Leveraging indexed document matching to automatically train SVM classifiers

摘要

A method and apparatus for automatically training a data loss prevention (DLP) agent deployed on an endpoint device is described. In one embodiment, the method includes monitoring information content on a client computer system for violations of a policy. The method further includes determining, with the client computer system, whether a violation of the policy has occurred for the information content based on a classifier. The method may also include transmitting monitored data indicative of a policy decision and the information content to a remote system and receiving a response from the remote system including an updated classifier, wherein the updated classifier was automatically generated by the remote system utilizing fingerprint matching.

主权项

1. A computer implemented method comprising:
generating, by a client computer system, a first determination on whether an information content item on the client computer system violates a data loss prevention (DLP) policy, the first determination being generated based on a support vector machine (SVM) classifier associated with the DLP policy; transmitting the information content item and the first determination on whether the information content item violates the DLP policy to a remote system; receiving an updated SVM classifier from the remote system if the first determination differs from a second determination based on document fingerprint matching by the remote system, wherein the updated SVM classifier reflects the second determination with respect to the information content item; and determining, by the client computer system, whether other information content items on the client computer system violate the DLP policy using the updated SVM classifier.