Some approaches to network DLP analysis

The work deals mainly with network DLP (Data Lost/Leakage Prevention) systems. One of the main tasks of DLP systems is to recognize the appearance of valuable information that can appear on the network at the output of the computer system. Network-based DLP systems are becoming more important due to the development of remote work of employees of various organizations. The proper functioning of the DLP is determined by recognizing short messages as random sequences and leaking valuable information such as personal data as a short sequence satisfying structural constraints. The main problem of these methods is false alarms. In the work, in the simplest models, the volume of data is estimated in which it is possible to search for valuable information at small probabilities of false alarms. The examples of simple but fast methods for detecting leaks of valuable information are built. The methods are divided by complexity and their applications. Such methods can be used not only to analyze DLP systems, but also to search for service inserts and signals during the transfer of information when searching and analyzing poorly protected or unprotected personal data where depersonalization is required according to the rules. The estimates of the probabilities of false alarms are built.