P reventing D ata L eakage via E mail ADD Presentation

1. Preventing DataLeakage via Email ADD Presentation

2. Academic Advisor: Dr. Yuval Elovici Technical Advisor: PolinaZilberman Team Members: Dmitry Kaganov RostislavPinski Eli Shtein Alexander Gorohovski Web site: http://www.cs.bgu.ac.il/~grorhovs/project/Main

3. Use Cases Diagram Mark e-mail as got / sent by mistake Simple User Simple User Check e-mail validity <<Extends>> Send an e-mail Add new user <<Extends>> Set systems’ configurations <<Extends>> Log in to the system as a system administrator Administrator Administrator Deal with e-mails marked by a question mark <<Extends>> <<Extends>> Update existing user <<Extends>> <<Extends>> Remove existing user E-mail client Update system’s model Exchange server Log out from the administrator mode

4. Global Architecture Host System core Plug-in Outlook Server Exchange server User Middle-ware Figure 1.1 – System architecture

5. System Architecture System Core Log files Management Console Same computer Middle-ware Plug-in Server Data base Figure 1.2 – System Core architecture

6. Data Flow Diagram

7. Purposed Solution – The Theoretical Model Link communication analysis • Every two users that exchanged emails in the past define a link, and all emails exchanged between these two users are associated with the link. • The classification of an e-mail with content c sent from s to r is performed as follows: the e-mail is compared with the link defined by the users s and r. If the received similarity score is lower than the link's threshold similarity score, then sending the e-mail is considered a potential leak. E-mail toclassify, e.g.query <s,r,c> Link's threshold Similarity score

8. Group communication analysis • Assume Alice and Bob belong to agroup that communicates topic T, and Bob sends an email with content T to Alice. Alice won't be considered a wrong recipient, even if Alice and Bob have never exchanged communication with content T before. Orange circles represent the emails taken into account when classifying an email sent from Bob to Alice.

9. Cascading the models Yes No No No Yes Yes • Apparently, cascading the group-based and link-based classifiers will take advantage of the “strong” points of both classifiers, and eliminate their “weak” points.

10. Overview of User Interface Simple User Interface

11. Overview of User Interface Administrator Interface

12. Plug-In – Main Classes

13. “Middle Ware” – Main Classes

14. Model + Server – Main Classes

15. Management Console– Main Classes

16. Data Base Information

18. And so the data continued to be safe and lived happily ever after…