Tuning of data loss prevention signature effectiveness

A method comprising:

• gaining access to an alert database and a signature set by an analytics module and an adjustment module, where the alert database includes whether each alert is a valid alert or a false positive alert;
• quantifying for each signature contained in the signature set an effect on the change in the number of alerts from its removal;
• determining with an analytics module whether any signature has a ratio of valid to false positive alerts less than a first threshold;
• and
• when at least one signature has the ratio less than the first threshold
• identifying and removing with an adjustment module at least one signature from the signature database having a ratio less than the first threshold where the signature is removed from the signature set, and
• repeating quantifying and determining;
• the method further comprising:
• annotating at least one signature in the signature set with a signature weighting;
• including in the metadata for any alert the signature's signature weighting;
• and
• removing from quantifying any signature having its signature weighting above a value threshold.

A method comprising:

• creating an alert database having a plurality of alerts each alert resulting from a determination by a data loss prevention sensor that a packet matches at least one signature in a signature set and each alert having an associated alert validity attribute;
• quantifying for each signature contained in the signature set an effect on the change in the number of alerts from its removal by
• removing from the signature set that signature,
• applying the modified signature set against the packets present in the alerts database, and
• determining at least one attribute for the signature;
• determining with an analytics module whether any signature has a ratio of valid to false positive alerts less than a threshold;
• when at least one signature has the ratio less than the threshold
• identifying and removing with an adjustment module at least one signature having a ratio less than the threshold where the signature is removed from the signature set, and repeating quantifying and determining;
• and
• when no signature has the ratio less than the threshold, repeat the method;
• the method further comprising:
• annotating at least one signature in the signature set with a signature weighting;
• including in the metadata for any alert the signature's signature weighting;
• and
• removing from quantifying any signature having its signature weighting above a value threshold.

A method comprising:

• creating an alert database having a plurality of alerts each alert resulting from a determination by a data loss prevention sensor that a packet matches at least one signature in a signature set and each alert having an associated alert validity attribute;
• quantifying for each signature contained in the signature set an effect on the change in the number of alerts from its removal by
• removing from the signature set that signature,
• applying the modified signature set against the packets present in the alerts database, and
• determining at least one attribute for the signature, where the at least one attribute includes a total number of unique alerts representing alerts not selected by not applying the removed rule, a number of associated unique valid alerts, and a number of associated unique false positive alerts;
• determining with an analytics module whether any signature has a ratio of unique valid to unique false positive alerts less than a unique threshold;
• when at least one signature has the unique ratio less than the unique threshold
• identifying and removing with an adjustment module at least the first signature in an ordered list of signatures based on the unique ratios of the signatures, where the first signature is removed from the signature set, and
• repeating quantifying and determining;
• and
• when no signature has the ratio less than the threshold, repeat the method;
• the method further comprising:
• annotating at least one signature in the signature set with a signature weighting;
• including in the metadata for any alert the signature's signature weighting;
• and
• at least one of removing from quantifying any signature having its signature weighting above a value threshold or for each signature after it has been quantified, modifying its ratio by its signature weighting.