Systems and methods for transparent data loss prevention classifications

A computer-implemented method for transparent data loss prevention classifications may include 1) identifying a document that received a classification by a machine learning classifier for data loss prevention, 2) identifying at least one linguistic constituent within the document that contributed to the classification, 3) identifying a relevant passage of the document that contextualizes the linguistic constituent, and 4) displaying a user interface including the linguistic constituent in context of the relevant passage. Various other methods, systems, and computer-readable media are also disclosed.

BACKGROUND

In the electronic information age, people may share, access, and disseminate high volumes of information. The ease with which information may be disseminated electronically is empowering. At the same time, the workforce has become increasingly mobile, and the ubiquity of high-speed Internet access, smart mobile devices, and portable storage means that “the office” may be anywhere. As a consequence, it has become more difficult than ever for organizations to prevent the loss of sensitive data. Organizations are therefore increasingly looking to data loss prevention (“DLP”) solutions to protect their sensitive data.

Traditional DLP systems may and intercept data at a variety of points in a computing system in efforts to detect and regulate the flow and access of sensitive data. Some traditional DLP systems may allow administrators to define keywords and/or regular expressions to identify potentially sensitive documents. Additionally or alternatively, some traditional DLP systems may employ classifiers generated with machine learning techniques. For example, these DLP systems may use training documents supplied by administrators to generate classifiers, and then apply the classifiers to documents to make DLP classifications. Unfortunately, these machine-learning based classifiers may function without administrators understanding the basis for many of their classifications. Furthermore, these classifiers may yield an unacceptable rate of false positives. Accordingly, the instant disclosure identifies and addresses a need for systems and methods for transparent data loss prevention classifications.

SUMMARY

As will be described in greater detail below, the instant disclosure generally relates to systems and methods for transparent data loss prevention classifications by identifying passages within documents that contain elements that contributed to the classifications of the documents and displaying these elements in the context of their surrounding passages (e.g., to a data loss prevention administrator). In one example, a computer-implemented method for transparent data loss prevention classifications may include 1) identifying a document that received a classification by a machine learning classifier for data loss prevention, 2) identifying at least one linguistic constituent within the document that contributed to the classification, 3) identifying a relevant passage of the document that contextualizes the linguistic constituent, and 4) displaying a user interface including the linguistic constituent in context of the relevant passage.

In some examples, identifying the linguistic constituent may include 1) identifying multiple linguistic constituents within the document that contributed to the classification and 2) selecting the linguistic constituent based at least in part on the degree to which the linguistic constituent contributed to the classification. Additionally or alternatively, identifying the linguistic constituent may include 1) identifying multiple linguistic constituents within the document that contributed to the classification, 2) identifying a candidate passage that includes the multiple linguistic constituents, and 3) selecting the linguistic constituent based at least in part on the degree to which the candidate passage contributed to the classification.

In some embodiments, displaying the user interface may include displaying the linguistic constituent highlighted within the relevant passage. In one example, the computer-implemented method may also include receiving user input via the user interface indicating that the machine learning classifier misclassified the document. In some examples, the computer-implemented method may include receiving user input via the user interface indicating a type of mistake that potentially caused the machine learning classifier to misclassify the document. In these examples, the type of mistake may include 1) a use of a numerical constituent by the classifier, 2) a use of a polysemous constituent by the classifier, 3) a use of a common constituent by the classifier, and/or 4) a use of a constituent that is common within an enterprise that is protected by a data loss prevention system that uses the machine learning classifier. Additionally or alternatively, in these examples, the computer-implemented method may also include modifying the machine learning classifier in response to receiving the user input indicating the type of mistake.

In one embodiment, a system for implementing the above-described method may include 1) an identification module programmed to identify a document that received a classification by a machine learning classifier for data loss prevention, 2) a constituent module programmed to identify at least one linguistic constituent within the document that contributed to the classification, 3) a contextualization module programmed to identify a relevant passage of the document that contextualizes the linguistic constituent, and 4) a interface module programmed to display a user interface comprising the linguistic constituent in context of the relevant passage. The system may also include at least one processor configured to execute the identification module, the constituent module, the contextualization module, and the interface module.

