Method and system to enhance accuracy of a data leak prevention (dlp) system

Abstract

A Data Loss Prevention (DLP) system is enhanced according to this disclosure by augmenting the information obtained from OS API hooking with 'context' information obtained from other sources, such as by monitoring an endpoint's user interface (UI). In one embodiment, the additional 'context' information is obtained from one or more user interface hooks that provide the DLP system with additional information, such as the contents of one or more application windows, the UI elements contained in a particular display window, window activation or deactivation, window resizing, user input, pointer operations, and the like. This UI information defines a “context” of the application, namely, its operating state (including, without limitation, its display state), and associated user actions that define that state. When a particular OS API hook is invoked by the application, the DLP solution uses the context information to make a more accurate enforcement decision, preferably based on the UI context.