A value-based approach for information classification

Abstract

The digital transformation has revamped how products and services are produced and traded in the digital world. This innovation, bolstered by emerging technologies and evolving business models, underscores the growing importance of information to organizations and amplifies the significance of protecting it. However, a current challenge faced by information security teams is identifying which information requires safeguarding. Today, securing all information collected and produced by an organization is complex due to several limitations, such as budget constraints and understaffed security teams. Furthermore, organizations hold much information that does not require protection. Information classification is the cornerstone process to deal with this challenge in an organization. This process distinguishes confidential from non-confidential information and defines different sensitivity levels. Information classification is a previously introduced research topic, but its real-world application encounters several difficulties due to its manual nature. In order to overcome real-world barriers, scientific research has evaluated the application of natural language processing to automate the process. Most scientific studies proposed supervised learning approaches, which also present drawbacks, such as the significant effort to annotate sensitive labels and the limited flexibility for changes in the information classification scheme. Thus, this study proposes a new information classification model based on the information value. To the best of our knowledge, this is the first attempt to estimate the information value using textual features in the information classification context. The model assesses document value from two perspectives: (i) personal information associated with laws and regulations and (ii) confidential information related to the organizational context. The model applies information extraction and topic modeling to acquire document features and a regression model to estimate information value. We evaluated the proposed model by designing three experiments. The first experiment assessed the performance of two named entity recognition approaches and a relation extraction technique for identifying personal and sensitive personal data. We also implemented an experiment to evaluate the bag-of-words approach to classify documents into four departments. The third experiment assessed the model implementation using a corpus comprising 197 documents from an organization related to the educational sector. The proposed model evaluation implemented six experimental scenarios comprising three, four, and five-level information classification schemes. The model implementation using a Decision Tree regressor achieved an accuracy higher than 80% in the six scenarios. The study also presented that the BERT model outcome LSTM neural network in discovering personal data entities. Finally, the study demonstrated the feasibility of implementing a specific model to extract topics from each organization department since the text classification task achieved an accuracy that did not significantly impact the proposed information classification model.