In some examples, the above-described method may be encoded as computer-readable instructions on a computer-readable-storage medium. For example, a computer-readable-storage medium may include one or more computer-executable instructions that, when executed by at least one processor of a computing device, may cause the computing device to 1) identify a document that received a classification by a machine learning classifier for data loss prevention, 2) identify at least one linguistic constituent within the document that contributed to the classification, 3) identify a relevant passage of the document that contextualizes the linguistic constituent, and 4) display a user interface including the linguistic constituent in context of the relevant passage.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

The present disclosure is generally directed to systems and methods for transparent data loss prevention classifications. As will be explained in greater detail below, by identifying passages within documents that contain elements that contributed to the classifications of the documents and displaying these elements in the context of their surrounding passages (e.g., to a data loss prevention administrator), the systems and methods described herein may enable data loss prevention administrators to understand the basis of the classifications. Accordingly, in some examples, these systems and methods may also enable administrators to use information about the basis of the classifications to improve data loss prevention classifiers. For example, these systems and methods may enable administrators to see the types of errors committed by data loss prevention classifiers and to provide specific input for resolving the observed types of errors. Accordingly, these systems and methods may potentially increase administrator trust in data loss prevention classifiers and empower administrators to tailor data loss prevention classifiers to particular enterprise environments (e.g., to reduce the rate of false positives committed by data loss prevention classifiers).

The following will provide, with reference toFIGS. 1,2, and6, detailed descriptions of exemplary systems for transparent data loss prevention classifications. Detailed descriptions of corresponding computer-implemented methods will also be provided in connection withFIG. 3. Detailed descriptions of exemplary user interfaces will be provided in connection withFIGS. 4 and 5. In addition, detailed descriptions of an exemplary computing system and network architecture capable of implementing one or more of the embodiments described herein will be provided in connection withFIGS. 7 and 8, respectively.

FIG. 1is a block diagram of an exemplary system100for transparent data loss prevention classifications. As illustrated in this figure, exemplary system100may include one or more modules102for performing one or more tasks. For example, and as will be explained in greater detail below, exemplary system100may include an identification module104programmed to identify a document that received a classification by a machine learning classifier for data loss prevention. Exemplary system100may also include a constituent module106programmed to identify at least one linguistic constituent within the document that contributed to the classification.

In addition, and as will be described in greater detail below, exemplary system100may include a contextualization module108programmed to identify a relevant passage of the document that contextualizes the linguistic constituent. Exemplary system100may also include an interface module110programmed to display a user interface comprising the linguistic constituent in context of the relevant passage. Although illustrated as separate elements, one or more of modules102inFIG. 1may represent portions of a single module or application.

Exemplary system100inFIG. 1may be implemented in a variety of ways. For example, all or a portion of exemplary system100may represent portions of exemplary system200inFIG. 2. As shown inFIG. 2, system200may include a computing device202in communication with a computing device206via a network204. Computing device202may be programmed with one or more of modules102. Additionally or alternatively, computing device206may be programmed with one or more of modules102.

In one embodiment, one or more of modules102fromFIG. 1may, when executed by at least one processor of computing device202and/or computing device206, facilitate computing device202and/or computing device206in transparent data loss prevention classifications. In one example, computing device206(e.g., a client device from which a document210has been created, accessed, moved, and/or stored) may report a classification230of document210by a classifier220to computing device202(e.g., a data loss prevention administration system). For example, and as will be described in greater detail below, one or more of modules102may cause computing device202and/or computing device206to 1) identify document210that received classification230by a machine learning classifier220for data loss prevention (e.g., to be provided to a data loss prevention module240for remediation), 2) identify at least one linguistic constituent212within document210that contributed to classification230, 3) identify a relevant passage214of document210that contextualizes constituent212, and 4) display a user interface240including constituent212in context of passage214.

Computing device202generally represents any type or form of computing device capable of reading computer-executable instructions. Examples of computing device202include, without limitation, laptops, tablets, desktops, servers, cellular phones, personal digital assistants (PDAs), multimedia players, embedded systems, combinations of one or more of the same, exemplary computing system710inFIG. 7, or any other suitable computing device.

