Applying text mining methods for data loss prevention

Currently, the greatest risks for information security of organizations are internal, rather than external, threats. Data loss prevention (DLP) systems are used for minimization of risks related to internal threats. The main function of the DLP systems is to prevent leak of confidential data; however, comparison of the DLP systems relies currently on their capabilities to analyze information captured and convenience of carrying out retrospective investigations of information security incident. In the paper, a new approach to retrospective analysis of user’s text information is presented. The idea of the proposed approach consists in topic analysis of the text content processed by the user in the past and prediction of further user behavior with content. User text content can cover different categories, including confidential ones. The topic analysis of user text content assumes determination of main topics and their weights for given past time intervals. Based on deviations of behavior of user’s operations with a content from the forecast, one can reveal time intervals when operation with documents of one or another category differs from normal (historical) work and when the user worked with documents of unusual categories. The proposed approach was experimentally verified on an example of actual corporate email correspondence created from the Enron data set.

[1]  Mikhail Petrovskiy,et al.  Using NMF-based text summarization to improve supervised and unsupervised classification , 2011, 2011 11th International Conference on Hybrid Intelligent Systems (HIS).

[2]  Gwilym M. Jenkins,et al.  Time series analysis, forecasting and control , 1971 .

[3]  Bruce J. West.  Auto regressive Integrated Moving Average (ARIMA) , 1999 .

[4]  Mikhail Petrovskiy,et al.  Automatic text summarization using latent semantic analysis , 2011, Programming and Computer Software.

[5]  D. Heckerman,et al.  Autoregressive Tree Models for Time-Series Analysis , 2002, SDM.

[6]  Gerard Salton,et al.  Research and Development in Information Retrieval , 1982, Lecture Notes in Computer Science.

[7]  Xin Liu,et al.  Document clustering based on non-negative matrix factorization , 2003, SIGIR.

[8]  Hinrich Schütze,et al.  Introduction to information retrieval , 2008 .

[9]  Chris H. Q. Ding,et al.  Orthogonal nonnegative matrix t-factorizations for clustering , 2006, KDD '06.

[10]  M. Petrovskiy,et al.  Supervised and Unsupervised Text Classification via Generic Summarization , 2012 .

[11]  Michael W. Berry,et al.  Algorithms and applications for approximate nonnegative matrix factorization , 2007, Comput. Stat. Data Anal..

[12]  J. van Leeuwen,et al.  Intelligent Data Engineering and Automated Learning , 2003, Lecture Notes in Computer Science.

[13]  Seungjin Choi,et al.  Orthogonal Nonnegative Matrix Factorization: Multiplicative Updates on Stiefel Manifolds , 2008, IDEAL.

[14]  Andri Mirzal,et al.  Converged Algorithms for Orthogonal Nonnegative Matrix Factorizations , 2010, ArXiv.

[15]  Xiaokui Shu,et al.  Natural Language Toolkit (NLTK) , 2010 .