BISENSE: AN ENTERPRISE-GRADE SYSTEM FOR AUTOMATED SENSITIVITY DISCOVERY OF INTERNAL DATA

Mandatory Access Control (MAC) protects an organisation's data by attaching a sensitivity label to every protected object and letting a central authority, rather than individual users, decide who may read it. Its effectiveness therefore depends entirely on those labels being accurate and up to date, a requirement that manual classification cannot meet at the scale and pace of a modern enterprise data estate. This thesis presents BiSense, a deep-learning system that automates the labelling step for the most pervasive data substrate in the enterprise, the relational table, by inferring the sensitivity level of each of its columns. The problem is cast as the classification of a column into one of four ordinal levels, Public, Internal, Confidential, Secret, where the ordering encodes the asymmetric cost of disclosure: failing to protect sensitive data is far graver than over-protecting benign data. BiSense adopts a decoupled semantic--structure architecture: a large, frozen language model embeds each column independently, a lightweight trainable head (an MLP, or a graph neural network over the table's columns) classifies it, an F1-first threshold calibration converts probabilities into protective decisions, and a deterministic rule layer guarantees a floor of protection on rigid personally-identifiable formats. Freezing the backbone is the key adaptation to the data regime, which is extreme: the system is designed and validated on the operational data estate of a large apparel-retail company, comprising only a few dozen tables, a severely imbalanced class distribution, and labels that are themselves contested between internal catalogues. A rigorous low-data methodology, group-by-table cross-validation used as the training procedure, deep ensembling, test-time augmentation and label-shift-safe synthetic augmentation, combats the resulting variance. On the held-out test split the system attains a macro-F1 of 0.83 over the present classes with a recall above 0.97 on the sensitive classes and perfect separation of the Secret class, never collapsing a confidential column to Public. Extensive ablations isolate the contribution of each design choice, including the empirical finding that, in this low-data regime, a structure-agnostic head outperforms graph neural networks, and that a frozen specialised embedding model is the best feature extractor among those tested. The thesis thereby contributes a complete, reproducible pipeline, and a candid account of what works, what does not, and why, for automated sensitivity discovery in support of Mandatory Access Control.