Abstract: A context-based chat message data loss prevention system (“DLP system”) detects sensitive chat messages communicated via Software-as-a-Service (“SaaS”) applications. The DLP system receives chat messages via SaaS connectors and buffers the chat messages in sliding windows that correspond to context of chat messages within UIs of the SaaS application. The DLP system then filters messages in the sliding windows and classifies the filtered messages with a language model. The resulting sensitive/non-sensitive classifications by the language model thus incorporate chat context for corresponding SaaS applications.

Abstract: A data loss prevention (DLP) pipeline is presently disclosed filters non-sensitive documents from DLP with two stages—a first filtering stage that filters documents that do not match one or more patterns corresponding to personally identifiable information (PII) and a second filtering stage that filters documents matching the one or more patterns that are classified with non-sensitive verdicts by a machine learning (ML) ensemble. The ML ensemble comprises a character-level convolutional neural network that generates pattern-based embeddings, a language model that generates context-based embeddings, and a classification model that receives concatenated embeddings as input to generate sensitive/non-sensitive verdicts.

Abstract: An identity document detector comprising a two-dimensional convolutional neural network is trained to detect categories of identity documents based on inputting unprocessed image data from documents. The documents comprise documents monitored by a data loss prevention (DLP) system across an organization, and each category of identity documents has associated risk levels for DLP. The DLP system performs corrective action to prevent data leakage based on detection of identity documents by the trained identity document detector and risk associated with the detected identity document categories as well as document context within the organization.

Abstract: A trained one-dimensional convolutional neural network (1D CNN) efficiently detects credentials that allow access to sensitive data across an organization. The 1D CNN has a lightweight architecture with one or more one-dimensional convolutional layers that capture semantic context of text data and a one-hot encoding embedding layer that takes unprocessed characters from documents as input. Lightweight architecture of the 1D CNN allows for high volume, fast detection of credentials for data loss prevention. The 1D CNN is trained on documents augmented with natural language processing techniques including token replacement, machine translation, token rearrangement, and text summarization.

Abstract: A named-entity recognition (NER) model detects named entities with types that correspond to protected health information (PHI) in potentially sensitive documents. The NER model is trained to detect named entities corresponding to both personally identifiable information (PII) and medical terms. Output of the NER model is preprocessed as input to a random forest classifier that outputs a verdict that documents comprise sensitive data. The verdict is interpretable via high confidence named entities detected by the NER model that led to the verdict.

Abstract: An OCR filter described herein filters non-textual files in scanned customer data from optical character recognition (OCR) and pattern analysis of text generated thereof for sensitive customer data. The OCR filter is trained on files labelled using feature values for features generated from OCR applied to the corresponding files. Moreover, the OCR filter stores internal representations of the files during training to avoid leaking potential sensitive customer data contained therein. Once trained, performance of the OCR filter in filtering files comprising image data without text is evaluated according to false positive rates and false negative rates by comparing classifications of the OCR filter to classifications according to feature values for features generated from OCR. Evaluation of the OCR filter ensures continued model performance and informs model updates.

Abstract: A set of features including a first feature and a second feature is received at a server. A subset of the set of features is determined for use in generating a model usable by a device to locally make a malware classification decision. The device has reduced computing resources as compared to computing resources of the server. The subset of the set of features is used to generate the model. The generated model includes the first feature and does not include the second feature. A determination is made, at a time subsequent to the generation of the model, that an updated model should be deployed to the device. An updated model is generated.