Sensitive data discrimination method and data loss prevention system using the sensitive data discrimination method
An exemplary embodiment of the present disclosure illustrates a sensitive data discrimination method executed in a data loss prevention system to determine whether a file has the least one sensitive data during a file generation proceeding. Steps of the sensitive data discrimination method are illustrated as follows. Multiple characters inputted via a keyboard are recorded. The recorded characters are trimmed to generate a trimmed data. The trimmed data and at least one predefined term related to the at least one sensitive data are compared, to determine whether the trimmed data has the at least one sensitive data.
1. A sensitive data discrimination method, executed in a data loss prevention system, for determining whether there is at least one sensitive data in contents inputted to generate a file during a file generation proceeding, comprising:
recording multiple characters inputted via a keyboard in real time;
storing the recorded characters in a file or buffering the recorded characters in a memory block;
trimming the recorded characters according to definitions of the characters to filter noises in the recorded characters and generate a trimmed data only including literal contents inputted via the keyboard;
obtaining the recorded characters from the file or the memory block before the recorded characters are trimmed;
comparing the trimmed data with at least one predefined term related to the at least one sensitive data, so as to determine whether the trimmed data has the at least one sensitive data; and
executing an event corresponding to the at least one sensitive data according to a comparison result.
2. The sensitive data discrimination method according to claim 1 , wherein after a specific application is activated, the characters inputted via the keyboard are recorded.
3. The sensitive data discrimination method according to claim 1 , wherein according to definition of at least one specific character, the recorded characters are trimmed, so as to filter noise of the recorded characters, and then the trimmed data is generated accordingly.
4. The sensitive data discrimination method according to claim 1 , wherein the event comprises at least one of sending a warning message to a system administrator or a user, generating a report to the system administrator, generating a log of security information and event management, locking the file, copying the file to a secure database, generating a fingerprint of the file, embedding a watermark into the file, and attaching a tag in the file.
5. The sensitive data discrimination method according to claim 1 , wherein a string match, regular expression match, or a term hash is used to compare the trimmed data with the at least one predefined term related to the at least one sensitive data.
6. A data loss prevention system for determining whether there is at least one sensitive data in contents inputted to generate a file during a file generation proceeding, comprising:
a log driving module, used to record multiple characters inputted via a keyboard in real time;
a storage/buffer module, used to store the recorded characters in a file or buffering the recorded characters in a memory block;
a pre-filtering module, used to trim the recorded characters according to definitions of the characters to filter noises in the recorded characters and generate a trimmed data only including literal contents inputted via the keyboard;
the pre-filtering module obtains the recorded characters from the file or the memory block before the recorded characters are trimmed;
a sensitive data analyzing module, used to compare the trimmed data with at least one predefined term related to the at least one sensitive data, so as to determine whether the trimmed data has the at least one sensitive data; and
an event processing module, used to execute an event corresponding to the sensitive data according to a comparison result.
7. The data loss prevention system according to claim 6 , wherein after a specific application is activated, the log driving module is driven to record the characters inputted via the keyboard.
8. The data loss prevention system according to claim 6 , wherein according to definition of at least one specific characters, the pre-filtering module trims the recorded characters to filter noise of the recorded characters, and then generates the trimmed data accordingly.
9. The data loss prevention system according to claim 6 , wherein the event comprises at least one of sending a warning message to a system administrator or a user, generating a report to the system administrator, generating a log of security information and event management, locking the file, copying the file to a secure database, generating a fingerprint of the file, embedding a watermark into the file, and attaching a tag in the file.
10. The data loss prevention system according to claim 6 , the sensitive data analyzing module uses a string match, regular expression match, or a term hash to compare the trimmed data with the at least one predefined term related to the at least one sensitive data.