REAL-TIME DATA LEAKAGE PREVENTION AND REPORTING

• US 20170270310A1
• Filed: 03/16/2016
• Published: 09/21/2017
• Est. Priority Date: 03/16/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Becker, Shlomit, Melamed, Boris, Pyasik, Alexander, Turgeman, Shani, Weber, Gidi, Yulevich, Yifat
• Granted Patent: US 10,169,603 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/254 Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Aspects include detecting that an extract transform load (ETL) job in an ETL system has been submitted for execution. The ETL job can include an input data storage location and an output data storage location. The ETL job is analyzed to predict whether execution of the ETL job will result in sensitive information being made accessible to an unauthorized user. The analyzing can be based on a sensitivity status of contents of the input data storage location and a data lineage of contents of the output data storage location. The ETL job is prevented from executing based on predicting that execution of the ETL job will result in sensitive information being made accessible to an unauthorized user. Execution of the ETL job is initiated based on predicting that execution of the ETL job will not result in sensitive information being made accessible to an unauthorized user.

Claims

1. A method comprising:

detecting, by an analysis engine, that an extract transform load (ETL) job in an ETL system has been submitted for execution, the ETL job including an input data storage location and an output data storage location;

analyzing, by the analysis engine, the ETL job to predict whether execution of the ETL job will result in sensitive information being made accessible to an unauthorized user, the analyzing based on a sensitivity status of contents of the input data storage location and a data lineage of contents of the output data storage location;

preventing, by the analysis engine, the ETL job from executing based on predicting that execution of the ETL job will result in sensitive information being made accessible to an unauthorized user; and

initiating execution of the ETL job based on predicting that execution of the ETL job will not result in sensitive information being made accessible to an unauthorized user.

2. The method of claim 1, wherein the input data storage location includes data that is classified as sensitive data and the method further comprises:

generating a report that indicates a flow of the data that is classified as sensitive data through ETL jobs defined in the ETL system.

3. The method of claim 1, wherein the sensitivity status is received in real-time in response to a request from the analysis engine.

4. The method of claim 3, wherein the sensitivity status is received from one or more of a database activity monitoring system and a file activity monitoring system.

5. The method of claim 1, wherein the data lineage is contained in a data lineage report that is generated based on one or more of a planned data flow, a design time data flow, and a run-time data flow in the ETL system.

6. The method of claim 1, wherein the predicting includes a recursive or iterative process of tracing data of the output data storage location through subsequent ETL jobs in the ETL system.

7. The method of claim 1, wherein the data lineage of contents of the output data storage location is located in a report that was generated by a data lineage tool based on a flow of ETL jobs in the ETL system.

8. The method of claim 1, further comprising:

subsequent to the initiating execution of the ETL job, receiving, by the analysis engine, a sensitivity status change alert; and

halting execution of the ETL job based on the receiving.

9. The method of claim 1, wherein inputs at the input data storage location do not contain sensitive data and the analysis engine predicts that execution of the ETL job will result in sensitive information being made accessible to an unauthorized user.

10. A system comprising:

a memory having computer readable instructions; and

one or more processors for executing the computer readable instructions, the computer readable instructions comprising;

detecting, by an analysis engine, that an extract transform load (ETL) job in an ETL system has been submitted for execution, the ETL job including an input data storage location and an output data storage location;

analyzing, by the analysis engine, the ETL job to predict whether execution of the ETL job will result in sensitive information being made accessible to an unauthorized user, the analyzing based on a sensitivity status of contents of the input data storage location and a data lineage of contents of the output data storage location;

preventing, by the analysis engine, the ETL job from executing based on predicting that execution of the ETL job will result in sensitive information being made accessible to an unauthorized user; and

initiating execution of the ETL job based on predicting that execution of the ETL job will not result in sensitive information being made accessible to an unauthorized user.

11. The system of claim 10, wherein the input data storage location includes data that is classified as sensitive data and the instructions further comprise:

generating a report that indicates a flow of the data that is classified as sensitive data through ETL jobs defined in the ETL system.

12. The system of claim 10, wherein the sensitivity status is received in real-time in response to a request from the analysis engine.

13. The system of claim 10, wherein the sensitivity status is received from one or more of a database activity monitoring system and a file activity monitoring system.

14. The system of claim 10, wherein the data lineage is contained in a data lineage report that is generated based on one or more of a planned data flow, a design time data flow, and a run-time data flow in the ETL system.

15. The system of claim 10, wherein the predicting includes a recursive or iterative process of tracing data at the contents of the output data storage location through subsequent ETL jobs in the ETL system.

16. The system of claim 10, wherein the data lineage of contents of the output data storage location is located in a report that was generated by a data lineage tool based on a flow of ETL jobs in the ETL system.

18. The computer program product of claim 15, wherein the input data storage location includes data that is classified as sensitive data and the program instructions are further executable by the processor to cause the processor to perform:

generating a report that indicates a flow of the data that is classified as sensitive data through ETL jobs defined in the ETL system.

19. The computer program product of claim 15, wherein the sensitivity status is received in real-time in response to a request from the analysis engine.

17. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform:

detecting that an extract transform load (ETL) job in an ETL system has been submitted for execution, the ETL job including an input data storage location and an output data storage location;

analyzing the ETL job to predict whether execution of the ETL job will result in sensitive information being made accessible to an unauthorized user, the analyzing based on a sensitivity status of contents of the input data storage location and a data lineage of contents of the output data storage location;

preventing the ETL job from executing based on predicting that execution of the ETL job will result in sensitive information being made accessible to an unauthorized user; and

initiating execution of the ETL job based on predicting that execution of the ETL job will not result in sensitive information being made accessible to an unauthorized user.

20. The computer program product of claim 17, wherein the sensitivity status is received from one or more of a database activity monitoring system and a file activity monitoring system.