Tuning of data loss prevention signature effectiveness

A system comprising:

• a data loss prevention sensor having a signature set containing a plurality of signatures each capable of causing an alert for any data packet passing through said data loss prevention sensor;
• a non-transitory computer readable storage medium for storing an alert database in communication with said data loss prevention sensor;
• an analytics module in communication to said computer readable storage medium, said analytics module analyzes at least one alert database present on said computer storage medium to determine whether any signatures from the signature set associated with the alert database being analyzed are ineffective based at least on a ratio of valid alerts to false positive alerts for individual signatures selected from a group including a plurality of signatures present in the signature set;
• and
• an adjustment module in communication to said computer readable storage medium and said analytics module, said adjustment module removes at least one ineffective signature from the signature set, wherein said analytics module determines whether one signature is ineffective by quantifying each signature having the ratio less than a quantification threshold by:
• removing iteratively from the signature set each signature having the ratio less than the quantification threshold,
• applying the modified signature set against the packets present in the alerts database, and determining at least one attribute for the removed signature.

A computer program product for fine tuning a signature set for a data loss protection system, said computer program product comprising:

• a non-transitory computer readable storage medium having stored thereon:
• first program instructions executable by a processor to cause the processor to quantify each signature contained in the signature set an effect on the change in the number of alerts from its removal;
• second program instructions executable by a processor to cause the processor to determine with an analytics module whether any signature has a ratio of valid to false positive alerts less than a first threshold;
• and
• third program instructions executable by a processor to cause the processor to identify and removing with an adjustment module at least one signature from the signature database having a ratio less than the first threshold where the signature is removed from the signature set when at least one signature has the ratio less than the first threshold, and
• fourth program instructions executable by a processor to cause the processor to perform each of said program instructions at least once when at least one signature has the ratio less than the first threshold, wherein quantifying includes for each signature having the ratio less than a second threshold:
• removing from the signature set that signature,
• applying the modified signature set against the packets present in the alerts database, and determining at least one attribute for the signature.

A computer program product for fine tuning a signature set for a data loss protection system, said computer program product comprising:

• a non-transitory computer readable storage medium having stored thereon:
• first program instructions executable by a processor to cause the processor to receive an alert validity attribute for a plurality of alerts in an alert database from a user;
• second program instructions executable by a processor to cause the processor to quantify each signature contained in the signature set having a ratio of valid to false positive alerts less than a quantification threshold, where quantifying for each signature an effect on the change in the number of alerts from its removal;
• third program instructions executable by a processor to cause the processor to determine with an analytics module whether any signature has a ratio of valid to false positive alerts less than a remove threshold;
• and
• fourth program instructions executable by a processor to cause the processor to identify and remove with an adjustment module the first signature present on a reordered list of signatures determined by said third program instructions based on at least one attribute quantified by said second program instructions, and
• fifth program instructions executable by a processor to cause the processor to perform each of said program instructions at least once when at least one signature has the ratio less than the remove threshold, wherein quantifying includes for each signature having the ratio less than a second threshold:
• removing from the signature set that signature,
• applying the modified signature set against the packets present in the alerts database, and determining at least one attribute for the signature.