Sensitive Data Leakage Detection in Log Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for identifying sensitive data in log data are complex and prone to false alarms, especially when the sensitive data lacks a well-formed structure, leading to potential leakage and compromise of secure environments.
Innovation Solution
The use of data classification tags to designate sensitive or public data within messages, with analysis modules sampling incoming messages, storing sensitive data values as watch data, and searching log data for these values to detect leaks, allowing for timely security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing systems are used to identify sensitive data in log data, then detection capability is provided, but system complexity increases and false alarms occur
Solution Approach 1:
The patent extracts only the essential identifying characteristics of sensitive data (such as specific data formats, patterns, or tagged elements) rather than attempting to analyze the entire log data structure. This extraction approach simplifies the detection system while maintaining accuracy by focusing on key discriminators that differentiate sensitive from non-sensitive data.
Solution Approach 2:
The detection system is segmented into modular components: data classification tags that mark sensitive information, sampling modules that select representative log entries, and analysis modules that evaluate specific segments. This segmentation reduces overall system complexity by breaking down the detection task into manageable, independent units that can be processed separately.
2Reliability
If comprehensive logging is performed to monitor sensitive data, then security monitoring is improved, but computational overhead increases
Solution Approach 1:
The system performs partial monitoring by sampling only a subset of log data rather than analyzing every single log entry. The sampling module selects representative portions of log data for analysis, providing sufficient security monitoring coverage while significantly reducing computational overhead compared to comprehensive analysis of all log data.
Solution Approach 2:
Data classification tags are applied to sensitive information before it is logged, performing the classification action in advance. This preliminary tagging allows the monitoring system to quickly identify and focus on potentially sensitive data without requiring complex real-time analysis of all log entries, thereby reducing computational overhead while maintaining monitoring effectiveness.
3Reliability
If log data is stored in secure environments, then data security is improved, but storage costs and operational complexity increase
Solution Approach 1:
The patent applies different security qualities to different types of data locally. Sensitive data identified through classification tags can be stored with enhanced security measures, while non-sensitive log data is stored in less secure, lower-cost environments. This local differentiation of security quality allows the system to maintain overall data security while reducing storage costs and operational complexity by not applying uniform high-security measures to all log data.
Data Source
AI summary
Techniques determine and mitigate leakage of sensitive data into log data. The message is parsed to identify a first value and a first data classification tag indicative of sensitive data and that refers to the first value. Log data is accessed to determine whether the first value is present in the log data. One or more actions are performed based on the first value being present in the log data.