Probabilistic fingerprint checking for preventing data leakage
A data-leakage prevention capability is presented herein. The data-leakage prevention capability prevents leakage of data, of a file set having a plurality of files, from a secure network using online fingerprint checking of data flows at a boundary of the secure network. The online fingerprint checking is performed using a set of data structures configured for the file set. The data structures for the file set are configured based on file set characteristics information of the file set and a target detection lag indicative of a maximum number of bits within which a data leakage event for the file set is to be determined. The data structure configuration is computed for a plurality of data structures configured for use in monitoring the files of the file set. The data structure configuration includes a plurality of data structure locations and data structure sizes for the respective plurality of data structures.
1. An apparatus, comprising:
a processor and a memory communicatively coupled to the processor, the processor configured to:
receive file set characteristics information of a file set comprising a plurality of files;
receive a target detection lag indicative of a maximum number of bits within which a data leakage event for the file set is to be determined; and
compute, based on the file set characteristics information and the target detection lag, a data structure configuration for a plurality of data structures configured for use in monitoring the files of the file set, wherein the data structure configuration comprises a plurality of data structure locations for the respective plurality of data structures and a plurality of data structure sizes for the respective plurality of data structures.
2. The apparatus of claim 1 , wherein the data leakage event comprises allowing at least a portion of one of the files of the file set to pass from a secure network to an unsecured network.
3. The apparatus of claim 1 , wherein the file set characteristics information indicates that at least one of the files of the file set has a file length L, wherein, to compute the data structure locations for the data structures, the processor is configured to:
compute, based on the file length L and the target detection lag, a number of data structures to be used for the data structure configuration; and
compute the data structure locations for the data structures based on the number of data structures to be used for the data structure configuration.
4. The apparatus of claim 3 , wherein the processor is configured to compute the number of data structures (k) to be used for the data structure configuration using
k
=
e
[
L
δ
-
1
]
,
wherein δ is the target detection lag.
5. The apparatus of claim 1 , wherein the file set includes a number of files n, wherein the file set characteristics information indicates that at least one of the files of the file set has a file length L, wherein, to compute the data structure sizes for the data structures, the processor is configured to:
compute a total number of bits to be used for the data structures, wherein the total number of bits to be used for the data structures is computed based on the number of files n, the file length L, and the target detection lag; and
compute the data structure sizes for the data structures based on a number of data structures to be used for the data structure configuration and the total number of bits to be used for the data structures.
6. The apparatus of claim 5 , wherein the processor is configured to compute the total number of bits (B) to be used for the data structures using
B
=
en
[
L
δ
-
1
]
,
wherein δ is the target detection lag.
7. The apparatus of claim 5 , wherein the processor is configured to compute the data structure sizes for the data structures using division of the total number of bits to be used for the data structures by the number of data structures to be used for the data structure configuration.
8. The apparatus of claim 1 , wherein the processor is configured to use a heuristics-based process to compute the data structure configuration.
9. The apparatus of claim 1 , wherein, to compute the data structure configuration, the processor is configured to:
determine a file size distribution (N(t)) of the file set and a maximum file size (l max ) of the files in the file set based on the file set characteristics information;
compute a number of data structures (k) based on the maximum file size (l max ) and the target detection lag (δ);
compute the data structure locations of the data structures based on the target detection lag and the number of data structures (k); and
compute the data structure sizes of the data structures based on the file size distribution (N(t)) of the file set and the data structure locations of the data structures.
10. The apparatus of claim 9 , wherein the processor is configured to compute the number of data structures (k) using k=el max /δ, wherein δ is the target detection lag.
11. The apparatus of claim 9 , wherein the processor is configured to compute the data structure locations (l j ) of the data structures using l j =δ/e for j=1 to k.
12. The apparatus of claim 9 , wherein the processor is configured to compute the data structure sizes of the data structures using b j =N(jδ/e), wherein δ is the target detection lag.
13. The apparatus of claim 1 , wherein, to determine the data structure configuration, the processor is configured to:
determine a file size distribution (N(t)) of the file set and a maximum file size (l max ) of the files in the file set based on the file set characteristics information;
for each bit (t) from the maximum file size (l max ) to the first bit:
compute a minimum number of bits (f(t)) needed up to bit t using
f
(
t
)
=
min
1
≤
g
<
δ
b
(
t
+
g
,
g
δ
)
+
f
(
t
+
g
)
,
wherein δ is the target detection lag;
determine a location (g*) that achieves the minimum number of bits f(t) using
g
*
=
arg
min
1
≤
g
<
δ
b
(
t
+
g
,
g
δ
)
+
f
(
t
+
g
)
;
and
compute a detection probability (p(t)) for bit t using p(t)=t+g*; and
compute the data structure locations and the data structure sizes for the data structures based on the detection probabilities.
14. The apparatus of claim 13 , wherein, to compute the data structure locations and the data structure sizes for the data structures based on the detection probabilities, the processor is configured to:
initialize a data structure counter variable (j) and set a data structure location (t j ) to a bit location associated a detection probability p( 1 );
while the detection probability at the data structure location (t j ) is not zero, perform:
set an intermediate variable equal to the detection probability at the data structure location (t j );
increment the data structure counter variable by one;
compute the data structure location (t j ) of the data structure for the data structure counter variable as a bit location associated with the intermediate variable; and
compute the data structure size (b j ) of the data structure for the data structure counter variable using b[t j , ((t j −t j−1 )/δ)].
15. The apparatus of claim 1 , wherein the processor is configured to:
construct the data structures based on the data structure configuration.
16. The apparatus of claim 15 , wherein, to construct the data structures based on the data structure configuration, the processor is configured to:
for at least one of the files of the file set:
compute a plurality of fingerprints associated with the respective data structure locations of the data structures; and
hash the plurality of fingerprints into the respective plurality of data structures associated with the respective data structure locations of the data structures.
17. The apparatus of claim 1 , wherein the processor is configured to:
receive a data stream comprising a plurality of bits; and
perform fingerprint checking of the data stream, using at least a portion of the data structures, for determining whether to allow the data stream to continue.
18. The apparatus of claim 17 , wherein, to perform fingerprint checking of the data stream, the processor is configured to:
compute a fingerprint for the data stream, the fingerprint associated with one of the data structure locations;
hash the fingerprint into one of the data structures associated with the one of the data structure locations; and
determine whether to allow the data stream to continue based on hashing of the fingerprint into the one of the data structures associated with the one of the data structure locations.
19. A non-transitory computer-readable storage medium storing instructions which, when executed by a computer, cause the computer to perform a method, the method comprising:
receiving file set characteristics information of a file set comprising a plurality of files;
receiving a target detection lag indicative of a maximum number of bits within which a data leakage event for the file set is to be determined; and
computing, based on the file set characteristics information and the target detection lag, a data structure configuration for a plurality of data structures configured for use in monitoring the files of the file set, wherein the data structure configuration comprises a plurality of data structure locations for the respective plurality of data structures and a plurality of data structure sizes for the respective plurality of data structures.
20. A method, comprising:
using a processor for:
receiving file set characteristics information of a file set comprising a plurality of files;
receiving a target detection lag indicative of a maximum number of bits within which a data leakage event for the file set is to be determined; and
computing, based on the file set characteristics information and the target detection lag, a data structure configuration for a plurality of data structures configured for use in monitoring the files of the file set, wherein the data structure configuration comprises a plurality of data structure locations for the respective plurality of data structures and a plurality of data structure sizes for the respective plurality of data structures.