Predicting likelihood of legitimate data loss in email DLP

Abstract

The volume and variety of data collected for modern organizations has increased significantly over the last decade necessitating the detection and prevention of disclosure of sensitive data. Data loss prevention is an embedded process used to protect against disclosure of sensitive data to external uncontrolled environments. A typical Data Loss Prevention (DLP) system uses custom policies to identify and prevent accidental and malicious data leakage producing large number of security alerts including significant volume of false positives. Consequently, identifying legitimate data loss can be very challenging as each incident comprises of different characteristics often requiring extensive intervention by a domain expert to review alerts individually. This limits the ability to detect data loss alerts in real-time making organisations vulnerable to financial and reputational damages. The aim of this research is to strengthen data loss detection capabilities of a DLP system by implementing a machine learning model to predict the likelihood of legitimate data loss. We conducted extensive experimentation using Decision Tree and Random Forest algorithms with historical email incident data collected by a globally established telecommunication enterprise. The final model produced with Random Forest algorithm was identified as the most effective as it was successfully able to predict approximately 95% data loss incidents accurately with an average true positive value of 90%. Furthermore, the proposed solution successfully enables identification of legitimate data loss in email DLP whilst facilitating prioritisation of real data loss through human-understandable explanation of the decision thereby improving the efficiency of the process.

Corporate chat under DLP–system controlling

“…The article describes the implemented software complex consisting of secure corporate chat and DLP-system in the form of security monitor; defines the functional requirements, and performs the algorithmic and the software design [15]. Its advantages include speed performance, effectiveness, simplicity of using, controlling of the employees correspondence with the search of forbidden words and phrases in the dictionaries; the sufficient minimal functionality for tracking the events on the system and detecting the threats, the prevention of the information leakage; and low cost software [16,17].…”

Research on Sustainable Development Indicator Prediction of Regional Economic Subsystem Based on Artificial Neural Network

“…In the process of data collection, due to the influence of various factors, data loss may occur, resulting in incomplete or discontinuous data and affecting data analysis [12].…”

35 th Bled eConference Digital Restructuring and Human (Re)action

“…Of course, articles describing this approach (Faiz et al, 2020), where an e-mail attachment is just seen as a yes or no flag, have been shown to have some scientific backing. On top of this, well defined and barely changing processes can be protected against many cases of data leakage using this method, so it is predestined to be used in high-security environment.…”