Data loss prevention expression building for a DLP engine
AssigneeZscaler, Inc.
InventorsZhifeng Zhang, Arun Bhallamudi, Pooja Deshmukh
Life of this patent
Estimating the term…
Abstract
Systems and methods include obtaining an expression for a Data Loss Prevention (DLP) engine, wherein the expression includes one or more DLP dictionaries that evaluate to a score for comparison with a corresponding threshold and one or more logical operators used to combine an evaluation of the one or more DLP dictionaries; storing the expression in a database associated with a DLP service; monitoring traffic from one or more users; evaluating the traffic using the DLP engine and the expression; and determining a DLP trigger based on a result of the expression that is a logical TRUE.
Claims18
A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:
- presenting a user interface and receiving an expression including one or more Data Loss Prevention (DLP) dictionaries, a corresponding threshold for comparison, and a selection of one or more logical operators;
- obtaining the expression including the one or more DLP dictionaries, the corresponding threshold for comparison, and the selection of one or more logical operators via the user interface for a DLP;
- storing the expression in a database associated with a DLP service;
- evaluating the one or more DLP dictionaries to a score for comparison with the corresponding threshold, wherein the one or more logical operators are used to combine the evaluation of the one or more DLP dictionaries;
- monitoring traffic from one or more users;
- evaluating the traffic using the DLP engine and the expression;
- and
- determining a DLP trigger based on a result of the expression that is a logical TRUE.
A method comprising:
- presenting a user interface and receiving an expression including one or more Data Loss Prevention (DLP) dictionaries, a corresponding threshold for comparison, and a selection of one or more logical operators;
- obtaining the expression including the one or more DLP dictionaries, the corresponding threshold for comparison, and the selection of one or more logical operators via the user interface for a DLP engine;
- storing the expression in a database associated with a DLP service;
- evaluating the one or more DLP dictionaries to a score for comparison with the corresponding threshold, wherein the one or more logical operators are used to combine the evaluation of the one or more DLP dictionaries;
- monitoring traffic from one or more users;
- evaluating the traffic using the DLP engine and the expression;
- and
- determining a DLP trigger based on a result of the expression that is a logical TRUE.
A cloud-based system comprising:
- a plurality of enforcement nodes each including a micro-processor and a memory connected to one another;
- a central authority connected to the plurality of enforcement nodes;
- and
- a Data Loss Prevention (DLP) service executed between the plurality of enforcement nodes, wherein the DLP service is configured to:
- present a user interface and receive an expression including one or more Data Loss Prevention (DLP) dictionaries, a corresponding threshold for comparison, and a selection of one or more logical operators;
- obtain the expression including the one or more DLP dictionaries, the corresponding threshold for comparison, and the selection of one or more logical operators via the user interface for a DLP;
- store the expression in a database associated with the DLP service;
- evaluate the one or more DLP dictionaries to a score for comparison with the corresponding threshold, wherein the one or more logical operators are used to combine the evaluation of the one or more DLP dictionaries;
- monitor traffic from one or more users;
- evaluate the traffic using the DLP engine and the expression;
- and
- determine a DLP trigger based on a result of the expression that is a logical TRUE.
Dependencies are inferred from the claim text.