Context-based sensitive message detection
AssigneePalo Alto Networks, Inc.
InventorsAvishek Bhattacharya, Yaser Karbaschi, Pralay Ramteke, Anirudh Mittal
Life of this patent
Estimating the term…
Abstract
A context-based chat message data loss prevention system (“DLP system”) detects sensitive chat messages communicated via Software-as-a-Service (“SaaS”) applications. The DLP system receives chat messages via SaaS connectors and buffers the chat messages in sliding windows that correspond to context of chat messages within UIs of the SaaS application. The DLP system then filters messages in the sliding windows and classifies the filtered messages with a language model. The resulting sensitive/non-sensitive classifications by the language model thus incorporate chat context for corresponding SaaS applications.
Claims20
A method comprising:
- updating buffers with messages in a sliding window of messages according to context heuristics for the buffers, wherein the context heuristics are heuristics for identifying those chat messages in a sliding window of messages proximal to a first message of the sliding window for different contexts and corresponding to channels and threads with respect to a user interface of a Software-as-a-Service (SaaS) application;
- for each buffer,
- filtering one or more messages from a first plurality of messages in the buffer to obtain a second plurality of messages, wherein filtering the one or more messages from the first plurality of messages is according to entropy of each of the first plurality of messages;
- invoking a language model on the second plurality of messages and the first message to obtain as output a verdict indicating whether the first message comprises sensitive data;
- and
- based on the verdict indicating the first message comprises sensitive data, performing corrective action to prevent data loss from communication of the first message.
A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to:
- update a plurality of buffers with chat messages in a sliding window of messages according to context heuristics for the plurality of buffers, wherein the context heuristics are heuristics for identifying those chat messages in the sliding window of messages proximal to a first message of the sliding window for different contexts corresponding to channels and threads with respect to a user interface of a Software-as-a-Service (SaaS) application;
- for each of the plurality of buffers,
- filter one or more messages from a first plurality of messages in the buffer to obtain a second plurality of messages, wherein filtering the one or more messages from the first plurality of messages is according to entropy of each of the first plurality of messages;
- invoke a language model on the second plurality of messages and the first message to obtain as output a verdict indicating whether the first message comprises sensitive data;
- and
- based on the verdict indicating the first message comprises sensitive data, perform corrective action to prevent data loss from communication of the first message.
An apparatus comprising:
- a processor;
- and
- a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
- update a plurality of buffers with chat messages in a sliding window of messages according to context heuristics for the plurality of buffers, wherein the context heuristics are heuristics for identifying those chat messages in the sliding window of messages proximal to a first message of the sliding window for different contexts corresponding to channels and threads with respect to a user interface of a Software-as-a-Service (SaaS) application;
- for each of the plurality of buffers,
- filter one or more messages from a first plurality of messages in the buffer to obtain a second plurality of messages, wherein filtering the one or more messages from the first plurality of messages is according to entropy of each of the first plurality of messages;
- invoke a language model on the second plurality of messages and the first message to obtain as output a verdict indicating whether the first message comprises sensitive data;
- and
- based on the verdict indicating the first message comprises sensitive data, perform corrective action to prevent data loss from communication of the first message.
Dependencies are inferred from the claim text.