Each packet leaving the source is assigned a data sensitivity S ∈ {0,1}, an egress channel (lane) with a fixed channel risk C (Email 0.35, Cloud upload 0.45, Web upload 0.55, USB / removable media 0.85), and a context signal A ∈ [0,1] describing how anomalous the originating session looks (off-hours, unusual volume, new device…).
Context-aware risk score:
R = 0.5·S + 0.3·C + 0.2·A
Legacy keyword-only DLP:
R = 0.8·S (channel and behavior ignored)
Decision:
block/quarantine if R ≥ τ, else allow
- Detection threshold τ — the risk cutoff a policy engine blocks at. Raise it to catch more real leaks at the cost of more false positives; lower it to reduce friction at the cost of missed leaks.
- Sensitive-data mix — the share of outbound packets that actually carry confidential/restricted content, set by the classification engine.
- Anomalous-session rate — how often traffic originates from a risky context (behavior analytics signal); only affects the score when context-aware policies are on.
- Context-aware toggle — switches between the full formula (sensitivity + channel + behavior) and the legacy keyword-only model, which ignores where and how data is leaving — the exact gap modern DLP closes.
Reading the two panels: the top flow view shows four egress lanes (drag to pan, scroll/pinch to zoom, like orbiting a camera around the pipeline); a packet crossing the dashed evaluation line is scored and either continues to its gate (green) or dives into the quarantine strip (amber). The bottom risk-space scatter plots every evaluated packet by channel risk (x) against its computed score R (y), with the threshold drawn as a live horizontal line — watch the whole cloud of points shift as you drag the sliders.
Real-world relevance: this mirrors how modern DLP platforms combine content inspection, CASB channel telemetry and UEBA (user/entity behavior analytics) into one risk-based policy decision, instead of a flat keyword match that both over-blocks harmless traffic and under-blocks quiet exfiltration over a high-risk channel.
Note: the formula weights (0.5/0.3/0.2, summing to 1.0) and channel-risk constants were checked against the original 3D engine and are internally consistent — max context-aware score is 0.5+0.3·0.85+0.2·1=0.955, always below 1, and the legacy score is a strict subset (0.8·S only). No correction was needed.