Data Loss Prevention Based on Text Classification in Controlled Environments

Kongsgard, Kyrre Wahl; Nordbotten, Nils Agne; Mancini, Federico; Engelstad, Paal E.

doi:10.1007/978-3-319-49806-5_7

Cited by 7 publications

(7 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Similar studies later reproduced and expanded upon these results [6], [15], [1] by using the complete document contents, multiple securityclassification levels and per-paragraph sensitivity predictions, while the concept of controlled environments was introduced by us in [8].…”

Section: Related Workmentioning

confidence: 72%

“…While previous work looked at building classifiers for complete documents [8], we have extended these methods to work for shorter messages, which is a more difficult case.…”

Section: Discussionmentioning

confidence: 99%

“…Estimating the sensitivity for completely new [3], [6], [15] or heavily processed (rewritten, summarized etc.) [8] information on the other hand is more challenging and is better handled using machine learning. By presenting the algorithm with examples of known classified and unclassified documents it will attempt to infer which features that are associated with each of the target classes (classification levels).…”

Section: Machine Learning-based Content Checkingmentioning

confidence: 99%

“…The set of imported documents, e.g., those accessed by the user during a session, is defined as input, and any new document(s) generated within the controlled environemnt is defined as output. By using the set of input documents as basis for the classifier, thereby reducing the noise in the classification process as the input documents are more relevant to the output, we can more accurately estimate the classification of output documents [8]. Our proposed solution inspects the information flow to the controlled environment as shown in Figure 2b, and estimates the classification of output documents based on the information about the input documents.…”

Section: B Controlled Environmentsmentioning

confidence: 99%

“…From this repository we extracted the three sub-collections: These were chosen because they contained a mix of both classified and unclassified documents from unrelated domains and from partially overlapping time periods. We train the classifiers (l 2 -regularized logistic regression) on documents, from the Digital Nation Security Archive (DNSA) data set [8], that were imported into a controlled environment and then evaluate the performance on the corresponding abstracts (these are removed from the input documents). This procedure simulates how (potentially classified) information is transformed into new documents.…”

Section: B Controlled Environmentsmentioning

confidence: 99%

See 4 more Smart Citations

Data Leakage Prevention for Secure Cross-Domain Information Exchange

et al. 2017

Self Cite

View full text Add to dashboard Cite

Abstract-Cross-domain information exchange is an increasingly important capability for conducting efficient and secure operations, both within coalitions and within single nations. A data guard is a common cross-domain sharing solution that inspects and validates that the security labels of exported data objects are such that they can be released according to policy. While we see that guard solutions can be implemented with high assurance, we find that obtaining an equivalent level of assurance in the correctness of the security labels easily becomes a hard problem in practical scenarios. Thus, a weakness of the guardbased solution is that there is often limited assurance in the correctness of the security labels. To mitigate this, guards make use of content checkers such as dirty word lists as a means for detecting mislabeled data.To improve the overall security of such cross-domain solutions we investigate more advanced content checkers based on the use of machine learning. Instead of relying on manually specified dirty word lists, we can build data-driven methods that automatically infer the words associated with classified content. However, care must be taken when constructing and deploying these methods as naive implementations are vulnerable to manipulation attacks. In order to provide a better context for performing classification, we monitor the incoming information flow and use the audit trail to construct controlled environments. The usefulness of said deployment scheme is demonstrated using a real collection of classified and unclassified documents.

show abstract

Section: Related Workmentioning

confidence: 72%

“…While previous work looked at building classifiers for complete documents [8], we have extended these methods to work for shorter messages, which is a more difficult case.…”

Section: Discussionmentioning

confidence: 99%

Section: Machine Learning-based Content Checkingmentioning

confidence: 99%

Section: B Controlled Environmentsmentioning

confidence: 99%

Section: B Controlled Environmentsmentioning

confidence: 99%

See 3 more Smart Citations

Data Leakage Prevention for Secure Cross-Domain Information Exchange

et al. 2017

Self Cite

View full text Add to dashboard Cite

show abstract

Apply Lagrange Interpolation Based Access Control Mechanism in Personal Health Record Medical System

Tai

Chiang

Chuang

et al. 2019

Lecture Notes in Networks and Systems

View full text Add to dashboard Cite

Predicting likelihood of legitimate data loss in email DLP

Faiz

Arshad

Alazab

et al. 2020

Future Generation Computer Systems

View full text Add to dashboard Cite

The volume and variety of data collected for modern organizations has increased significantly over the last decade necessitating the detection and prevention of disclosure of sensitive data. Data loss prevention is an embedded process used to protect against disclosure of sensitive data to external uncontrolled environments. A typical Data Loss Prevention (DLP) system uses custom policies to identify and prevent accidental and malicious data leakage producing large number of security alerts including significant volume of false positives. Consequently, identifying legitimate data loss can be very challenging as each incident comprises of different characteristics often requiring extensive intervention by a domain expert to review alerts individually. This limits the ability to detect data loss alerts in real-time making organisations vulnerable to financial and reputational damages. The aim of this research is to strengthen data loss detection capabilities of a DLP system by implementing a machine learning model to predict the likelihood of legitimate data loss. We conducted extensive experimentation using Decision Tree and Random Forest algorithms with historical email incident data collected by a globally established telecommunication enterprise. The final model produced with Random Forest algorithm was identified as the most effective as it was successfully able to predict approximately 95% data loss incidents accurately with an average true positive value of 90%. Furthermore, the proposed solution successfully enables identification of legitimate data loss in email DLP whilst facilitating prioritisation of real data loss through human-understandable explanation of the decision thereby improving the efficiency of the process.

show abstract

Data Loss Prevention Based on Text Classification in Controlled Environments

Cited by 7 publications

References 14 publications

Data Leakage Prevention for Secure Cross-Domain Information Exchange

Data Leakage Prevention for Secure Cross-Domain Information Exchange

Apply Lagrange Interpolation Based Access Control Mechanism in Personal Health Record Medical System

Predicting likelihood of legitimate data loss in email DLP

Contact Info

Product

Resources

About