1. A computer-implemented method, comprising: receiving content comprising a plurality of terms with at least some of the plurality of terms comprising noise terms intermixed to known phrases; generating first hash sets for term subsets in the received content over a window of a window size configured to enable detection of a phrase indicative of confidential or sensitive information with the noise terms intermixed, each first hash set including first hashes of term subsets; determining whether a number of elements in the window exceeds a noise threshold, and, if the noise threshold is reached, deleting all hashes in a window buffer and starting a new phrase match detection based on the receiving, wherein the window buffer has a size K where K is a maximum number of the subject phrases and the window is sized equal to K+(K−1)×G where G is a gap length of a maximum number of noise elements of the noise; comparing the first hashes to a hash index, the hash index include sub-phrase scores indexed by hash values, each hash value corresponding to a hash of a term subsets of the phrase, and each sub-phrase scores is based on a cardinality of the phrase to which the term subset belongs; identifying sub-phrase scores for each of the first hashes based on the comparison; determining a subject phrase of a corresponding cardinality is present in the received content if the identified sub-phrase scores correspond to the sub-phrase scores based on the corresponding cardinality and the number of sub-phrase scores is less than the corresponding cardinality; and utilizing the identified sub-phrase scores for data leakage prevention of the confidential or sensitive information; wherein the noise terms comprise terms, words, symbols, and other data that when hashed do not match one of the first hashes of the phrase.