Computing device206generally represents any type or form of computing device capable of reading computer-executable instructions. Examples of computing device206include, without limitation, laptops, tablets, desktops, servers, cellular phones, personal digital assistants (PDAs), multimedia players, embedded systems, combinations of one or more of the same, exemplary computing system710inFIG. 7, or any other suitable computing device.

FIG. 3is a flow diagram of an exemplary computer-implemented method300for transparent data loss prevention classifications. The steps shown inFIG. 3may be performed by any suitable computer-executable code and/or computing system. In some embodiments, the steps shown inFIG. 3may be performed by one or more of the components of system100inFIG. 1, system200inFIG. 2, computing system710inFIG. 7, and/or portions of exemplary network architecture800inFIG. 8.

As illustrated inFIG. 3, at step302one or more of the systems described herein may identify a document that received a classification by a machine learning classifier for data loss prevention. For example, at step302identification module104may, as part of computing device202inFIG. 2, identify document210that received classification230by machine learning classifier220for data loss prevention (e.g., to be provided to data loss prevention module240for remediation).

As used herein, the term “document” may refer to any data object that may be of interest in a data loss prevention determination. For example, a document may include a file, an email, etc. Additionally or alternatively, a document may include the textual content of a data object (e.g., the plain text contents of a word processing document, an email, etc.).

As used herein, the phrase “machine learning” may refer to any technique for computer-enabled empirical assessments. For example, the phrase “machine learning” may refer to one or more supervised learning techniques for analyzing future inputs based on an analysis of training data. As used herein, the term “classifier” may refer to any algorithm, formula, rule, module, and/or filter for classifying, labeling, categorizing, rating, and/or scoring an input. Accordingly, the phrase “machine learning classifier” may refer to any classifier generated, defined, and/or configured at least in part by a machine learning technique. In some examples, the machine learning classifier may use one or more keywords and/or phrases as features for classifying documents.

In some examples, the machine learning technique used to generate the machine learning classifier may use a corpus of training documents to generate the machine learning classifier. As used herein, the phrase “training document” may refer to any input to a machine learning system to contribute to the generation, definition, and/or configuration of a machine learning classifier. For example, a machine learning system may take a training document and a classification of the training document as input with the object of generating a classifier that provides the same classification to like documents. In some examples, the corpus of training documents may include documents considered to have one or more characteristics relevant to at least one data loss prevention policy. For example, the corpus of training documents may include documents regarded as sensitive and/or confidential (e.g., a “positive set”). For example, the positive set may include customer information, source code, contracts, and/or documents covered by standards and/or regulations such as the Health Insurance Portability and Accountability Act, the Payment Card Industry Data Security Standard, etc. Additionally, in some examples, another corpus of training documents may include documents regarded as non-sensitive (e.g., a “negative set”). For example, the negative set may include public-facing advertising materials, personal emails, and/or publicly-accessible Internet documents. Accordingly, the machine learning classifier may be configured to provide input for data loss prevention determinations to identify sensitive and/or confidential documents.

As used herein, the phrase “data loss prevention” may refer to a technique for protecting sensitive information by applying one or more policies, rules, and/or heuristics to data within the bounds of a data loss prevention system to determine the disposition of the data in various scenarios. In some examples, a data loss prevention system may be configured to prevent sensitive information from leaking (e.g., being transmitted outside the bounds of the system under uncontrolled circumstances). Additionally or alternatively, a data loss prevention system may be configured to prevent sensitive information from being misused and/or insecurely stored.

Identification module104may identify the document in any suitable context. For example, identification module104may identify the document by receiving a message from a data loss prevention agent after the machine learning classifier classified the document as sensitive. In some examples, identification module104may operate as a part of a data loss prevention administration system.

Returning toFIG. 3, at step304one or more of the systems described herein may identify at least one linguistic constituent within the document that contributed to the classification. For example, at step304constituent module106may, as part of computing device202inFIG. 2, identify at least one linguistic constituent212within document210that contributed to classification230.

As used herein, the phrase “linguistic constituent” (or “constituent”) may refer to any word, phrase, morpheme, and/or other lexical unit usable as a feature by a machine learning classifier.

Constituent module106may identify the linguistic constituent within the document that contributed to the classification in any suitable manner. For example, the machine learning classifier may produce annotated results that identify constituents within the document used for classifying the document and/or locations of such constituents within the document. In this example, constituent module106may receive the annotated results from the machine learning classifier to identify the linguistic constituent within the document.

