A MODEL OF THE DATA LEAKAGE DETECTION PROCESS WITH EVOLUTIONARY ADAPTATION

Abstract

The paper presents a generalized model of the data leakage detection process with evolutionary adaptation, built on the integration of three functional components: document classification based on a genetic algorithm with IF-THEN rules, concept drift detection via a dual-window statistical detector (Kolmogorov–Smirnov and t-test), and adaptive user behavioral profiling with exponential forgetting. A DLP-system architecture is described. The feedback mechanism is demonstrated, whereby the drift detector intensifies mutation in the genetic algorithm while the behavioral module adjusts threshold values. Experimental evaluation on the DISC corpus of declassified government documents (2,450 documents, three security levels) confirms that the GA classifier achieves F1 = 0.867, falling behind ensemble methods by only 5-6 % while maintaining full interpretability; the adaptation mechanism increases prequential F1 by 7.6%; and the behavioral detector with genetic weight optimization provides FPR = 0.023. The model maintains full interpretability of decisions suitable for audit and verification by security experts.