A computer-implemented method of controlling data within a computing network, the method comprising: receiving one or more user-provided data samples; generating respective root hash values corresponding to the one or more user-provided data samples; storing the root hash values in a database; evaluating network traffic to extract and group data objects based on their content satisfying a set of similarity criteria, and to identify baseline data behavior with respect to the data objects, wherein the evaluating includes determining that a given one of the data objects satisfies the set of similarity criteria, including by: generating a data object hash value of the given data object; and determining that the data object hash value matches a given one of the root hash values stored in the database; generating a set of data-defined network, DDN, data structures that logically group data objects independent of physical infrastructure via which those data objects are stored, communicated, or utilized, wherein a given one of the set of DDN data structures includes a content class and one or more behavioral classes; wherein the content class is indicative of one or more of the data objects that have been grouped based on the one or more data objects satisfying the set of similarity criteria; and wherein the one or more behavioral classes indicate baseline behavior of the one or more data objects within the content class as determined from evaluation of the network traffic; monitoring, using content and behavioral classes of the set of DDN data structures, network traffic to detect anomalous data behavior within network traffic; and in response to detecting particular anomalous data behavior, preventing network traffic corresponding to the particular anomalous data behavior from being communicated via the computing network. receiving one or more user-provided data samples; generating respective root hash values corresponding to the one or more user-provided data samples; storing the root hash values in a database; evaluating network traffic to extract and group data objects based on their content satisfying a set of similarity criteria, and to identify baseline data behavior with respect to the data objects, wherein the evaluating includes determining that a given one of the data objects satisfies the set of similarity criteria, including by: generating a data object hash value of the given data object; and determining that the data object hash value matches a given one of the root hash values stored in the database; generating a data object hash value of the given data object; and determining that the data object hash value matches a given one of the root hash values stored in the database; generating a set of data-defined network, DDN, data structures that logically group data objects independent of physical infrastructure via which those data objects are stored, communicated, or utilized, wherein a given one of the set of DDN data structures includes a content class and one or more behavioral classes; wherein the content class is indicative of one or more of the data objects that have been grouped based on the one or more data objects satisfying the set of similarity criteria; and wherein the one or more behavioral classes indicate baseline behavior of the one or more data objects within the content class as determined from evaluation of the network traffic; wherein the content class is indicative of one or more of the data objects that have been grouped based on the one or more data objects satisfying the set of similarity criteria; and wherein the one or more behavioral classes indicate baseline behavior of the one or more data objects within the content class as determined from evaluation of the network traffic; monitoring, using content and behavioral classes of the set of DDN data structures, network traffic to detect anomalous data behavior within network traffic; and in response to detecting particular anomalous data behavior, preventing network traffic corresponding to the particular anomalous data behavior from being communicated via the computing network.