International Journal of Science, Engineering and TechnologyAuthors: Sabitha K, Sabaripriya S, Suganthi R
Abstract: Why have so many teams migrated their digital records to cloud setups? Mostly convenience, since moving information around off-site fundamentally altered daily administrative work. Yet these remote spaces still invite trouble. They leave confidential records exposed, let files slip out through unapproved sharing, leak company data, and host fishy account behavior. Older defenses mainly checked credentials, granted permissions, and handled basic gatekeeping, which leaves a noticeable blind spot. Teams still need active eyes on the actual files moving through the pipeline.To tackle this gap, we built DataShadow: a Privacy-First Cloud Data Exposure and Leakage Detection System with Risk-Based Analysis and Automated Incident Response. It tracks file movements, inspects uploads, catches sensitive text, and weighs potential threats using one unified interface. The codebase relies on Python alongside Flask, keeps structured tables inside MySQL, and hooks directly into Amazon Web Services (AWS) for hosting. In practice, operators get standard login tools, active session tracking, and a primary console where they inspect document histories and security alerts.Its tracking pipeline logs core metadata right away, noting the owner, upload timestamp, name, format, and byte size. Once a file lands, the system generates a SHA-256 hash, checks for dubious file extensions, sifts through content for private records, and grades overall danger. Each document receives a score from zero to one hundred, landing in Safe, Medium, High, or Critical tiers. Predefined rules then tag the record as Public, Internal, Confidential, or Restricted.DataShadow also runs User Behavior Analytics (UBA) against raw activity streams. It flags odd routines, such as persistent failed logins or bursts of uploading, downloading, and external sharing. Once an account crosses designated alert thresholds, the system flags possible insider threats and logs formal incidents. The system can lock down accounts on its own. When high-risk or critical triggers trip, the automated incident response tool logs the measure and restricts access, which prevents further damage. You also get a clean paper trail: audit logs, download records, sharing tracking, checksum integrity checks, origin data, and unbroken chain-of-custody details all map out what happens to each file.How does the AWS side handle this? DataShadow relies on Amazon Simple Storage Service (Amazon S3) for object storage, wired in via the Python Boto3 library. When an event crosses into the high-risk bracket, Amazon Simple Notification Service (Amazon SNS) pushes out email notices. This bridge tethers the core analysis to cloud storage and outward paging. From there, everything surfaces in a single interface: alerts, observed user habits, open incidents, risk ratings, labels, and audit
DOI:
