Enriched document-sensitivity metadata using contextual information

A proxy system positioned on a network separate from a user and a cloud-based provider including one or more processors coupled to memory, the memory loaded with computer instructions to efficiently classify, using a document handle generated by cloud-based provider services to encode, from a document type as opposed to a file type, sensitivity of documents generated by and downloaded from the cloud-based provider services to save analysis time during later Data Loss Prevention (DLP) analysis to prevent exfiltration, the instructions, when executed on the processors, implement actions comprising:

• monitoring network traffic using an inline proxy that is independent and not provided by a cloud-based provider of service, wherein the traffic includes a web page, the web page including:
• a link for a user to select to download the document generated by the cloud-based services,
• a domain name, and
• an API parameter string that includes the document handle;
• using the domain name to select a parser adapted for the cloud-service provider;
• the parser parsing the network traffic, generated in response to a user selecting the link requesting the download of the document, to identify the document handle from the API parameter string;
• determining a sensitivity classification from the identified document handle;
• and
• encoding the determined sensitivity classification into header metadata that is part of the document,
• whereby the encoded sensitivity classification travels with the document and enables exfiltration policy enforcement in a way that saves enforcement processing time, based on acquiring the encoded sensitivity classification from the document header metadata.

A non-transitory computer readable storage medium impressed with computer program instructions to efficiently classify, using a document handle generated by cloud-based provider services to encode, from a document type as opposed to a file type, sensitivity of documents generated by and downloaded from the cloud-based provider services to save analysis time during later Data Loss Prevention (DLP) analysis to prevent exfiltration, the instructions, when executed on a processor of a proxy positioned on a network separate from a user and the cloud-based provider, implement a method comprising:

• monitoring network traffic using an inline proxy that is independent and not provided by a cloud-based provider of service, wherein the traffic includes a web page, the web page including:
• a link for a user to select to download the document generated by the cloud-based services,
• a domain name, and
• an API parameter string that includes the document handle;
• using the domain name to select a parser adapted for the cloud-service provider;
• the parser parsing the network traffic, generated in response to a user selecting the link requesting the download of the document, to identify the document handle from the API parameter string;
• determining a sensitivity classification from the identified document handle;
• and
• encoding the determined sensitivity classification into header metadata that is part of the document,
• whereby the encoded sensitivity classification travels with the document and enables exfiltration policy enforcement in a way that saves enforcement processing time, based on acquiring the encoded sensitivity classification from the document header metadata.

A method of efficiently pre-classifying, using a file handle generated by a cloud-based provider service to encode, from a document type as opposed to a file type, sensitivity of a file downloaded from the cloud-based provider service, to save analysis time during later Data Loss Prevention (DLP) analysis to prevent exfiltration and including actions of:

• monitoring network traffic using an inline proxy that is independent and not provided by a cloud-based provider of service, wherein the traffic includes a web page, the web page including:
• a link for a user to select to download a file generated by the cloud-based provider of services,
• a domain name, and
• an API parameter string that includes the file handle;
• using the domain name to select a parser adapted for the cloud-service provider;
• parsing the network traffic, generated in response to a user selecting the link requesting the download of the file, to identify the file handle from the API parameter string;
• encoding the determined sensitivity classification into header metadata that is part of the file,
• whereby the encoded sensitivity classification travels with the file and enables exfiltration policy enforcement in a way that saves enforcement processing time, based on acquiring the encoded sensitivity classification from the file header metadata.