Data leak protection in upper layer protocols

A non-transitory program storage device of a network security device, embodying a program of instructions executable by one or more computer processors of the network security device to perform a method of data leak prevention (DLP), the method comprising:

• receiving a packet originated by a host device within a private network protected by the network security device and directed to a destination device outside of the private network;
• identifying an upper layer protocol associated with the received packet;
• determining whether the identified upper layer protocol is one of a plurality of candidate upper layer protocols having a potential to carry sensitive information out of the private network with reference to a database containing therein information regarding the plurality of candidate upper layer protocols, one or more corresponding requests or commands of interest for each of the plurality of candidate upper layer protocols and a corresponding suspect field within each of the one or more corresponding requests or commands of interest that is to be subjected to DLP scanning;
• when a result of the determining is affirmative and a request or command represented by the received packet is among those of the one or more corresponding requests or commands of interest for the identified upper layer protocol, then performing a DLP scan on content contained within the corresponding suspect field of the received packet by:
• applying a plurality of DLP rules to the content, wherein each of the plurality of DLP rules include (i) a regular expression or a string defining a search pattern indicative of existence of one of a plurality of forms of sensitive information and (ii) information defining an action to take when the search pattern matches the content;
• and
• when a match is found between the content and the search pattern of a DLP rule of the plurality of DLP rules, then performing the defined action of the DLP rule;
• and
• when the result is negative or the request or command represented by the received packet is not among those of the one or more corresponding requests or commands of interest for the identified upper layer protocol, then skipping performance of the DLP scan for the received packet;
• wherein the one or more corresponding requests or commands of interest for each of the plurality of candidate upper layer protocols are configurable by a network administrator of the private network.