In some examples, constituent module106may identify multiple linguistic constituents within the document that contributed to the classification and select the linguistic constituent based at least in part on the degree to which the linguistic constituent contributed to the classification. For example, constituent module106may identify scalar values that describe the degree to which the various linguistic constituents contributed to the classification and/or confidence levels attributed to the various linguistic constituents indicating that the document is sensitive. Constituent module106may then select the linguistic constituent based on the linguistic constituent being associated with a higher scalar value.

In some examples, constituent module106may 1) identify multiple linguistic constituents within the document that contributed to the classification, 2) identify a candidate passage that includes the multiple linguistic constituents, and 3) select the linguistic constituent based at least in part on the degree to which the candidate passage contributed to the classification. For example, constituent module106may search the document to identify five non-overlapping windows of 25 words and/or phrases that contribute most to the classification. In this example, constituent module106may also filter out one or more of the five non-overlapping windows whose contributions fail to meet a predetermined threshold. Constituent module106may then identify the linguistic constituent as a constituent within one of the identified non-overlapping windows.

As used herein, the term “passage” may refer to any selection, snippet, and/or cluster, of linguistic constituents within a document. For example, the passage may include a certain number of words and/or phrases, a paragraph, etc. In some examples, important features within documents may tend to cluster together within a document (e.g., appear in the same paragraphs together). Accordingly, as will be explained in greater detail below, by identifying important passages, the systems and methods described herein may enable administrators to efficiently review classifications performed on documents.

Returning toFIG. 3, at step306one or more of the systems described herein may identify a relevant passage of the document that contextualizes the linguistic constituent. For example, at step306contextualization module108may, as part of computing device202inFIG. 2, identify relevant passage214of document210that contextualizes constituent212.

As used herein, the term “context” as it relates to a linguistic constituent within a document may refer to any additional text within the document that is potentially useful for evaluating the use of the linguistic constituent to classify the document. For example, contextualization module108may identify the relevant passage that contextualizes the linguistic constituent by identifying a passage in which the linguistic constituent appears.

Contextualization module108may identify the relevant passage in any of a variety of ways. For example, as mentioned earlier, in some examples the systems and methods described herein may identify linguistic constituents of interest by identify passages of interest. In these examples, contextualization module108may identify the relevant passage simply by identifying a passage of interesting that includes one or more linguistic constituents of interest (e.g., including the linguistic constituent). Additionally or alternatively, contextualization module108may identify the relevant passage by identifying text surrounding the linguistic constituent. In some examples, contextualization module108may identify a certain number of words and/or phrases that proceed and/or follow the linguistic constituent. Additionally or alternatively, contextualization module108may identify the beginning and/or end of a sentence and/or paragraph to determine the bounds of the passage within the document.

Returning toFIG. 3, at step308one or more of the systems described herein may display a user interface including the linguistic constituent in context of the relevant passage. For example, at step308interface module110may, as part of computing device202inFIG. 2, display user interface240including constituent212in context of passage214.

Interface module110may display the user interface in any suitable format and including any of a variety of elements and/or information. For example, interface module110may present an interface that includes the relevant passage (and, e.g., one or more additional passages that contributed most to the classification). Additionally or alternatively, interface module110may present the interface including information regarding how important the passage was to the classification (e.g., the output of a linear kernel function). In some examples, interface module110may also present one or more navigational elements (e.g., buttons) for viewing other relevant passages within the document.

In some examples, interface module110may display the linguistic constituent highlighted within the relevant passage. For example, interface module110may display the linguistic constituent with different colors, a different font, a different style, and/or a different size than the surrounding passage text.

In some examples, interface module110may also receive user input via the user interface indicating that the machine learning classifier misclassified the document. As used herein, the phrase “user input” may refer to any entered data and/or interaction with an element of the user interface. For example, the user input may include a click event on a button, a checkbox, etc. In some examples, the user input may indicate that the document should not be classified as a sensitive document, and interface module110may send a message to a data loss prevention agent to release the document in response (e.g., to allow storage of, access to, and/or movement of the document).

