Confidence level threshold selection assistance for a data loss prevention system using machine learning

• US 9,691,027 B1
• Filed: 12/13/2011
• Issued: 06/27/2017
• Est. Priority Date: 12/14/2010
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: DiCorpo, Philip, Sawant, Shitalkumar S., Shrowty, Vikram
• Primary Examiner(s): Wong, Lut
• Assistant Examiner(s): Brown, Jr., Nathan
• Application Number:
  US13/324,987
• Time in Patent Office: 2,023 Days
• Field of Search: 706 12
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/168 Details of user interfaces specifically adapted to file systems, e.g. browsing and visualisation, 2d or 3d GUIs query results presentation G06F16/156
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Machine-learning based detection (MLD) profiles can be used to identify sensitive information in documents. The MLD profile can be used to generate a confidence value for the document that expresses the degree of confidence with which the MLD profile can classify the document as sensitive or not. In one embodiment, a data loss prevention system provides or suggests a confidence level threshold to a user of the data loss prevention system by providing a confidence level threshold for the MLD profile to the user, the confidence level threshold to be used as the boundary between sensitive data and non-sensitive data. In one embodiment the provided confidence level threshold is determined by scanning a random data set using the MLD profile.

Claims

1. A method comprising:

training, by a processing device, a machine learning-based detection (MLD) profile, wherein the MLD profile is used to classify new data as sensitive data or as non-sensitive data; and

providing a confidence level threshold for the MLD profile to a user, wherein the confidence level threshold is used as a boundary between the sensitive data and the non-sensitive data, wherein providing the confidence level threshold comprises setting a default value of a confidence level threshold user interface element to the confidence level threshold, and wherein the confidence level threshold user interface element allows the user to change the confidence level threshold,

wherein the MLD profile is used to classify new data by using the MLD profile to assign a confidence value to the new data and classifying the new data as the sensitive data in response to determining that the confidence value of the new data is above the confidence level threshold, wherein the confidence value is from a range of confidence values, and wherein a higher value in the range of confidence values indicates a higher likelihood of being the sensitive data than a lower value in the range of confidence values.

2. The method of claim 1, further comprising scanning a random data set using the MLD profile to determine the confidence level threshold.

3. The method of claim 2, wherein scanning the random data set using the MLD profile comprises determining a confidence value for each random datum in the random data set using the MLD profile.

4. The method of claim 3, wherein each random datum in the random data set comprises a document from a random document set.

5. The method of claim 3, wherein each random datum in the random data set comprises a web page selected randomly from a subset of public web pages.

6. The method of claim 3, wherein scanning the random data set using the MLD profile further comprises selecting the confidence value of the random datum with the highest confidence value as the confidence level threshold.

7. The method of claim 3, wherein the method further comprises testing the confidence level threshold using a test data set that is different from the random data set to determine whether the confidence level threshold has a threshold gap between a distribution of confidence values for ones of the test data set classified as the sensitive data and a distribution of confidence values for ones of the test data set classified as the non-sensitive data.

8. The method of claim 7, further comprising selecting a second random data set in response to the determination that the confidence level threshold does not have the threshold gap between the distribution of confidence values for the ones of the test data set classified as the sensitive data and the distribution of confidence values for the ones of the test data set classified as the non-sensitive data.

9. The method of claim 1, wherein training comprises extracting features using a user-selectable feature extraction algorithm.

10. A non-transitory computer-readable storage medium having instructions stored therein that, when executed by a processing device, cause the processing device to perform operations comprising:

training, by the processing device, a machine learning-based detection (MLD) profile, wherein the MLD profile is used to classify new data as sensitive data or as non-sensitive data;

scanning a random data set using the MLD profile to determine a confidence level threshold; and

providing the confidence level threshold for the MLD profile to a user, wherein the confidence level threshold is used as a boundary between the sensitive data and the non-sensitive data,

wherein the MLD profile is used to classify new data by using the MLD profile to assign a confidence value to the new data and classifying the new data as the sensitive data in response to determining that the confidence value of the new data is above the confidence level threshold, wherein the confidence value is from a range of confidence values, and wherein a higher value in the range of confidence values indicates a higher likelihood of being the sensitive data than a lower value in the range of confidence values.

11. The non-transitory computer-readable storage medium of claim 10, wherein providing the confidence level threshold comprises setting a default value of a confidence level threshold user interface element to the confidence level threshold, and wherein the confidence level threshold user interface element allows the user to change the confidence level threshold.

12. The non-transitory computer-readable storage medium of claim 10, wherein scanning the random data set using the MLD profile comprises determining a confidence value for each random datum in the random data set using the MLD profile.

13. The non-transitory computer-readable storage medium of claim 12, wherein each random datum in the random data set comprises a document from a random document set.

14. The non-transitory computer-readable storage medium of claim 12, wherein scanning the random data set using the MLD profile further comprises selecting the confidence value of the random datum with the highest confidence value as the confidence level threshold.

15. The non-transitory computer-readable storage medium of claim 10, wherein training comprises extracting features using a user-selectable feature extraction algorithm.

16. A system comprising:

a memory to store instructions for a machine learning manager; and

a processing device to execute the instructions to;

train a machine learning-based detection (MLD) profile, wherein the MLD profile is used to classify new data as sensitive data or as non-sensitive data;

scan a random data set using the MLD profile to determine a confidence level threshold; and

provide the confidence level threshold for the MLD profile to a user, wherein the confidence level threshold is used as a boundary between the sensitive data and the non-sensitive data,

wherein the MLD profile is used to classify new data by using the MLD profile to assign a confidence value to the new data and classifying the new data as the sensitive data in response to determining that the confidence value of the new data is above the confidence level threshold, wherein the confidence value is from a range of confidence values, and wherein a higher value in the range of confidence values indicates a higher likelihood of being the sensitive data than a lower value in the range of confidence values.

17. The system of claim 16, wherein to scan the random data set the processing device is to determine a confidence value for each random datum in the random data set using the MLD profile, and wherein to determine the confidence level threshold the processing device is to select the confidence value of the random datum with the highest confidence value as the confidence level threshold.

18. The system of claim 17, wherein each random datum in the random data set comprises a document from a random document set, and wherein the processing device is further to test the confidence level threshold using a test document set that is different from the random document set to determine whether the confidence level threshold has a threshold gap between a distribution of confidence values for sensitive ones of the test document set and a distribution of confidence values for non-sensitive ones of the test document set.

19. The system of claim 16, wherein to provide the confidence level threshold the processing device is to set a default value of a confidence level threshold user interface element to the confidence level threshold, and wherein the confidence level threshold user interface element allows the user to change the confidence level threshold.

20. The system of claim 16, wherein training comprises extracting features using a user-selectable feature extraction algorithm.