Developing document classification algorithm against malicious data leakage attacks

It is often seen that institutional or non-institutional valuable documents are seized by persons who are not authorized to access them and taken out or leaked. With the leakage of these documents, valuable information for the private enterprise may be passed into the hands of its opponents. Valuable information leakage can lead to changes in the policies applied on a national basis, as well as breaking the relations between nations. Data Leakage Protection (DLP) systems uses rule-based, pattern based and statistical methods. Rule based and pattern based systems generally use matching algorithms. Bypassing the matching algorithms can be easy done with small changes in the document. Although statistical methods are well but against of an attack it may decrease. Therefore it is necessary to identify the sophisticated methods used by malwares and develop an algorithm that is resistant to these attacks. In this thesis, malware-based attacks are re-organized and attack types are shown in a schema. In this study, two type of attacks, which are structural attack and obfuscated attack are scoped. A software has been developed to carry out these attacks. With this software, the documents were attacked and then the performance of the developed method was measured. In the developed algorithm, Natural Language Processing (NLP) methods, machine learning and artificial neural networks were used. Natural language processing algorithms, which are commonly used by text-based classification systems, are used in the extraction of features. Later, Decision Support Machines (SVM), Random Forest and Multi-Layer Perceptron were used in the classification model. In these classification models, the decision mechanism is provided by Vote Classifier. The reliability of the algorithm was compared with several methods used in data leakage prevention systems and text classification algorithms and the success of the algorithm was measured.In the tests performed, the f1 score of the classification success of the proposed method was found to be 99%.