Uber's AI Guards Data at Scale

Organizations grapple with massive data flows, making it difficult to distinguish sensitive information from benign files. Traditional Data Loss Prevention (DLP) systems, reliant on keyword matching, often falter, leading to alert fatigue and potential security breaches. Uber recognized this challenge and built an AI-driven solution to gain deeper insight into outbound data.

The File Semantic Analyzer (FSA), detailed by Uber Engineering, tackles this by semantically classifying data. It aims to understand the nature and summary of information leaving the company's environment, drastically reducing the need for manual oversight and improving accuracy.

The Problem: A Digital Haystack

Imagine the daily deluge of files within a large enterprise, from strategic documents to personal photos. Identifying critical business information as these files egress is a monumental task.

Traditional DLP systems struggle because they lack true content understanding. They scan for keywords, not meaning, leading to both missed threats and a flood of irrelevant alerts.

The Solution: GenAI for Context

Uber's FSA leverages Generative AI to move beyond superficial pattern matching. The goal is to interpret and summarize file contents, providing security analysts with actionable insights.

• Data Labeling: The process begins with meticulously labeled datasets, classifying files as 'Business Critical,' 'Personal,' or 'Neutral.'
• Pre-Processing: Diverse file formats are converted to plain text. For image-based files, Optical Character Recognition (OCR) is employed. Intelligent chunking strategies maintain context for Large Language Models (LLMs) due to token limits.
• GenAI Interpretation: A fine-tuned LLM summarizes content, extracts key entities, and infers semantic intent. It provides probabilistic assessments of a file's criticality and can explain its reasoning. For example, it can identify a document as a 'highly sensitive merger agreement' or a 'personal travel itinerary with PII.'
• Policy Enforcement: The AI's output feeds into a rule-based engine for automated policy enforcement, such as alerting on specific types of sensitive data sent externally.
• Continuous Learning: Human analysts validate AI findings, providing feedback to refine the models and improve accuracy, transforming their role from reviewers to strategic validators.

This approach dramatically cuts down on false positives by 97% while ensuring fewer true positives are missed.

Architecture and Risk Management

The FSA architecture includes file connectors, a processing engine, prompt building for the GenAI, a decision engine, and a human-in-the-loop validation step. Managing risks like LLM hallucinations and context loss is paramount.

Mitigation strategies include requiring explanations for classifications, using intelligent chunking for large files, and maintaining human oversight for critical decisions. This ensures autonomous errors do not disrupt business operations.

Impact and Future Directions

The FSA has revolutionized Uber's data security, accelerating incident response times from hours to minutes. Analysts save an estimated 5 minutes per file, projecting significant time savings annually.

Future explorations include multimodal GenAI for analyzing images and videos directly, and integrating FSA's semantic enforcement into DLP systems for a more context-aware security posture.

Uber's journey with its File Semantic Analyzer represents a significant leap in protecting valuable organizational assets through intelligent data understanding.

The system's ability to infer intent and reason semantically offers a vital step toward autonomous defense.

By integrating Generative AI, Uber is building an intelligent guardian for its digital heartbeat.