Sensitive data movement detection

1. A system for data set movement monitoring, the system comprising:

at least one processor; and

memory including instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:

receive a request to establish a monitored data set corresponding to a data directory;

gather file data including a set of risk indicators that indicate a sensitivity level for files in the data directory;

generate a security container that includes files in the data directory identified based on the sensitivity level;

create a log of file names, a file-data string table, and a hash log for the monitored data set including hash values for files included in the security container using the file data;

identify an attempt to relocate the file that is a member of the monitored data set;

determine a user account associated with the attempt to relocate the file;

identify a safe user group for the user account associated with the attempt to relocate the file;

obtain a destination for the attempt to relocate the file;

determine a safe zone for the monitored data set using the user account and the identification of the monitored data set; and

provide a notification based on the destination for the attempt to relocate the file and the safe user group and the safe zone.

2. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to:

determine that the destination is not a member of the safe zone; and

prevent the attempt to relocate the file, wherein the notification includes a message that indicates that the attempt to relocate the file was unsuccessful.

3. The system of claim 2 , the memory further comprising instructions that cause the at least one processor to perform operations to transmit a notification to a group of users responsible for management of the monitored data set.

4. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to:

determine that the destination is a member of the safe zone; and

allow the attempt to relocate the file, wherein the notification includes a message that indicates that the attempt to relocate the file was successful.

5. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to:

calculate a first hash value for the file;

store the first hash value in the hash table that corresponds to the monitored data set that includes the file;

upon identification of the attempt to relocate the file, calculate a second hash value for the file; and

determine that the file is the member of the monitored data set based on a comparison between the first hash value and the second hash value.

6. The system of claim 5 , the memory further comprising instructions that cause the at least one processor to perform operations to:

identify that the file has been modified;

calculate a third hash value for the file; and

update the hash table with the third hash value, wherein the instructions to determine that the file is the member of the monitored data set includes instructions to compare the second hash value to the third hash value.

7. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to:

identify a current file name of the file; and

determine that the file is the member of the monitored data set based on a comparison between the current file name and an entry in the log of file names.

8. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to:

identify a data string included in the file;

store the data string in the file-data string table that corresponds to the monitored data set for the file;

upon identification of the attempt to relocate the file, scan the file for the data string; and

determine that the file is the member of the monitored data set based on the data string be located in the file.

9. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to:

determine that a new file has been created in a location corresponding to the monitored data set;

generate an identification profile for the new file; and

add the new file to the monitored data set.

10. At least one non-transitory machine-readable medium including instructions for a file manager including data set movement monitoring that, when executed by at least one processor, cause the at least one processor to perform operations to:

receive a request to establish a monitored data set corresponding to a data directory;

gather file data including a set of risk indicators that indicate a sensitivity level for files in the data directory;

generate a. security container that includes files in the data directory identified based on the sensitivity level;

create a log of file names, a file-data string table, and a hash log for the monitored data set including hash values for files included in the security container using the file data;

identify an attempt to relocate the file that is a member of the monitored data set;

determine a user account associated with the attempt to relocate the file;

identify a safe user group for the user account associated with the attempt to relocate the file;

obtain a destination for the attempt to relocate the file;

determine a safe zone for the monitored data set using the user account and the identification of the monitored data set; and

provide a notification based on the destination for the attempt to relocate the file and the safe user group and the safe zone.

11. The at least one non-transitory machine-readable medium of claim 10 , the memory further comprising instructions that cause the at least one processor to perform operations to:

determine that the destination is not a member of the safe zone; and

prevent the attempt to relocate the file, wherein the notification includes a message that indicates that the attempt to relocate the file was unsuccessful.

12. The at least one non-transitory machine-readable medium of claim 10 , the memory further comprising instructions that cause the at least one processor to perform operations to:

determine that the destination is a member of the safe zone; and

allow the attempt to relocate the file, wherein the notification includes a message that indicates that the attempt to relocate the file was successful.

13. The at least one non-transitory machine-readable medium of claim 10 , the memory further comprising instructions that cause the at least one processor to perform operations to:

calculate a first hash value for the file;

store the first hash value in the hash table that corresponds to the monitored data set that includes the file;

upon identification of the attempt to relocate the file, calculate a second hash value for the file; and

determine that the file is the member of the monitored data set based on a comparison between the first hash value and the second hash value.

14. The at least one non-transitory machine-readable medium of claim 13 , the memory further comprising instructions that cause the at least one processor to perform operations to:

identify that the file has been modified;

calculate a third hash value for the file; and

update the hash table with the third hash value, wherein the instructions to determine that the file is the member of the monitored data set includes instructions to compare the second hash value to the third hash value.

15. The at least one non-transitory machine-readable medium of claim 10 , the memory further comprising instructions that cause the at least one processor to perform operations to:

identify a data string included in the file;

store the data string in the file-data string table that corresponds to the monitored data set for the file;

upon identification of the attempt to relocate the file, scan the file for the data. string; and

determine that the file is the member of the monitored data set based on the data string being located in the file.

16. A method for a file manager including data set movement monitoring, the method comprising:

receiving a request to establish a monitored data set corresponding to a data directory;

gathering file data including a set of risk indicators that indicate a sensitivity level for files in the data directory;

generating a security container that includes files in the data directory identified based on the sensitivity level;

creating a log of file names, a file-data string table, and a hash log for the monitored data set including hash values for files included in the security container using the file data;

identifying, by the file manager, an attempt to relocate a file that is a member of a monitored data set;

determining, by the file manager, a user account associated with the attempt to relocate the file;

identifying a safe user group for the user account associated with the attempt to relocate the file;

obtaining, by the file manager, a. destination for the attempt to relocate the file;

determining a safe zone for the monitored data set using the user account and the identification of the monitored data set; and

providing a notification via the file manager based on the destination for the attempt to relocate the file and the safe user group and the safe zone.

17. The method of claim 16 , further comprising:

determining that the destination is not a member of the sate zone; and

preventing the attempt to relocate the file, wherein the notification includes a message indicating that the attempt to relocate the file was unsuccessful.

18. The method of claim 16 , further comprising:

determining that the destination is a member of the safe zone; and

allowing the attempt to relocate the file, wherein the notification includes a message indicating that the attempt to relocate the file was successful.

19. The method of claim 16 , further comprising:

calculating a first hash value for the file;

storing the first hash value in the hash table corresponding to the monitored data set that includes the file;

upon identifying the attempt to relocate the file, calculating a second hash value for the file; and

determining that the file is the member of the monitored data set based on a comparison between the first hash value and the second hash value.

20. The method of claim 16 , further comprising:

identifying a data string included in the file;

storing the data string in the file-data string table corresponding to the monitored data set for the file;

upon identifying the attempt to relocate the file, scanning the file for the data string; and

determining that the file is the member of the monitored data set based on locating the data. string in the file.