Machine Learning Based Data Leakage Detection and Prevention

Data leakage refers to the unauthorized disclosure or unintended transfer of sensitive information and represents a significant security concern for organizations. This paper presents SentinelDLP, a machine-learning-based data leakage detection and prevention system designed for Windows endpoints. The system combines rule-based techniques with TF-IDF and Logistic Regression for content classification into different sensitivity levels. It also includes an Isolation Forest component intended for behavioural anomaly detection. SentinelDLP provides monitoring and detection capabilities across multiple endpoint channels, including filesystem activity, USB devices, clipboard operations, screenshots, printing, MTP devices, and network shares. The system generates alerts and incident records to support administrative monitoring and investigation. It also incorporates risk-scoring and policy-management components. Print prevention is implemented for detected sensitive printing activities. USB transfer blocking is activated through a separate command that must be executed with administrator privileges from the project directory. Once activated, the current mechanism blocks all file transfers to USB devices rather than selectively blocking files according to their sensitivity. The Windows Shell Copy Hook is present in the source code but has not been implemented successfully as a functioning selective file-copy prevention mechanism. The content-classification model was evaluated using separate training and testing datasets. Further verification is required to establish the integration of behavioural anomaly detection, the reported evaluation metrics, and the effectiveness of prevention across all monitored channels. The project demonstrates an approach to combining content classification, endpoint monitoring, and selected prevention mechanisms for data leakage detection and prevention.