Statistical Heuristics for Data Validation False Positive Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data Loss Prevention (DLP) systems face a high administrative burden due to false positives when using pattern matching methods, which can decrease their effectiveness in identifying and protecting sensitive data.
Innovation Solution
A method and system that uses statistical heuristics to validate data by extracting strings matching a predetermined regular expression, identifying a validated subset, and determining whether this subset satisfies specific criteria to reduce false positives, employing measures like Valid Expected Ratio, Valid Consecutive Sequence, and Valid Neighborhood to assess the likelihood of false detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern matching with validation function is used to improve detection accuracy, then sensitivity to sensitive data is improved, but false positives increase
Solution Approach 1:
The system dynamically adjusts the confidence threshold based on the validation function's characteristics and the specific data context. Rather than using a fixed threshold, the threshold adapts to the validation function's false positive rate, allowing the system to optimize between detection sensitivity and false positive reduction for different validation scenarios.
Solution Approach 2:
The invention changes the parameter of confidence threshold from a fixed value to a dynamically determined value based on validation function analysis. By calculating the expected number of false positives using the validation function's characteristics and comparing against a threshold, the system adjusts its detection criteria to maintain accuracy while reducing false alarms.
2Reliability
If strict validation criteria are applied to reduce false positives, then reliability is improved, but detection sensitivity decreases
Solution Approach 1:
The system dynamically adjusts the confidence threshold based on the validation function's characteristics and the specific data context. Rather than using a fixed threshold, the threshold adapts to the validation function's false positive rate, allowing the system to optimize between detection sensitivity and false positive reduction for different validation scenarios.
Solution Approach 2:
The invention changes the parameter of confidence threshold from a fixed value to a dynamically determined value based on validation function analysis. By calculating the expected number of false positives using the validation function's characteristics and comparing against a threshold, the system adjusts its detection criteria to maintain accuracy while reducing false alarms.
3Measurement precision
If multiple validation functions are used to improve accuracy, then detection precision is improved, but system complexity increases
Solution Approach 1:
The system applies validation functions selectively rather than uniformly to all detected patterns. By determining whether a validation function is applicable based on the pattern type and context, the system avoids unnecessary validation steps, reducing complexity while maintaining high detection accuracy for relevant patterns.
Solution Approach 2:
Different validation functions are applied to different pattern types based on their specific characteristics. The system tailors the validation approach to each pattern's requirements, using appropriate validation functions only where needed, thereby optimizing detection accuracy without uniformly increasing system complexity across all validation scenarios.
Data Source
AI summary
To validate data, a plurality of strings that match a predetermined regular expression is extracted from the data. A validated subset of the strings is identified. To determine whether the validated subset has been falsely validated, it is determined whether the validated subset satisfies each of one or more predetermined criteria relative to the plurality of strings. In one embodiment, the subset is determined to be falsely validated if at least one of the criteria is satisfied. In another embodiment, the subset is determined to be falsely validated if all of the criteria are satisfied. The data are released only if the subset is determined to be falsely validated.