Systems and methods for detecting attempts to transmit sensitive information via data-distribution channels

1. A computer-implemented method for detecting attempts to transmit sensitive information via data-distribution channels, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying an attempt to transmit a file through a data-distribution channel;

comparing, using an image-matching technique, the file with a plurality of known sensitive files that are both stored in image formats and protected by a data-loss-prevention policy;

comparing, using a finer image-matching technique that consumes more computing resources than the image-matching technique, the file and at least one known sensitive file from the plurality of known sensitive files that was not discarded by the image-matching technique;

determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy;

performing a security action in response to determining that the file violates the data-loss-prevention policy.

2. The computer-implemented method of claim 1 , wherein the security action comprises at least one of:

blocking the attempt to transmit the file through the data-distribution channel;

alerting an administrator to the attempt to transmit the file through the data-distribution channel;

informing a user that the attempt to transmit the file through the data-distribution channel violates the data-loss-prevention policy;

logging the attempt to transmit the file through the data-distribution channel.

3. The computer-implemented method of claim 1 , wherein comparing, using the image-matching technique, the file with the plurality of known sensitive files comprises converting the file into the image format.

4. The computer-implemented method of claim 1 , wherein the known sensitive file comprises a text-based form and determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy comprises determining that the file comprises an edited version of the text-based form.

5. The computer-implemented method of claim 1 , wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises creating a difference image that represents a set of elements that are different between the known sensitive file and the file.

6. The method of claim 1 , wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises identifying a set of key points within the file that are homologous to a set of key points within the known sensitive file.

7. The method of claim 1 , wherein comparing, using the finer image-matching technique, the file with the known sensitive file comprises at least one of:

comparing a single visual element of the file to a single visual element of the known sensitive file;

comparing a set of distance ratios between key features of the file to a set of distance ratios between key features of the known sensitive file;

comparing, using a distance metric, a set of feature vectors belonging to the file to a set of feature vectors belonging to the known sensitive file.

8. The computer-implemented method of claim 1 :

wherein comparing, using the image-matching technique, the file with the plurality of known sensitive files comprises identifying a gallery of known sensitive files that are both stored in the image formats and protected by the data loss prevention policy;

further comprising comparing, using a final image-matching technique that consumes more computing resources than the finer image-matching technique, the file and at least one known sensitive file within the gallery not discarded by the finer image-matching technique.

9. The computer-implemented method of claim 1 , wherein determining, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy comprises determining that the file includes personally identifying information.

10. The computer-implemented method of claim 1 , further comprising:

identifying an additional file that is stored on the computing device;

comparing, using the image-matching technique, the additional file with at least one additional known sensitive file that is both stored in an image format and protected by the data-loss-prevention policy;

determining, based on the image-matching technique, that the additional file violates the data-loss-prevention policy;

performing an additional security action in response to determining that the additional file violates the data-loss-prevention policy.

11. A system for detecting attempts to transmit sensitive information via data-distribution channels, the system comprising:

an identification module, stored in memory, that identifies an attempt to transmit a file through a data-distribution channel;

a comparison module, stored in memory, that:

compares, using an image-matching technique, the file with a plurality of known sensitive files that are both stored in image formats and protected by a data-loss-prevention policy;

compares, using a finer image-matching technique, the file with at least one known sensitive file from the plurality of known sensitive files that was not discarded by the image-matching technique;

a determination module, stored in memory, that determines, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy;

a security module, stored in memory, that performs a security action in response to determining that the file violates the data-loss-prevention policy;

at least one physical processor configured to execute the identification module, the comparison module, the determination module, and the security module.

12. The system of claim 11 , wherein the security action comprises at least one of:

blocking the attempt to transmit the file through the data-distribution channel;

alerting an administrator to the attempt to transmit the file through the data-distribution channel;

informing a user that the attempt to transmit the file through the data-distribution channel violates the data-loss-prevention policy;

logging the attempt to transmit the file through the data-distribution channel.

13. The system of claim 11 , wherein the comparison module compares, using the image-matching technique, the file with the plurality of known sensitive files by converting the file into the image format.

14. The system of claim 11 , wherein the known sensitive file comprises a text-based form and the determination module determines, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy by determining that the file comprises an edited version of the text-based form.

15. The system of claim 11 , wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by creating a difference image that represents a set of elements that are different between the known sensitive file and the file.

16. The system of claim 11 , wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by identifying a set of key points within the file that are homologous to a set of key points within the known sensitive file.

17. The system of claim 11 , wherein the comparison module compares, using the finer image-matching technique, the file with the known sensitive file by at least one of:

comparing a single visual element of the file to a single visual element of the known sensitive file;

comparing a set of distance ratios between key features of the file to a set of distance ratios between key features of the known sensitive file;

comparing, using a distance metric, a set of feature vectors belonging to the file to a set of feature vectors belonging to the known sensitive file.

18. The system of claim 11 , wherein the comparison module:

compares, using the image-matching technique, the file with the plurality of known sensitive files by identifying a gallery of known sensitive files that are both stored in the image formats and protected by the data loss prevention policy;

compares, using the finer image-matching technique that consumes more computing resources than the image-matching technique, the file and the at least one known sensitive file by comparing, using a final image-matching technique that consumes more computing resources than the finer image-matching technique, the file and at least one known sensitive file within the gallery not discarded by the finer image-matching technique.

19. The system of claim 11 , wherein the determination module determines, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy by determining that the file includes personally identifying information.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify an attempt to transmit a file through a data-distribution channel;

compare, using an image-matching technique, the file with a plurality of known sensitive files that are both stored in image formats and protected by a data-loss-prevention policy;

compare, using a finer image-matching technique that consumes more computing resources than the image-matching technique, the file and at least one known sensitive file from the plurality of known sensitive files that was not discarded by the image-matching technique;

determine, based on the results of the finer image-matching technique, that the file violates the data-loss-prevention policy;

perform a security action in response to determining that the file violates the data-loss-prevention policy.