In some examples, interface module110may additionally receive user input via the user interface indicating a type of mistake that potentially caused the machine learning classifier to misclassify the document. The type of mistake may include any of a variety of potential pitfalls for machine-learning based classification. For example, the type of mistake may include a use of a numerical constituent by the classifier. As used herein, the phrase “numerical constituent” may refer to any textually-expressed number. In some examples, the phrase “numerical constituent” may refer to a textually-expressed number of a value below a certain threshold (e.g., any number of three digits or fewer). In another example, the type of mistake may include the use of a polysemous constituent by the classifier. As used herein, the phrase “polysemous constituent” may refer to any constituent that is potentially semantically ambiguous (e.g., a word with more than one meaning). In one example, the type of mistake may include the use of a common constituent by the classifier. As used herein, the phrase “common constituent” may refer to any constituent that is prevalent within a language (e.g., beyond a defined threshold), that is used in non-specialized discourse (e.g., that doesn't apply to specific topics, such as sensitive topics protected by a data loss prevention system), and/or that may be commonly found in documents outside of an enterprise protected by a data loss prevention system. In some examples, the type of mistake may include the use of a constituent that is common within an enterprise that is protected by a data loss prevention system that uses the machine learning classifier. For example, the type of mistake may be that the classifier has relied on a word corresponding to a topic that relates to an endeavor of the enterprise, but which does not indicate sensitive topics relating to the enterprise.

In some examples, interface module110may also modify the machine learning classifier in response to receiving the user input indicating the type of mistake. For example, the classifier may have classified the document as sensitive based in part on the presence of the number “32” within the document (e.g., due to an overfitting mistake arising in part from sensitive documents in a positive training set happening to disproportionately include the number “32”). For example, a group of sensitive contracts based on the same template and used to train the machine learning classifier may all have included section numbering up to the number “32.” Accordingly, when an administrator sees that the number “32” has caused the machine learning classifier to classify the document as sensitive, the administrator may provide user input to interface module110indicating that the classifier erroneously relied on a numerical constituent to classify the document, and interface module110may modify the machine learning classifier (e.g., to ignore the number “32” as a feature, to ignore numbers “32” and below as features, to reduce weight on numbers as features, etc.).

As another example, the classifier may have classified the document as sensitive based in part on a polysemous constituent. For example, the classifier may have classified the document as sensitive based in part on the presence of the term “account” (e.g., a financial firm may have trained the classifier on sensitive documents referring to specific accounts), but the document may use the term “account” to mean “story” rather than a financial account. Accordingly, when an administrator sees that a use of “account” with the non-sensitive meaning has caused the machine learning classifier to classify the document as sensitive, the administrator may provide user input to interface module110indicating that the classifier mistakenly classified the document as sensitive based on a term that can have a sensitive meaning but which did not in the document. Interface module110may then modify the machine learning classifier (e.g., to reevaluate the term “account” in the training documents by identifying terms that appear proximate to “account” in the positive set and only giving weight to “account” when the same terms are proximate).

As an additional example, the classifier may have classified the document as sensitive based in part on a common constituent. For example, the classifier may have classified the document as sensitive based in part on the presence of the term “account” (e.g., possibly indicating overfitting and/or an insufficiently large and/or diverse negative training set). Accordingly, an administrator may provide user input to interface module110indicating that the classifier mistakenly classified the document as sensitive based on a common term. Interface module110may then modify the machine learning classifier (e.g., by crawling the Internet for additional documents for the negative training set). Additionally or alternatively, interface module110may display a message suggesting that the administrator improve the negative training set by including more general-topic documents and/or publicly available documents.

In one example, the classifier may have classified the document as sensitive based in part on a constituent that is common within the enterprise that is protected by the data loss prevention system that uses the classifier. For example, the classifier may have classified the document as sensitive based in part on the term “loan” (e.g., where the enterprise belongs to a lending institution). Accordingly, an administrator may recognize that the term “loan” may appear in many non-sensitive documents within the enterprise (e.g., including outward-facing public documents, such as advertisements, informative documents, etc.) and provide user input to interface module110indicating such. Interface module110may then modify the machine learning classifier (e.g., by crawling non-sensitive locations within the enterprise, such as a public website, for additional negative training documents; by crawling websites of similar institutions for additional negative training documents; etc.). Additionally or alternatively, interface module110may display a message suggesting that the administrator improve the negative training set by including more non-sensitive internal documents and/or publicly available documents within the same industry.

