Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

David Subiros Perez

Helen Balinsky

Steven J Simske

Kas Kasravi

James C Cooper

Luis Miguel Vaquero Gonzalez

Example embodiments relate to hierarchical rule clustering. The examples disclosed herein access information about a set of rules, where information for an individual rule comprises information about a set of hypershapes associated with the individual rule. A respective hypervolume for each set of hypershapes associated with each individual rule may be calculated based on the accessed information. A first rule and a second rule may be combined as a new individual rule in the set of rules based on overlaps between the calculated hypervolumes.

Hierarchical rule clustering

A callback, which may be assigned to a creation event of an application process, may be executed. In response to the execution of the callback, a data flow control object may be injected into the application process. The data flow control object may be to intercept a system call made by the application process and to control flow of data handled by the system call.

Injection of data flow control objects into application processes

According to an example, a performance of a predetermined action with regard to a data may be prevented. In the method, a first system call pertaining to the data may be intercepted and suspended. A determination may be made as to whether a second system call that is to be executed following execution of the first system call will result in performance of a predetermined action with regard to the data. In addition, an operation may be implemented on the first system call to prevent the performance of the predetermined action with regard to the data.

Prevention of a predetermined action regarding data

A data leak prevention system includes an application, having source code that is unavailable or non-modifiable, resident on a client device. A system call is emittable by the application as a result of an action, and is to take place before a data leak event can occur. The action involves a document and i) latest full contents of the document, ii) metadata of the document, or iii) a combination of the latest full contents and the metadata. A system call interceptor agent is also resident on the client device. The interceptor agent includes a system call interceptor to intercept the system call emitted by the application and to suspend the system call. The system also includes a policy decision engine to analyze at least some of i) the latest full contents, ii) the metadata, or iii) the combination, and implement a policy action based upon the analysis.

Data leak prevention systems and methods

A data leak from a computer can be prevented by intercepting one or more system calls from an unknown application and applying different policies to the intercepted action associated with the system call(s) depending on the data itself and the metadata of a document associated with the system call.

Growing community of inventors

Bristol, United Kingdom

David Subiros Perez