adjusts and refines the semantic descriptions to be more specific, creating a dynamic adaptation process that balances resource efficiency with detection accuracy without requiring manual intervention.
4Reliability
If monitoring services are used for unstructured data without key values, then detection capability is improved, but the cost per query increases
Solution Approach 1:
The patent changes the monitoring parameter from exact key value matching to semantic description matching. This parameter change allows the system to effectively monitor unstructured data that lacks traditional key values, while the hierarchical refinement approach keeps the number of expensive queries minimal, thus maintaining cost efficiency.
Data Source
AI summary
The disclosure describes a data protection service that generates semantic descriptions of protected data volumes. The data protection service queries a monitoring service with the generated semantic descriptions. The monitoring service responds to the queries with indications of whether and data items on the dark web match the semantic descriptions. When a query receives a positive response from the monitoring service, the data protection service iteratively refines the semantic description and queries the monitoring service with the refined semantic descriptions until a breach is detected. Once a breach is detected, the data protection service initiates a mitigation action.