FIG. 4illustrates an exemplary user interface400for transparent data loss prevention classifications. As shown inFIG. 4, exemplary user interface400may include a window410displaying a passage420with constituents422,424, and426. Constituents422,424, and426may be highlighted (e.g., bolded) within passage420. Window410may also display an interface element430for designating the document as non-sensitive.

FIG. 5illustrates an exemplary user interface500for transparent data loss prevention classifications. As shown inFIG. 5, exemplary user interface500may include a window510presenting input elements522,524,526, and528. For example, input element522may include a checkbox whereby an administrator may indicate that the classifier mistakenly used a numerical constituent. Input element524may include a checkbox whereby an administrator may indicate that the classifier mistakenly used a polysemous constituent. Input element526may include a checkbox whereby an administrator may indicate that the classifier mistakenly used a common constituent. Input element528may include a checkbox whereby an administrator may indicate that the classifier mistakenly used a constituent that is common within the enterprise (e.g., including in non-sensitive documents). Window510may also present an interface element530for submitting the input of input elements522,524,526, and528(e.g., to modify the classifier in response to the types of mistakes identified).

FIG. 6illustrates an exemplary system600for transparent data loss prevention classifications. As shown inFIG. 6, exemplary system600may include interface module110. In one example, interface module110may receive user input610identifying a mistake type612as input and transform a classifier620into a modified classifier622(e.g., so that modified classifier622will be less likely to produce mistake type612).

As explained above, by identifying passages within documents that contain elements that contributed to the classifications of the documents and displaying these elements in the context of their surrounding passages (e.g., to a data loss prevention administrator), the systems and methods described herein may enable data loss prevention administrators to understand the basis of the classifications. Accordingly, in some examples, these systems and methods may also enable administrators to use information about the basis of the classifications to improve data loss prevention classifiers. For example, these systems and methods may enable administrators to see the types of errors committed by data loss prevention classifiers and to provide specific input for resolving the observed types of errors. Accordingly, these systems and methods may potentially increase administrator trust in data loss prevention classifiers and empower administrators to tailor data loss prevention classifiers to particular enterprise environments (e.g., to reduce the rate of false positives committed by data loss prevention classifiers).

FIG. 7is a block diagram of an exemplary computing system710capable of implementing one or more of the embodiments described and/or illustrated herein. For example, all or a portion of computing system710may perform and/or be a means for performing, either alone or in combination with other elements, one or more of the identifying, selecting, displaying, receiving, and modifying steps described herein. All or a portion of computing system710may also perform and/or be a means for performing any other steps, methods, or processes described and/or illustrated herein.

Computing system710broadly represents any single or multi-processor computing device or system capable of executing computer-readable instructions. Examples of computing system710include, without limitation, workstations, laptops, client-side terminals, servers, distributed computing systems, handheld devices, or any other computing system or device. In its most basic configuration, computing system710may include at least one processor714and a system memory716.

Processor714generally represents any type or form of processing unit capable of processing data or interpreting and executing instructions. In certain embodiments, processor714may receive instructions from a software application or module. These instructions may cause processor714to perform the functions of one or more of the exemplary embodiments described and/or illustrated herein.

System memory716generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and/or other computer-readable instructions. Examples of system memory716include, without limitation, random access memory (RAM), read only memory (ROM), flash memory, or any other suitable memory device. Although not required, in certain embodiments computing system710may include both a volatile memory unit (such as, for example, system memory716) and a non-volatile storage device (such as, for example, primary storage device732, as described in detail below). In one example, one or more of modules102fromFIG. 1may be loaded into system memory716.

In certain embodiments, exemplary computing system710may also include one or more components or elements in addition to processor714and system memory716. For example, as illustrated inFIG. 7, computing system710may include a memory controller718, an Input/Output (I/O) controller720, and a communication interface722, each of which may be interconnected via a communication infrastructure712. Communication infrastructure712generally represents any type or form of infrastructure capable of facilitating communication between one or more components of a computing device. Examples of communication infrastructure712include, without limitation, a communication bus (such as an ISA, PCI, PCIe, or similar bus) and a network.

