Data loss monitoring of partial data streams

摘要

A method for detecting loss of sensitive information in partial data streams may include identifying partial data streams containing segments lost while capturing network traffic at a network computing device, determining characteristics of content of the partial data streams, padding content portions of the lost segments in the partial data streams, and scanning the partial data streams for sensitive information according to at least one data loss prevention (DLP) policy.

主权项

1. A computer-implemented method comprising:
identifying partial data streams containing segments lost while capturing network traffic at a network computing device, each partial data stream corresponding to a session; determining characteristics of the partial data streams, wherein determining characteristics of the partial data streams comprises performing a protocol analysis for data stream elements of a partial data stream by determining a type for each data stream element, parsing each data stream element based on the type to extract metadata, and storing the metadata in a metadata store; padding content portions of the lost segments in the partial data streams to generate padded partial data streams; and scanning the padded partial data streams for sensitive information according to at least one data loss prevention (DLP) policy, wherein scanning the padded partial data streams comprises using signatures of the sensitive information to determine whether content portions of the padded partial data streams contain the sensitive information.