A Hybrid Framework for Data Loss Prevention and Detection

Modern enterprises face a serious threat from data loss, or the unintentional or undesired disclosure of data. Modern Data Loss Protection (DLP) systems either discover anomalies in regular behavior (anomaly-based) or use signatures of known attack patterns. Though signature-based solutions are effective in accurately identifying known attacks and may thus be used to block them, they are unable to handle unexpected attacks or attackers who choose atypical attack vectors (such as those that are only known to insiders) to execute their attack. However, because they frequently produce a high false positive rate, anomaly-based solutions are not as useful for identifying suspicious activity. In contrast, they can identify undiscovered attacks. Our research presents a hybrid DLP system that integrates anomaly-based and signature-based approaches to facilitate both prevention and detection. Using an anomaly-based engine, the framework automatically builds a model of typical user behavior, enabling it to detect unusual transactions carried out by insiders. This is usually where anomaly-based solutions end. To prevent unwanted transactions from causing harm, our framework goes one step further by using an operator’s feedback on alarms to automatically create and update attack signatures. We manage to improve time to detect a data breach was reduced by $67 \%$, improving response efficiency.