Memory controller718generally represents any type or form of device capable of handling memory or data or controlling communication between one or more components of computing system710. For example, in certain embodiments memory controller718may control communication between processor714, system memory716, and I/O controller720via communication infrastructure712.

I/O controller720generally represents any type or form of module capable of coordinating and/or controlling the input and output functions of a computing device. For example, in certain embodiments I/O controller720may control or facilitate transfer of data between one or more elements of computing system710, such as processor714, system memory716, communication interface722, display adapter726, input interface730, and storage interface734.

Communication interface722broadly represents any type or form of communication device or adapter capable of facilitating communication between exemplary computing system710and one or more additional devices. For example, in certain embodiments communication interface722may facilitate communication between computing system710and a private or public network including additional computing systems. Examples of communication interface722include, without limitation, a wired network interface (such as a network interface card), a wireless network interface (such as a wireless network interface card), a modem, and any other suitable interface. In at least one embodiment, communication interface722may provide a direct connection to a remote server via a direct link to a network, such as the Internet. Communication interface722may also indirectly provide such a connection through, for example, a local area network (such as an Ethernet network), a personal area network, a telephone or cable network, a cellular telephone connection, a satellite data connection, or any other suitable connection.

In certain embodiments, communication interface722may also represent a host adapter configured to facilitate communication between computing system710and one or more additional network or storage devices via an external bus or communications channel. Examples of host adapters include, without limitation, SCSI host adapters, USB host adapters, IEEE 1394 host adapters, SATA and eSATA host adapters, ATA and PATA host adapters, Fibre Channel interface adapters, Ethernet adapters, or the like. Communication interface722may also allow computing system710to engage in distributed or remote computing. For example, communication interface722may receive instructions from a remote device or send instructions to a remote device for execution.

As illustrated inFIG. 7, computing system710may also include at least one display device724coupled to communication infrastructure712via a display adapter726. Display device724generally represents any type or form of device capable of visually displaying information forwarded by display adapter726. Similarly, display adapter726generally represents any type or form of device configured to forward graphics, text, and other data from communication infrastructure712(or from a frame buffer, as known in the art) for display on display device724.

As illustrated inFIG. 7, exemplary computing system710may also include at least one input device728coupled to communication infrastructure712via an input interface730. Input device728generally represents any type or form of input device capable of providing input, either computer or human generated, to exemplary computing system710. Examples of input device728include, without limitation, a keyboard, a pointing device, a speech recognition device, or any other input device.

As illustrated inFIG. 7, exemplary computing system710may also include a primary storage device732and a backup storage device733coupled to communication infrastructure712via a storage interface734. Storage devices732and733generally represent any type or form of storage device or medium capable of storing data and/or other computer-readable instructions. For example, storage devices732and733may be a magnetic disk drive (e.g., a so-called hard drive), a solid state drive, a floppy disk drive, a magnetic tape drive, an optical disk drive, a flash drive, or the like. Storage interface734generally represents any type or form of interface or device for transferring data between storage devices732and733and other components of computing system710.

In certain embodiments, storage devices732and733may be configured to read from and/or write to a removable storage unit configured to store computer software, data, or other computer-readable information. Examples of suitable removable storage units include, without limitation, a floppy disk, a magnetic tape, an optical disk, a flash memory device, or the like. Storage devices732and733may also include other similar structures or devices for allowing computer software, data, or other computer-readable instructions to be loaded into computing system710. For example, storage devices732and733may be configured to read and write software, data, or other computer-readable information. Storage devices732and733may also be a part of computing system710or may be a separate device accessed through other interface systems.

The computer-readable-storage medium containing the computer program may be loaded into computing system710. All or a portion of the computer program stored on the computer-readable-storage medium may then be stored in system memory716and/or various portions of storage devices732and733. When executed by processor714, a computer program loaded into computing system710may cause processor714to perform and/or be a means for performing the functions of one or more of the exemplary embodiments described and/or illustrated herein. Additionally or alternatively, one or more of the exemplary embodiments described and/or illustrated herein may be implemented in firmware and/or hardware. For example, computing system710may be configured as an application specific integrated circuit (ASIC) adapted to implement one or more of the exemplary embodiments disclosed herein.

