Cloud based data loss prevention system using graphical processing units for index filtering
A system for providing data loss prevention services includes an indexer system configured to generate a search index based on structured data to be protected and a detection system configured to receive the search index and network data content and to detect in the network data content for matching data based on the search index. The detection system includes a first processor and multiple graphical processing units. The first processor provides words from the network data content in parallel to each of the graphical processing units, each graphical processing unit receiving a different word from the network data content. The graphical processing units perform detection of the words in parallel to detect for matched data content in at least a portion of the search index.
1. A system for providing data loss prevention services to an enterprise operating an enterprise data network, the system comprising:
a first hardware processor and a plurality of graphical processing units, wherein the first hardware processor is configured to:
receive, from a remote storage site, a search index based on structured data to be protected, wherein the search index is based on hash values of the structured data to be protected, wherein the structured data to be protected is encoded with a forward hash function based on a key;
receive network data content belonging to the enterprise;
apply the forward hash function based on the key to the network data content;
generate a sub-index from the search index, the sub-index being a portion of the search index;
apply a Bloom filter to the sub-index;
detect in the network data content matching data using the Bloom filter applied to the sub-index;
generate an alert in response to matched data being found in the network data content;
load the sub-index into each of the plurality of graphical processing units; and
provide hash values of words from the network data content in parallel to each of the plurality of graphical processing units, each graphical processing unit receiving a different word from the network data content,
wherein each of the plurality of graphical processing units are configure to receive a hash value of a different word from the network data content, and wherein the plurality of graphical processing units are configured to perform detection of the words in parallel to detect for matched data content in the sub-index.
2. The system of claim 1 , further comprising a plurality of memory units, each memory unit being coupled to a respective graphical processing unit, wherein the first processor is configured to load the sub-index into the plurality of memory units associated with the plurality of graphical processing units.
3. The system of claim 1 , wherein the first hardware processor is further configured to apply remediation measures in response to matched data content being found in the network data content.
4. A method for providing data loss prevention services to an enterprise operating an enterprise data network, the method comprising:
generating, using a hardware processor, a search index based on hash values of structured data to be protected;
receiving, from a remote storage site, a search index based on the structured data to be protected, wherein the structured data to be protected is encoded using a forward hash function based on a key;
receiving, at a hardware processor, network data content belonging to the enterprise;
applying, at the hardware processor, the forward hash function based on the key to the network data content;
generating, at the hardware processor, a sub-index from the search index, the sub-index being a portion of the search index;
applying, at the hardware processor, a Bloom filter to the sub-index;
loading the sub-index with the Bloom filter applied into a plurality of graphical processing units;
providing hash values of words from the network data content in parallel to each of the plurality of graphical processing units, each graphical processing unit receiving a hash value of a different word from the network data content;
detecting, at the plurality of graphical processing units, words in parallel for matched data content using the Bloom filter applied to the sub-index; and
generating, at the hardware processor, an alert in response to matched data content being found in the network data content.
5. The method of claim 4 , further comprising:
detecting, at the plurality of graphical processing units, hash values of words in parallel for matched data content using the Bloom filter applied to the sub-index; and
generating an alert in response to matched data content being found in the hash values of the network data content.
6. The method of claim 4 , wherein detecting, at the plurality of graphical processing units, words in parallel for matched data content using the Bloom filter applied to the sub-index comprises detecting, using the plurality of graphical processing units, the words from the network data content in parallel for matched data content using the Bloom filter applied to the sub-index.