基于指纹和Bloom滤波器的数据泄漏检测方案  

Data-leakage detection scheme based on fingerprint and Bloom filters

作　　者：黄伟文[1] 罗佳[2] 

机构地区：[1]宁波职业技术学院信息资源中心,浙江宁波315800 [2]浙江大学计算机科学与技术学院,杭州310058

出　　处：《计算机应用》2014年第7期1922-1928,共7页journal of Computer Applications

基　　金：国家自然科学基金面上项目(61379119/F020803)

摘　　要：针对当前的数据防泄漏方案主要依赖在外传数据中进行关键词通用搜索,导致数据流控制不够精细、虚警率较高的问题。首先设计了一种基于白名单的数据防泄漏(DLP)架构,在此基础上,提出了一种基于文件指纹和Bloom滤波器的数据泄露检测算法。该算法通过使用动态规划来计算最优检测位置,最大限度地降低了内存开销,并支持高速部署。仿真实验结果表明,所提算法可以用较低的代价,实现大量数据的在线指纹检测。例如,对1 TB的文件,该方案只需340 MB内存就可实现1000字节的最差检测延时期望(泄露的长度)。Aiming at the problems that the existing Data-Leakage Prevention （DLP） solutions are based on generic search for keywords in outgoing data, and hence severely lack the ability to control data flow at a fine granularity with low false probability. In this paper, an DLP architecture based on the white-listing was firstly designed, which used a white-listing for providing the strong security of data transmission. On this basis, a data leakage detection algorithm by combining document fingerprinting with Bloom filters was proposed. This algorithm computed the optimal locations by using dynamic programming to minimize the memory overhead and enable high-speed implementation. The simulation results show that the proposed algorithm for checking the fingerprints for a large amount of documents at very low cost. For example, for 1 TB of documents, the proposed solution only requires 340 MB memory to achieve worst case expected detection lag （ i. e. leakage length） of 1 000 Bytes.

关 键 词：数据泄露 云计算 白名单 虚警率 指纹检测 BLOOM滤波器 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]