Systems and methods for detecting attempts to transmit sensitive information via data-distribution channels

Patent metadata

Field	Value
Publication number	US-9436821-B2
Application number	US-201414483131-A
Country	US
Kind code	B2
Filing date	Sep 10, 2014
Priority date	Sep 10, 2014
Publication date	Sep 6, 2016
Grant date	Sep 6, 2016

Abstract

The disclosed computer-implemented method for detecting attempts to transmit sensitive information via data-distribution channels may include (1) identifying an attempt to transmit a file through a data-distribution channel, (2) comparing, using an image-matching technique, the file with at least one known sensitive file that is both stored in an image format and protected by a data-loss-prevention policy, (3) determining, based on the results of the image-matching technique, that the file violates the data-loss-prevention policy, and (4) performing a security action in response to determining that the file violates the data-loss-prevention policy. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for detecting attempts to transmit sensitive information via data-distribution channels, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying an attempt to transmit a file through a data-distribution channel;
comparing, using an image-matching technique, the file with a plurality of known sensitive files that are both stored in image formats and protected by a data-loss-prevention policy;
comparing, using a finer image-matching technique that consumes more computing resources than the image-matching technique, the file and at least one known sensitive file from the plurality of known sensitive files that was not discarded by the image-matching technique;
determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy;
performing a security action in response to determining that the file violates the data-loss-prevention policy.

2. The computer-implemented method of claim 1 , wherein the security action comprises at least one of:
blocking the attempt to transmit the file through the data-distribution channel;
alerting an administrator to the attempt to transmit the file through the data-distribution channel;
informing a user that the attempt to transmit the file through the data-distribution channel violates the data-loss-prevention policy;
logging the attempt to transmit the file through the data-distribution channel.

3. The computer-implemented method of claim 1 , wherein comparing, using the image-matching technique, the file with the plurality of known sensitive files comprises converting the file into the image format.

4. The computer-implemented method of claim 1 , wherein the known sensitive file comprises a text-based form and determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy comprises determining that the file comprises an edited version of the text-based form.

5. The computer-implemented method of claim 1 , wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises creating a difference image that represents a set of elements that are different between the known sensitive file and the file.

6. The method of claim 1 , wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises identifying a set of key points within the file that are homologous to a set of key points within the known sensitive file.

7. The method of claim 1 , wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises at least one of:
comparing a single visual element of the file to a single visual element of the known sensitive file;
comparing a set of distance ratios between key features of the file to a set of distance ratios between key features of the known sensitive file;
comparing, using a distance metric, a set of feature vectors belonging to the file to a set of feature vectors belonging to the known sensitive file.

8. The computer-implemented method of claim 1 :
wherein comparing, using the image-matching technique, the file with the plurality of known sensitive files comprises identifying a gallery of known sensitive files that are both stored in the image formats and protected by the data loss prevention policy;
further comprising comparing, using a final image-matching technique that consumes more computing resources than the finer image-matching technique, the file and at least one known sensitive file within the gallery not discarded by the finer image-matching technique.

9. The computer-implemented method of claim 1 , wherein determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy comprises determining that the file includes personally identifying information.

10. The computer-implemented method of claim 1 , further comprising:
identifying an additional file that is stored on the computing device;
comparing, using the image-matching technique, the additional file with at least one additional known sensitive file that is both stored in an image format and protected by the data-loss-prevention policy;
determining, based on the image-matching technique, that the additional file violates the data-loss-prevention policy;
performing an additional security action in response to determining that the additional file violates the data-loss-prevention policy.

11. A system for detecting attempts to transmit sensitive information via data-distribution channels, the system comprising:
an identification module, stored in memory, that identifies an attempt to transmit a file through a data-distribution channel;
a comparison module, stored in memory, that:
compares, using an image-matching technique, the file with a plurality of known sensitive files that are both stored in image formats and protected by a data-loss-prevention policy;
compares, using a finer image-matching technique, the file with at least one known sensitive file from the plurality of known sensitive files that was not discarded by the image-matching technique;

a determination module, stored in memory, that determines, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy;
a security module, stored in memory, that performs a security action in response to determining that the file violates the data-loss-prevention policy;
at least one physical processor configured to execute the identification module, the comparison module, the determination module, and the security module.

12. The system of claim 11 , wherein the security action comprises at least one of:
blocking the attempt to transmit the file through the data-distribution channel;
alerting an administrator to the attempt to transmit the file through the data-distribution channel;
informing a user that the attempt to transmit the file through the data-distribution channel violates the data-loss-prevention policy;
logging the attempt to transmit the file through the data-distribution channel.

13. The system of claim 11 , wherein the comparison module compares, using the image-matching technique, the file with the plurality of known sensitive files by converting the file into the image format.

14. The system of claim 11 , wherein the known sensitive file comprises a text-based form and the determination module determines, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy by determining that the file comprises an edited version of the text-based form.

15. The system of claim 11 , wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by creating a difference image that represents a set of elements that are different between the known sensitive file and the file.

16. The system of claim 11 , wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by identifying a set of key points within the file that are homologous to a set of key points within the known sensitive file.

17. The system of claim 11 , wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by at least one of:
comparing a single visual element of the file to a single visual

Assignees

• Symantec Corp

Inventors

• Antoun Ramzi Abi
• Lindsay Michael

Classifications

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F21/60

  Protecting data · CPC title

• G06F21/50 Primary

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title