US 2025/0330487 A1 · Data Exfiltration Monitoring Using Semantic Queries

Abstract

The disclosure describes a data protection service that generates semantic descriptions of protected data volumes. The data protection service queries a monitoring service with the generated semantic descriptions. The monitoring service responds to the queries with indications of whether and data items on the dark web match the semantic descriptions. When a query receives a positive response from the monitoring service, the data protection service iteratively refines the semantic description and queries the monitoring service with the refined semantic descriptions until a breach is detected. Once a breach is detected, the data protection service initiates a mitigation action.

Claims20

Dependent claims

A method of operating a data protection service, comprising:

generating a semantic description of a data volume;
querying a monitoring service with the semantic description;
determining, based on results received from the monitoring service, to iteratively, until determining that a breach occurred:
refine the semantic description to be more specific;
query the monitoring service with the semantic description, and
determine whether the breach occurred based on results received from the monitoring service in response to the semantic description;
and
upon determining that the breach occurred, initiating a mitigation action.

5 more elements

A system for operating a data protection service, the system comprising:

one or more processors;
and
one or more memories operably coupled to the one or more processors and having stored thereon software instructions that, upon execution by the one or more processors, cause the one or more processors to:
generate a semantic description of a data volume;
query a monitoring service with the semantic description;
determine, based on results received from the monitoring service, to iteratively, until determining that a breach occurred:
refine the semantic description to be more specific;
query the monitoring service with the semantic description, and
determine whether the breach occurred based on results received from the monitoring service in response to the semantic description;
and
upon determining that the breach occurred, initiate a mitigation action.

8 more elements

A computer-readable storage media having program instructions stored thereon to operate a data protection service, wherein the program instructions, upon execution by one or more processors, cause the one or more processors to:

generate a semantic description of a data volume;
query a monitoring service with the semantic description;
determine, based on results received from the monitoring service, to iteratively, until determining that a breach occurred:
refine the semantic description to be more specific;
query the monitoring service with the semantic description, and
determine whether the breach occurred based on results received from the monitoring service in response to the semantic description;
and
upon determining that the breach occurred, initiate a mitigation action.

5 more elements

Dependencies are inferred from the claim text.

Data Exfiltration Monitoring Using Semantic Queries

Life of this patent

Data Exfiltration Monitoring Using Semantic Queries

Life of this patent

Abstract

Claims20