On the Use of Matrix Bloom Filters in Data Leak Protection

摘要

Data leak prevention systems become a must-have component of enterprise information security. To minimize the communication delay, these systems require quick mechanisms for massive document comparison. Bloom filters have been proven to be a fast tool for membership checkup. Taking into account specific needs of fast text comparison this chapter proposes modifications to the Matrix Bloom filters. Approach proposed in this chapter allows improving density in Matrix Bloom filters with the help of special index to track documents uploaded into the system. Density is improved by combining a few documents in one line of the matrix to reduce the filter size and to address the problem of document removal. Special attention is paid to the negative impact of filter-to-filter comparison in matrix filters. Theoretical evaluation of the threshold for false positive results is provided. The experiment provided in the chapter outlines advantages and applicability of the proposed approach.