Data loss prevention of information using structured document templates and forms
AssigneeSymantec Corporation
InventorSumesh Jaiswal
Life of this patent
Estimating the term…
Abstract
A method and apparatus for identifying information as protected information using a structure is described. A DLP system, incorporating a structure analyzer, monitors outbound data transfers performed by the computing system for violations of a DLP policy. The DLP system analyzes a structure of information contained in an outbound data transfer against a protected structure defined in a DLP policy. The DLP system identifies the information as protected information to be protected by the DLP policy based on the analysis, and, when the information is identified as protected, the DLP system detects a violation of the DLP policy. The protected structure may be derived from document templates, document forms, or from a set of training documents.
Claims20
A method comprising:
- monitoring, by a processing device in a data loss prevention (DLP) system, outbound data transfers performed by a computing system for violations of a DLP policy;
- analyzing a structure of information contained in an outbound data transfer in the outbound data transfers against protected structures defined in the DLP policy, wherein the protected structures are defined based on first structural information extracted from a blank form;
- identifying the information contained in the outbound data transfer as protected based on analyzing the structure using the protected structures;
- and
- detecting a violation of the DLP policy in response to identifying the information as protected.
A system comprising:
- a memory;
- and
- a processing device to communicate with the memory to execute a data loss prevention (DLP) system to:
- monitor outbound data transfers performed by a computing system for violations of a DLP policy;
- analyze a structure of information contained in an outbound data transfer in the outbound data transfers against protected structures defined in the DLP policy, wherein the protected structures are defined based on first structural information extracted from a blank form;
- identify the information contained in the outbound data transfer as protected based on the analysis of the structure using the protected structures;
- and
- detect a violation of the DLP policy in response to the identification of the information as protected.
A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
- monitoring, by the processing device in a data loss prevention (DLP) system, outbound data transfers performed by a computing system for violations of a DLP policy;
- analyzing a structure of information contained in an outbound data transfer in the outbound data transfers against protected structures defined in the DLP policy, wherein the protected structures are defined based on first structural information extracted from a blank form;
- identifying the information contained in the outbound data transfer as protected based on analyzing the structure using the protected structures;
- and
- detecting a violation of the DLP policy in response to identifying the information as protected.
Dependencies are inferred from the claim text.