# US 9,436,821 B2 · Systems and methods for detecting attempts to transmit sensitive information via data-distribution channels > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,821 B2 - Document ID: US9436821B2 - Status: Granted - Kind: B2 - Application number: 14/483,131 - Filed: 2014-09-10 - Published: 2016-03-10 - Granted: 2016-09-06 - Earliest claimed: 2014-09-10 - Assignees: Symantec Corporation - Applicants: Symantec Corporation - Inventors: Ramzi Abi Antoun; Michael Lindsay - Web page: https://patentgrep.com/patent/US9436821B2 ## CPC - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/60: Protecting data - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosed computer-implemented method for detecting attempts to transmit sensitive information via data-distribution channels may include (1) identifying an attempt to transmit a file through a data-distribution channel, (2) comparing, using an image-matching technique, the file with at least one known sensitive file that is both stored in an image format and protected by a data-loss-prevention policy, (3) determining, based on the results of the image-matching technique, that the file violates the data-loss-prevention policy, and (4) performing a security action in response to determining that the file violates the data-loss-prevention policy. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for detecting attempts to transmit sensitive information via data-distribution channels, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying an attempt to transmit a file through a data-distribution channel; comparing, using an image-matching technique, the file with a plurality of known sensitive files that are both stored in image formats and protected by a data-loss-prevention policy; comparing, using a finer image-matching technique that consumes more computing resources than the image-matching technique, the file and at least one known sensitive file from the plurality of known sensitive files that was not discarded by the image-matching technique; determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy; performing a security action in response to determining that the file violates the data-loss-prevention policy. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the security action comprises at least one of: blocking the attempt to transmit the file through the data-distribution channel; alerting an administrator to the attempt to transmit the file through the data-distribution channel; informing a user that the attempt to transmit the file through the data-distribution channel violates the data-loss-prevention policy; logging the attempt to transmit the file through the data-distribution channel. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein comparing, using the image-matching technique, the file with the plurality of known sensitive files comprises converting the file into the image format. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the known sensitive file comprises a text-based form and determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy comprises determining that the file comprises an edited version of the text-based form. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises creating a difference image that represents a set of elements that are different between the known sensitive file and the file. ### Claim 6 (depends on 1) The method of claim 1, wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises identifying a set of key points within the file that are homologous to a set of key points within the known sensitive file. ### Claim 7 (depends on 1) The method of claim 1, wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises at least one of: comparing a single visual element of the file to a single visual element of the known sensitive file; comparing a set of distance ratios between key features of the file to a set of distance ratios between key features of the known sensitive file; comparing, using a distance metric, a set of feature vectors belonging to the file to a set of feature vectors belonging to the known sensitive file. ### Claim 8 (depends on 1) The computer-implemented method of claim 1: wherein comparing, using the image-matching technique, the file with the plurality of known sensitive files comprises identifying a gallery of known sensitive files that are both stored in the image formats and protected by the data loss prevention policy; further comprising comparing, using a final image-matching technique that consumes more computing resources than the finer image-matching technique, the file and at least one known sensitive file within the gallery not discarded by the finer image-matching technique. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy comprises determining that the file includes personally identifying information. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, further comprising: identifying an additional file that is stored on the computing device; comparing, using the image-matching technique, the additional file with at least one additional known sensitive file that is both stored in an image format and protected by the data-loss-prevention policy; determining, based on the image-matching technique, that the additional file violates the data-loss-prevention policy; performing an additional security action in response to determining that the additional file violates the data-loss-prevention policy. ### Claim 11 A system for detecting attempts to transmit sensitive information via data-distribution channels, the system comprising: an identification module, stored in memory, that identifies an attempt to transmit a file through a data-distribution channel; a comparison module, stored in memory, that: compares, using an image-matching technique, the file with a plurality of known sensitive files that are both stored in image formats and protected by a data-loss-prevention policy; compares, using a finer image-matching technique, the file with at least one known sensitive file from the plurality of known sensitive files that was not discarded by the image-matching technique; a determination module, stored in memory, that determines, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy; a security module, stored in memory, that performs a security action in response to determining that the file violates the data-loss-prevention policy; at least one physical processor configured to execute the identification module, the comparison module, the determination module, and the security module. ### Claim 12 (depends on 11) The system of claim 11, wherein the security action comprises at least one of: blocking the attempt to transmit the file through the data-distribution channel; alerting an administrator to the attempt to transmit the file through the data-distribution channel; informing a user that the attempt to transmit the file through the data-distribution channel violates the data-loss-prevention policy; logging the attempt to transmit the file through the data-distribution channel. ### Claim 13 (depends on 11) The system of claim 11, wherein the comparison module compares, using the image-matching technique, the file with the plurality of known sensitive files by converting the file into the image format. ### Claim 14 (depends on 11) The system of claim 11, wherein the known sensitive file comprises a text-based form and the determination module determines, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy by determining that the file comprises an edited version of the text-based form. ### Claim 15 (depends on 11) The system of claim 11, wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by creating a difference image that represents a set of elements that are different between the known sensitive file and the file. ### Claim 16 (depends on 11) The system of claim 11, wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by identifying a set of key points within the file that are homologous to a set of key points within the known sensitive file. ### Claim 17 (depends on 11) The system of claim 11, wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by at least one of: comparing a single visual element of the file to a single visual element of the known sensitive file; comparing a set of distance ratios between key features of the file to a set of distance ratios between key features of the known sensitive file; comparing, using a distance metric, a set of feature vectors belonging to the file to a set of feature vectors belonging to the known sensitive file. ### Claim 18 (depends on 11) The system of claim 11, wherein the comparison module: compares, using the image-matching technique, the file with the plurality of known sensitive files by identifying a gallery of known sensitive files that are both stored in the image formats and protected by the data loss prevention policy; compares, using the finer image-matching technique that consumes more computing resources than the image-matching technique, the file and the at least one known sensitive file by comparing, using a final image-matching technique that consumes more computing resources than the finer image-matching technique, the file and at least one known sensitive file within the gallery not discarded by the finer image-matching technique. ### Claim 19 (depends on 11) The system of claim 11, wherein the determination module determines, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy by determining that the file includes personally identifying information. ### Claim 20 A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: identify an attempt to transmit a file through a data-distribution channel; compare, using an image-matching technique, the file with a plurality of known sensitive files that are both stored in image formats and protected by a data-loss-prevention policy; compare, using a finer image-matching technique that consumes more computing resources than the image-matching technique, the file and at least one known sensitive file from the plurality of known sensitive files that was not discarded by the image-matching technique; determine, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy; perform a security action in response to determining that the file violates the data-loss-prevention policy.