Abstract: Latency of DLP policy application during file transfer operations is decreased, by front loading the extraction of file content. The potential extraction latencies of files are quantified based on attributes such as size and/or type. Files with potential extraction latencies that meet a given threshold are identified for pre-transfer content extraction, and their content is extracted and stored. An index of the stored extracted content is maintained, tracking all files from which content has been extracted, according to factors such as size and checksum. When a specific file in the filesystem is transferred, it is determined whether its content has already been extracted, for example by matching the file size and checksum against those for which extracted content has been stored. Responsive to determining that content of the specific file has already been extracted and stored, the stored content is utilized when applying DLP, thereby greatly increasing performance.

Abstract: The disclosed computer-implemented method for utilizing an information trail to enforce data loss prevention policies on potentially malicious file activity may include (1) recording, by a computing device, one or more current activities associated with a file retrieved from a server, (2) linking, by the computing device, the current activities to one or more previously recorded activities associated with the file, (3) generating, by the computing device, a graph including nodes representing an information trail of related events associated with the current activities and the previously recorded activities, (4) determining, by the computing device, a severity of the information trail based on one or more rules, and (5) performing, by the computing device, a data loss prevention action on one or more operations associated with the file based on potential malicious activity. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method and apparatus for detecting a violation of a data loss prevention (DLP) policy and correlating an external identifier of an incident record of the violation to a unique internal identifier using an identity-correlation data store are described.

Abstract: A computer-implemented method for data loss prevention may include intercepting a packet sent by an application of an endpoint. The computer-implemented method may also include extracting file-identification information from the packet. The computer-implemented method may further include identifying a list of opened files and matching the file-identification information to a file in the list of opened files. The computer-implemented method may additionally include identifying a data-loss-prevention policy that applies to the file. The computer-implemented method may moreover include filtering the packet based on the data-loss-prevention policy. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method and apparatus for dynamically populating an identity-correlation data store and using the identity-correlation data store to correlate external identifiers and unique internal identifiers are described.

Abstract: A computer-implemented method for data loss prevention may include intercepting a packet sent by an application of an endpoint. The computer-implemented method may also include extracting file-identification information from the packet. The computer-implemented method may further include identifying a list of opened files and matching the file-identification information to a file in the list of opened files. The computer-implemented method may additionally include identifying a data-loss-prevention policy that applies to the file. The computer-implemented method may moreover include filtering the packet based on the data-loss-prevention policy. Various other methods, systems, and computer-readable media are also disclosed.