Abstract
Data leakage is a serious problem for many large organizations. In order to provide the user with information about confidential data, many prevalent data leakage prevention (DLP) solutions rely on scanning the content of the relevant files. This approach requires the capability to parse various file formats. However, risks of data breach persist for unsupported file formats. To address this issue, we propose in this paper an active behavior-based DLP model that hooks the keyboard and mouse application programming interfaces (APIs) to track and profile user behavior. This model has two major advantages: (1) it can help discover sensitive data without parsing file formats, and (2) a data creator can be identified according to his/her keystroke and mouse movement behavior. Since this model is based on profiling user behavior, it eliminates the risk of data leakage from unsupported file formats and can identify the creator of a file. The experiments showcase the effectiveness of the proposed model with data creator identification method yields an accuracy rate of 92.64%, which is promising considering that the features of keystroke and mouse movement behavior are dealing together.