Sensitive data detection using domain-enhanced attention neural networks

1 . A method for sanitizing sensitive data, the method comprising:

retrieving, by a processor, training data comprising a plurality of tuples, wherein the each of the plurality of tuples comprises a first parameter and a second parameter, and wherein the first parameter comprises a string associated with an application event and the second parameter comprises a sanitization label;

for each tuple of the plurality of tuples:

matching, by the processor, a substring in the first parameter of the respective tuple to at least one keyword of a plurality of keywords;

identifying, by the processor, a security category corresponding to the at least one keyword; and

expanding, by the processor, the first parameter of the respective tuple to comprise a respective string associated with the application event and the security category;

training, by the processor, a model to detect sensitive data from the application event using the plurality of tuples, including an expanded first parameter for each tuple of the plurality of tuples, wherein the model is configured to implement a deep neural network including a special attention mechanism; and

sanitizing, by the processor, the sensitive data using the trained model, wherein the sanitizing comprises:

identifying, by the processor, using the trained model, the sensitive data in the application event and a sensitivity level of the sensitive data;

in response to the sensitivity level indicating low sensitivity for at least a subset of the sensitive data, identifying, by the processor, using the trained model, an encryption technique based on the amount of data in the subset of the sensitive data and a minimum required level of security; and

encrypting, by the processor, the subset of the sensitive data using the encryption technique.

2 . The method of claim 1 , wherein the special attention mechanism comprises a fixed special attention weight.

3 . The method of claim 1 , further comprising: repeating the security category an m number of times in the expanded first parameter for the respective tuple.

4 . The method of claim 1 , further comprising:

receiving, by the processor, an application event string;

identifying, by the processor, using the trained model, a security category associated with the application event string;

identifying, by the processor, using the trained model, sensitive data included in the application event string to be sanitized;

determining, by the processor, using the trained model, a sanitization type;

sanitizing, by the processor, using the model, the sensitive data in the application event string, based on the sanitization type; and

storing, by the processor, a sanitized application event string in a data storage device.

5 . The method of claim 4 , wherein the sanitization type comprises redaction, pruning, or encrypting data.

6 . The method of claim 4 , wherein determining the sanitization type is based on a level of sensitivity of the sensitive data.

7 . The method of claim 1 , wherein the first parameter of each tuple of the plurality of tuples is a domain-specific signal.

8 . A system for sanitizing sensitive data, the system comprising:

a processor coupled to a memory, wherein the processor is configured to:

retrieve training data comprising a plurality of tuples, wherein the each of the plurality of tuples comprises a first parameter and a second parameter, and wherein the first parameter comprises a string associated with an application event and the second parameter comprises a sanitization label;

for each tuple of the plurality of tuples:

match a substring in the first parameter of the respective tuple to at least one keyword of a plurality of keywords;

identify a security category corresponding to the at least one keyword; and

expand the first parameter of the respective tuple to comprise a respective string associated with the application event and the security category;

train a model to detect the sensitive data from the application event using the plurality of tuples, including an expanded first parameter for each tuple of the plurality of tuples, wherein the model is configured to implement a deep neural network including a special attention mechanism; and

sanitize the sensitive data using the trained model by:

identifying the sensitive data in the application event and a sensitivity level of the sensitive data;

in response to the sensitivity level indicating low sensitivity for at least a subset of the sensitive data, identifying an encryption technique based on the amount of data in the subset of the sensitive data and a minimum required level of security; and

encrypting the subset of the sensitive data using the encryption technique.

9 . The system of claim 8 , wherein the special attention mechanism comprises a fixed special attention weight.

10 . The system of claim 8 , wherein the processor is further configured to repeat security the category an m number of times in the expanded first parameter for the respective tuple.

11 . The system of claim 8 , wherein the processor is further configured to:

receive an application event string;

identify, using the trained model, a security category associated with the application event string;

identify, using the trained model, sensitive data included in the application event string to be sanitized;

determine, using the trained model, a sanitization type;

sanitize, using the trained model, the sensitive data in the application event string, based on the sanitization type; and

store a sanitized application event string in a data storage device.

12 . The system of claim 11 , wherein the sanitization type comprises redaction, pruning, or encrypting data.

13 . The system of claim 11 , wherein determining the sanitization type is based on a level of sensitivity of the sensitive data.

14 . The system of claim 8 , wherein the first parameter of each tuple of the plurality of tuples is a domain-specific signal.

15 . A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:

retrieving training data comprising a plurality of tuples, wherein each of the plurality of tuples comprises a first parameter and a second parameter, and wherein the first parameter comprises a string associated with an application event and the second parameter comprises a sanitization label;

for each tuple of the plurality of tuples:

matching a substring in the first parameter of the respective tuple to at least one keyword of a plurality of keywords;

identifying a security category corresponding to the at least one keyword; and

expanding the first parameter of the respective tuple to comprise a respective string associated with the application event and the security category;

training a model to detect sensitive data from the application event using the plurality of tuples, including an expanded first parameter for each tuple of the plurality of tuples, wherein the model is configured to implement a deep neural network including a special attention mechanism; and

sanitizing the sensitive data using the trained model, wherein the sanitizing comprises:

identifying the sensitive data in the application event and a sensitivity level for the sensitive data;

in response to the sensitivity level indicating low sensitivity for at least a subset of the sensitive data, identifying an encryption technique based on the amount of data in the subset of the sensitive data and a minimum required level of security; and

encrypting the subset of the sensitive data using the encryption technique.

16 . The non-transitory computer-readable medium of claim 15 , wherein the special attention mechanism comprises a fixed special attention weight.

17 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise repeating the security category an m number of times in the expanded first parameter for the respective tuple.

18 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:

receiving an application event string;

identifying, using the trained model, a security category associated with the application event string;

identifying, using the trained model, sensitive data included in the application event string to be sanitized;

determining, using the trained model, a sanitization type;

sanitizing, using the trained model, the sensitive data in the application event string, based on the sanitization type; and

storing the event string including the sanitization label in a data storage device.

19 . The non-transitory computer-readable medium of claim 18 , wherein the sanitization type comprises redaction, pruning, or encrypting data.

20 . The non-transitory computer-readable medium of claim 18 , wherein determining the sanitization type is based on a level of sensitivity of the sensitive data.