Intelligent composite and roll-up analysis of en route traffic flow for efficient data loss prevention

1 . A system for obviating inefficient data loss prevention (DLP) due to redundant consideration of individual traffic characteristics of en route traffic flow, comprising:

at least one processor;

a memory coupled to the at least one processor and storing computer-executable instructions, which when executed by the at least one processor, are configured to implement:

a composite analyzer interposed amongst a network of traffic exchangers, and configured to intermediate en route traffic flowing between traffic exchangers in the network of traffic exchangers by:

intercepting an en route traffic flow between a pair of traffic exchangers in the network of traffic exchangers;

detecting a multiplicity of primitive traffic characteristics of the en route traffic flow, wherein the multiplicity of primitive traffic characteristics are data loss inspectable by M data loss inspectors;

together-analyzing the multiplicity of primitive traffic characteristics based on a composite view of the multiplicity of primitive traffic characteristics;

based on the together-analysis of the multiplicity of primitive traffic characteristics, in-line determining that N data loss inspectors satisfy accurate data loss inspection of the en route traffic flow, wherein N is smaller than M; and

in-line selecting the N data loss inspectors, and in-line data loss inspecting the en route traffic flow using the N data loss inspectors.

2 . The system of claim 1 , wherein the multiplicity of primitive traffic characteristics comprises at least one source location of the en route traffic flow.

3 . The system of claim 2 , wherein the N data loss inspectors comprise at least one source region-specific data loss inspector selected based on the at least one source location of the en route traffic flow.

4 . The system of claim 3 , wherein the multiplicity of primitive traffic characteristics comprises at least one destination location of the en route traffic flow.

5 . The system of claim 4 , wherein the N data loss inspectors comprise at least one destination region-specific data loss inspector selected based on the at least one destination location of the en route traffic flow.

6 . The system of claim 5 , wherein the multiplicity of primitive traffic characteristics comprises at least one content indicator identifying a type of content transmitted by the en route traffic flow.

7 . The system of claim 6 , wherein the N data loss inspectors comprise at least one content-specific data loss inspector selected based on the content indicator identifying the type of the content transmitted by the en route traffic flow.

8 . The system of claim 6 , wherein the composite analyzer is further configured with logic to:

determine an originating geographic region of the en route traffic flow in dependence upon the at least one source location of the en route traffic flow;

determine a destination geographic region of the en route traffic flow in dependence upon the at least one destination location of the en route traffic flow;

determine at least one compliance protocol applicable to the type of the content transmitted by the en route traffic flow and/or the type of application facilitating the en route traffic flow; and

making the in-line determination and the in-line selection of the N data loss inspectors based on combination of the originating geographic region, the destination geographic region, and the compliance protocol.

9 . The system of claim 8 , wherein the compliance protocol is at least one of a Payment Card Industry Data Security Standard (PCI DSS) compliance protocol for financial data, a General Data Protection Regulation (GDPR) compliance protocol for personal data, or a Health Insurance Portability and Accountability Act (HIPAA) compliance protocol for health and medical data.

10 . The system of claim 1 , wherein the multiplicity of primitive traffic characteristics comprises at least one application indicator identifying a type of application facilitating the en route traffic flow.

11 . The system of claim 1 , wherein the composite analyzer is further configured to perform the in-line data loss inspection of the en route traffic flow using the N data loss inspectors by in-line analyzing data and metadata of the en route traffic flow to in-line determine compliance of the en route traffic flow with data loss prevention policies of the N data loss inspectors.

12 . A system for obviating inefficient data loss prevention (DLP) due to redundant application of individual data loss inspectors on en route traffic flow, comprising:

at least one processor;

a memory coupled to the at least one processor and storing computer-executable instructions, which when executed by the at least one processor, are configured to implement:

a roll-up analyzer interposed amongst a network of traffic exchangers, and configured to intermediate en route traffic flowing between traffic exchangers in the network of traffic exchangers by:

intercepting an en route traffic flow between a pair of traffic exchangers in the network of traffic exchangers; detecting a multiplicity of primitive traffic characteristics of the en route traffic flow, wherein the multiplicity of primitive traffic characteristics are data loss inspectable by a multiplicity of individual data loss inspectors;

together-analyzing the multiplicity of primitive traffic characteristics based on a rolled-up view of the multiplicity of primitive traffic characteristics;

based on the together-analysis of the multiplicity of primitive traffic characteristics, in-line determining that at least one umbrella data loss inspector satisfies accurate data loss inspection of the en route traffic flow by aggregating functionalities of the multiplicity of individual data loss inspectors; and

in-line selecting the umbrella data loss inspector, and in-line data loss inspecting the en route traffic flow using the umbrella data loss inspector instead of using the multiplicity of individual data loss inspectors.

13 . The system of claim 12 , wherein the multiplicity of primitive traffic characteristics comprises at least one content indicator identifying a type of content transmitted by the en route traffic flow.

14 . The system of claim 13 , wherein the umbrella data loss inspector is a content-specific data loss inspector selected based on the content indicator identifying the type of the content transmitted by the en route traffic flow.

15 . The system of claim 12 , wherein the multiplicity of primitive traffic characteristics comprises at least one application indicator identifying a type of application facilitating the en route traffic flow.

16 . The system of claim 15 , wherein the umbrella data loss inspector is an application-specific data loss inspector selected based on the application indicator identifying the type of the application facilitating the en route traffic flow.

17 . The system of claim 12 , wherein the umbrella data loss inspector is selected from a many-to-one mapping that maps the aggregated functionalities of the multiplicity of individual data loss inspectors to the umbrella data loss inspector.