Systems and methods for identifying content types for data loss prevention
Provided herein are systems and methods for classifying content to prevent data breach or exfiltration. An entity engine may receive content for classification into a content type for preventing data breach or exfiltration. The entity engine may determine that secondary data, defined by an operand of an entity definition, is present in the content. Each entity definition may correspond to one content type and may include a Boolean expression of operands. Each operand may include a matching element to be used for matching against content undergoing classification into one of the content types, upon secondary data defined by the operand being present in the content. The entity engine may classify the content into a content type of the content types, corresponding to the entity definition, based on matching the matching element of the operand to the content, and matching other operands of the entity definition to the content.
1. A system for classifying content to prevent data breach or exfiltration, the system comprising:
memory configured to store a plurality of entity definitions, each entity definition corresponding to a respective content type of a plurality of content types, and comprising a Boolean expression of a plurality of operands, the Boolean expression of each of the plurality of operands specifying:
(i) a corresponding threshold score for the respective content type,
(ii) at least one operand of the plurality of operands comprising a matching element to be used for matching against content undergoing classification into the respective content type of the plurality of content types, and
(iii) a corresponding weight to be applied to the at least one operand when secondary data defined by another of the plurality of operands different from the at least one operand is present in the content; and
an entity engine executable on one or more processors, the entity engine configured to:
receive first content for classification into one of the plurality of content types for preventing data breach or exfiltration;
determine that secondary data, defined by a first operand of a Boolean expression of a first entity definition of the plurality of entity definitions, is present in the first content;
in response to determining that the secondary data defined by the first operand is present in the first content, match a matching element of a second operand of the Boolean expression of the first entity definition against the first content, the second operand being different than the first operand;
in response to determining that the secondary data defined by the first operand is present in the first content, identify a weight corresponding to the second operand used to match the matching element against the first content for classification of the first content into a first content type of the plurality of content type;
identify a threshold score specified by the Boolean expression of the first entity definition corresponding to the first content type;
determine that the weight specified for the classification satisfies the threshold score specified by the Boolean expression of the first entity definition; and
classify the first content into the first content type of the plurality of content types, corresponding to the first entity definition, based on matching the matching element of the second operand to the first content, matching other operands of the first entity definition to the first content, and determining that the weight satisfies the threshold score.
2. The system of claim 1 , wherein each of the plurality of entity definitions comprises the Boolean expression of a plurality of operands, each operand including the matching element corresponding to one of: a pattern, a term, a dictionary of words or phrases, or another entity definition.
3. The system of claim 2 , wherein the dictionary of words or phrases comprises a list of entries each of which comprises a word or a phrase, and a match between the dictionary and corresponding content occurs when the corresponding content matches any entry in the list of entries.
4. The system of claim 1 , wherein each of the plurality of entity definitions comprises the Boolean expression of the plurality of operands, each operand specifying a maximum score for determining a matching score for a corresponding content.
5. The system of claim 1 , wherein the entity engine is configured to classify the first content into the first content type corresponding to the first entity definition, if all operands of the first entity definition matches to the first content within a predefined proximity window.
6. The system of claim 1 , wherein the entity engine is configured to determine that the matching element of the second operand matches the first content when the matching element matches to elements within the first content over a predetermined minimum number of occurrences.
7. The system of claim 1 , wherein the entity engine is configured to determine that the matching element of the second operand matches the first content, by determining that the matching element matches a string of characters in the first content, and validating each of a plurality of subgroups of the string of characters.
8. The system of claim 1 , wherein the entity engine is configured to determine that the secondary data is present in the first content, the secondary data comprising one or more terms relevant to a context of the corresponding matching element.
9. The system of claim 1 , wherein the secondary data comprises terms or identifiers that correlates to a homonymic context of the corresponding matching element.
10. The system of claim 1 , wherein the one or more processors is configured to manage the first content for data loss prevention according to a severity level assigned to the first content type.
11. A method for classifying content to prevent data breach or exfiltration, the method comprising:
receiving, by an entity engine executable on one or more processors, first content for classification into one of the plurality of content types for preventing data breach or exfiltration;
determining, by the entity engine, that secondary data, defined by a first operand of a first entity definition of a plurality of entity definitions, is present in the first content, each entity definition of the plurality of entity definitions corresponding to a respective content type of a plurality of content types, and comprising a Boolean expression of a plurality of operands, the Boolean expression of each of the plurality of operands specifying:
(i) a corresponding threshold score for the respective content type,
(ii) at least one operand of the plurality of operands comprising a matching element to be used for matching against content undergoing classification into the respective content type of the plurality of content types, and
(iii) a corresponding weight to be applied to the at least one operand when, upon secondary data defined by another of the plurality of operands different from the at least one operand being is present in the content;
in response to determining that the secondary data defined by the first operand is present in the first content, matching, by the entity engine, a matching element of a second operand of the Boolean expression of the first entity definition against the first content, the second operand being different than the first operand;
in response to determining that the secondary data defined by the first operand is present in the first content, identifying, by the entity engine, a weight corresponding to the second operand used to match the matching element against the first content for classification of the first content into a first content type of the plurality of content types;
identifying, by the entity engine, a threshold score specified by the Boolean expression of the first entity definition corresponding to the first content type;
determining, by the entity engine, that the weight specified for classification satisfies the threshold score specified by the Boolean expression of the first entity definition; and
classifying, by the entity engine, the first content into the first content type of the plurality of content types, corresponding to the first entity definition, based on matching the matching element of the second operand to the first content, matching other operands of the first entity definition to the first content and determining that the weight satisfies the threshold score.
12. The method of claim 11 , wherein each of the plurality of entity definitions comprises the Boolean expression of a plurality of operands, each operand including the matching element corresponding to one of: a pattern, a term, a dictionary of words or phrases, or another entity definition.
13. The method of claim 12 , wherein the dictionary of words or phrases comprises a list of entries each of which comprises a word or a phrase, and a match between the dictionary and corresponding content occurs when the corresponding content matches any entry in the list of entries.
14. The method of claim 11 , wherein each of the plurality of entity definitions comprises the Boolean expression of the plurality of operands, each operand specifying a maximum score for determining a matching score for a corresponding content.
15. The method of claim 11 , further comprising classifying the first content into the first content type corresponding to the first entity definition, if all operands of the first entity definition matches to the first content within a predefined proximity window.
16. The method of claim 11 , further comprising determining that the matching element of the second operand matches the first content when the matching element matches to elements within the first content over a predetermined minimum number of occurrences.
17. The method of claim 11 , further comprising determining that the matching element of the second operand matches the first content, by determining that the matching element matches a string of characters in the first content, and validating each of a plurality of subgroups of the string of characters.
18. The method of claim 11 , wherein determining that the secondary data is present in the first content comprises determining that the secondary data comprises one or more terms relevant to a context of the corresponding matching element.
19. The method of claim 11 , wherein determining that the secondary data is present in the first content comprises determining that the secondary data comprises terms or identifiers that correlates to a homonymics context of the corresponding matching element.
20. The method of claim 11 , further comprising managing the first content for data loss prevention according to a severity level assigned to the first content type.