Tuning of data loss prevention signature effectiveness

摘要

In at least one embodiment, a method and a system include capability to fine-tune a data loss prevention system. An example method includes gaining access to or creating an alert database and a signature set by an analytics module and an adjustment module, where the alert database includes an alert validity attribute for each alert; quantifying for each signature contained in the signature set an effect on the change in the number of alerts from its removal; determining with an analytics module whether any signature has a ratio of valid to false positive alerts less than a threshold; and when at least one signature has the ratio less than the first threshold identifying and removing with an adjustment module at least one signature from the signature database having a ratio less than the threshold where the signature is removed from the signature set, and repeating quantifying and determining.

主权项

1. A method comprising:
processing a flow of packets with a data loss prevention sensor using a signature set; diverting any packet that matches at least one signature to an alert database; receiving an alert validity attribute into the alert database; quantifying for each signature contained in the signature set an effect on the change in the number of alerts from its removal; determining with an analytics module whether any signature has a ratio of valid to false positive alerts less than a first threshold; and when at least one signature has the ratio less than the threshold
identifying and removing with an adjustment module at least one signature having a ratio less than the first threshold where the signature is removed from the signature set, and repeating quantifying and determining; the method further comprising:
annotating at least one signature in the signature set with a signature weighting;including in the metadata for any alert the signature's signature weighting; andremoving from quantifying any signature having its signature weighting above a value threshold.