Data leak protection in upper layer protocols

A non-transitory program storage device readable by a network security appliance, tangibly embodying a program of instructions executable by one or more computer processors of the network security appliance to perform a method of data leak prevention (DLP), the method comprising:

• maintaining a data structure identifying therein a plurality of candidate upper layer protocols, one or more corresponding requests or commands of interest for each of the plurality of candidate upper layer protocols and a corresponding suspect field contained within each of the one or more corresponding requests or commands of interest that is to be subjected to DLP scanning as a result of its potential for carrying sensitive information out of a private network protected by the network security appliance;
• receiving a packet originated by a host device within the private network and directed to a destination device outside of the private network;
• identifying an upper layer protocol associated with the received packet based on a destination port specified in a header of the received packet or information contained in a protocol field of the header;
• determining whether the identified upper layer protocol is among the plurality of candidate upper layer protocols;
• when a result of the determining is affirmative and a request or command represented by the received packet is among those of the one or more corresponding requests or commands of interest for the candidate upper layer protocol, then performing a DLP scan on the received packet by:
• extracting a content from the corresponding suspect field contained within the received packet;
• applying a plurality of DLP rules to the extracted content, wherein each of the plurality of DLP rules are defined in terms of (i) one or more of a regular expression and a string that are configured to detect existence of one or more forms of sensitive information and (ii) information defining an action to take when one or more conditions associated with the DLP rule are satisfied;
• and
• when said applying results in a conclusion that the one or more forms of sensitive information are contained within the received packet, then performing, by the network security appliance, the defined action;
• and
• when the result is negative or the request or command represented by the received packet is not among those of the one or more corresponding requests or commands of interest for the candidate upper layer protocol, then allowing the received packet to pass through the network security appliance without performing the DLP scan on the received packet.