FIG. 8is a block diagram of an exemplary network architecture800in which client systems810,820, and830and servers840and845may be coupled to a network850. As detailed above, all or a portion of network architecture800may perform and/or be a means for performing, either alone or in combination with other elements, one or more of the identifying, selecting, displaying, receiving, and modifying steps disclosed herein. All or a portion of network architecture800may also be used to perform and/or be a means for performing other steps and features set forth in the instant disclosure.

Client systems810,820, and830generally represent any type or form of computing device or system, such as exemplary computing system710inFIG. 7. Similarly, servers840and845generally represent computing devices or systems, such as application servers or database servers, configured to provide various database services and/or run certain software applications. Network850generally represents any telecommunication or computer network including, for example, an intranet, a wide area network (WAN), a local area network (LAN), a personal area network (PAN), or the Internet. In one example, client systems810,820, and/or830and/or servers840and/or845may include all or a portion of system100fromFIG. 1.

As illustrated inFIG. 8, one or more storage devices860(1)-(N) may be directly attached to server840. Similarly, one or more storage devices870(1)-(N) may be directly attached to server845. Storage devices860(1)-(N) and storage devices870(1)-(N) generally represent any type or form of storage device or medium capable of storing data and/or other computer-readable instructions. In certain embodiments, storage devices860(1)-(N) and storage devices870(1)-(N) may represent network-attached storage (NAS) devices configured to communicate with servers840and845using various protocols, such as NFS, SMB, or CIFS.

Servers840and845may also be connected to a storage area network (SAN) fabric880. SAN fabric880generally represents any type or form of computer network or architecture capable of facilitating communication between a plurality of storage devices. SAN fabric880may facilitate communication between servers840and845and a plurality of storage devices890(1)-(N) and/or an intelligent storage array895. SAN fabric880may also facilitate, via network850and servers840and845, communication between client systems810,820, and830and storage devices890(1)-(N) and/or intelligent storage array895in such a manner that devices890(1)-(N) and array895appear as locally attached devices to client systems810,820, and830. As with storage devices860(1)-(N) and storage devices870(1)-(N), storage devices890(1)-(N) and intelligent storage array895generally represent any type or form of storage device or medium capable of storing data and/or other computer-readable instructions.

In certain embodiments, and with reference to exemplary computing system710ofFIG. 7, a communication interface, such as communication interface722inFIG. 7, may be used to provide connectivity between each client system810,820, and830and network850. Client systems810,820, and830may be able to access information on server840or845using, for example, a web browser or other client software. Such software may allow client systems810,820, and830to access data hosted by server840, server845, storage devices860(1)-(N), storage devices870(1)-(N), storage devices890(1)-(N), or intelligent storage array895. AlthoughFIG. 8depicts the use of a network (such as the Internet) for exchanging data, the embodiments described and/or illustrated herein are not limited to the Internet or any particular network-based environment.

In at least one embodiment, all or a portion of one or more of the exemplary embodiments disclosed herein may be encoded as a computer program and loaded onto and executed by server840, server845, storage devices860(1)-(N), storage devices870(1)-(N), storage devices890(1)-(N), intelligent storage array895, or any combination thereof. All or a portion of one or more of the exemplary embodiments disclosed herein may also be encoded as a computer program, stored in server840, run by server845, and distributed to client systems810,820, and830over network850.

As detailed above, computing system710and/or one or more components of network architecture800may perform and/or be a means for performing, either alone or in combination with other elements, one or more steps of an exemplary method for transparent data loss prevention classifications.

In addition, one or more of the modules described herein may transform data, physical devices, and/or representations of physical devices from one form to another. For example, one or more of the modules recited herein may receive a machine learning classifier to be transformed, transform the machine learning classifier, use the result of the transformation to more accurately classify documents, and store the result of the transformation to a storage device. Additionally or alternatively, one or more of the modules recited herein may transform a processor, volatile memory, non-volatile memory, and/or any other portion of a physical computing device from one form to another by executing on the computing device, storing data on the computing device, and/or otherwise interacting with the computing device.