Document templates

Kaspersky Security allows you to detect documents that were created on the basis of templates and layouts and might contain confidential data. The Document templates category allows you to specify a list of document templates against which the application will monitor for matches.

To detect matches with templates, Kaspersky Security uses Digital Fingerprints technology, which allows the application to convert text data into digital fragments.

When monitoring for leaks, the application compares fragments in email messages being scanned against fragments stored in the category. You can also configure Document match threshold to perform the following tasks:

• Detect completed templates of documents;
• Detect documents that partially or fully match templates.

The application stores no original documents (nor any parts of them) in the category. No original documents (nor any of their parts) that have been added to a category can be restored or read on the basis of fragments.

Category settings

Document match threshold determines the level of match between the document being scanned and a template added to the category; when this value is reached, the application registers a data leak by this category. This level is conditioned by two settings: minimum and maximum percentage of fragment match.

The minimum percentage of fragment match determines the minimum allowed similarity between scanned text and a template. If the scanned text matches the template at a lower rate than the value of this setting, the application registers no data leak by this category.

The maximum percentage of fragment match determines the maximum similarity between scanned text and a template. If the scanned text matches the template at a higher rate than the value of this setting, the application registers no data leak by this category.

The respective default values of these settings (30% and 99% similarity, respectively) ensure an optimal functioning of the category when handling most documents. In some cases, you may have to redefine these settings.

We recommend that you alter the minimum percentage of fragment match in the following cases:

• If scanned documents cause false positives (the application creates incidents when scanning documents that you do not view as matching any of the templates from the category). We recommend that you increase this value when configuring the category.
• If no match is found between scanned documents and any templates (the application cannot find the documents that you view as matching some of the templates from this category). We recommend that you decrease this value when configuring the category.

We recommend that you alter the maximum length of a matching sequence of fragments in the following cases:

• If you need to find documents, which completely match templates that have been added to the category (for example, the templates themselves). We recommend that you raise this value up to 100% when configuring the category in this case.
• If you need to exclude from the scan some documents, which are alternate versions of templates (for example, templates with slightly changed margins). We recommend that you decrease this value when configuring the category.

We recommend that you upload documents of an approximately equal size to a single category. We recommend that you create separate categories for documents if their size differs more than 2-3 times. Otherwise, detection of matches with templates added to the category may be far from optimal.

If you cannot find optimal values for the minimum and maximum percentage of fragment match, we recommend that you distribute the templates from this category by a few subcategories so that each of them contains templates with an approximately identical structure and file size.

Scenario of a check for matches with documents

1. Add a category with quotations from documents and configure it.
2. Add a policy for this category.

The application will check documents sent by email for matches with document patterns in the category.

Page top