Scripting Engine for Data Leak Prevention Accuracy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data leak prevention products face challenges in accurately detecting sensitive identification numbers and handling sophisticated requests, leading to false positives and negatives, especially when dealing with large entities and unique validation procedures, and struggle to categorize documents based on security sensitivity effectively.
Innovation Solution
Embedding a scripting language processing engine into data leak prevention applications allows for customizable detection and validation of sensitive data types using mathematical procedures and algorithms, enabling accurate detection of identification numbers and enhanced sensitivity categorization without requiring extensive resource usage or updates to existing software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a dictionary of all valid identification numbers is created to accurately detect sensitive data, then detection accuracy is improved, but RAM and hard disk resources are excessively consumed
Solution Approach 1:
The patent transforms the detection approach from storing actual identification number values to storing validation parameters and mathematical procedures. Instead of keeping a dictionary of all valid numbers, the system stores validation rules (parameters) that can verify any identification number on-demand, dramatically reducing memory requirements while maintaining detection accuracy.
Solution Approach 2:
The patent creates a virtual copy of the validation logic rather than storing actual data copies. By embedding scripting language processing engines that can execute validation procedures, the system replicates the ability to verify identification numbers without duplicating the actual identification number data, thus reducing resource consumption.
2Quantity of substance
If regular expressions are used to detect identification numbers, then resource usage is reduced, but false positives increase significantly
Solution Approach 1:
The patent segments the detection process into two stages: first using regular expressions to identify potential identification number patterns (low-resource initial filter), then applying scripting language processing engines to validate those patterns against organization-specific procedures (accurate verification). This segmentation allows the system to benefit from both approaches without suffering their respective drawbacks.
Solution Approach 2:
The scripting language processing engine acts as an intermediary between the regular expression detection and the final validation decision. It receives potential matches from regex patterns and applies organization-specific validation procedures, serving as a mediator that eliminates false positives while maintaining resource efficiency.
3Productivity
If the threshold for triggering data leak prevention action is lowered to detect more sensitive documents, then detection coverage is improved, but false positives increase
Solution Approach 1:
The patent implements dynamic threshold adjustment based on validation results. The system can adaptively modify detection thresholds depending on the confidence level of validation procedures, the type of identification number detected, and organizational policies. This dynamic approach allows the system to maintain high detection coverage while reducing false positives through context-aware threshold management.
4Measurement precision
If custom validation procedures are implemented for each organization's identification numbers, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The patent creates a universal scripting language processing engine that can execute any organization's custom validation procedures through a standardized interface. The engine itself is universal and reusable, while the validation logic it executes can be customized for different organizations. This separation of universal infrastructure from custom validation logic reduces overall system complexity.
Solution Approach 2:
The system enables organizations to define and update their own validation procedures through configurable parameters and scripts without requiring changes to the core detection engine. Organizations can self-configure their validation rules, making the system adaptable to different organizational needs without increasing core system complexity.
Data Source
AI summary
A data leak prevention application that categorizes documents by data type is provided, a data type being a sensitivity classification of a document based on what data the document contains. A scripting language processing engine is embedded into the data leak prevention application, the scripting language forming part of the application as hard code. A user configures interaction of the scripting language processing engine with the application. The configuring may include modifying or adding code or setting criteria for when code portions of the scripting language processing engine activates. The scripting language processing engine is activated to enhance an accuracy of an existing data type or so as to detect a new data type. Upon enhancing the accuracy of the data type, documents may be re-categorized.