Method of identifying and tracking sensitive data and system thereof

A system capable of identifying sensitive data (SD) from amongst data stored on one or more data repositories, the system comprising a processor and memory block operatively coupled to the one or more data repositories, wherein the processor and memory block is configured to:

• process the data from the one or more data repositories to calculate a plurality of float feature (FF) vectors associated with the data, wherein, for each file of said data of a plurality of files of said data, a FF vector of said FF vectors is associated with said file and comprises a plurality of floating point numbers calculated in accordance with the binary content of said file,
• wherein, for at least some files of different size of the plurality of files, FF vectors associated with said some files have a fixed maximum byte length irrespective of a size of said some files,
• wherein process the data comprises, for each file of said data:
• extracting bytes from a binary content of the file, wherein at least some of the bytes are representative of a graphical content present in the file,
• dividing the bytes into a plurality of chunks,
• generating, for each chunk, a pair of values characterizing data in the chunk, thereby giving rise to a plurality of pairs of values,
• generating a plurality of nodes in a two dimensional space, wherein each node is associated with a pair of values of the plurality of pair of values, defining location of the node in the two dimensional space,
• generating objects characterizing a spatial relationship between nodes of the plurality of nodes, and
• generating the FF vector associated with the file based on the objects, cluster the plurality of FF vectors into a plurality of clusters, each cluster associated with a respective subset of the data being the data in respect of which the FF vectors in the cluster were calculated;
• generate, for each cluster, a vector representative of the cluster;
• compare the vectors representative of respective clusters to one or more FF vectors calculated for a respective one or more examples of SD;
• and
• classify one or more clusters as SD based on the result of said comparing, thereby identifying respective subsets of data as SD.

A non-transitory storage medium comprising instructions that when executed by a processor and memory block, cause the processor and memory block to perform a method of identifying sensitive data (SD) from amongst data stored on one or more data repositories, the method comprising:

• processing the data from the one or more data repositories to calculate a plurality of float feature (FF) vectors associated with the data, wherein, for each file of said data of a plurality of files of said data, a FF vector associated with said file and comprises a plurality of floating point numbers calculated in accordance with the binary content of said file,
• wherein, for at least some files of different size of the plurality of files, FF vectors associated with said some files have a fixed maximum byte length irrespective of a size of said some files,
• wherein the processing comprises, for each file of said data:
• extracting bytes from a binary content of the file, wherein at least some of the bytes are representative of a graphical content present in the file,
• dividing the bytes into a plurality of chunks,
• generating, for each chunk, a pair of values characterizing data in the chunk, thereby giving rise to a plurality of pairs of values,
• generating a plurality of nodes in a two dimensional space, wherein each node is associated with a pair of values of the plurality of pair of values, defining location of the node in the two dimensional space,
• generating objects characterizing a spatial relationship between nodes of the plurality of nodes, and
• generating the FF vector associated with the file based on the objects;
• clustering the plurality of FF vectors into a plurality of clusters, each cluster associated with a respective subset of the data being the data in respect of which the FF vectors in the cluster were calculated;
• generating, for each cluster, a vector representative of the cluster;
• comparing the vectors representative of respective clusters to one or more FF vectors calculated for a respective one or more examples of SD;
• and
• classifying one or more clusters as SD based on the result of said comparing, thereby identifying respective subsets of data as SD.