Patent ID: 8181036

Claim:
A computer-implemented method for detecting extrusion of obfuscated content, comprising: comparing signatures of programs launched on a computer with signatures of known obfuscation tools; detecting launching of an obfuscation tool on the computer responsive to a signature of a program launched on the computer matching a signature of a known obfuscation tool; responsive to detecting launching of the obfuscation tool, determining if a file being opened by the obfuscation tool is classified as sensitive, the determining comprising: determining if the file contains a word/phrase indicative of sensitive information; responsive to determining that the file contains the word/phrase indicative of sensitive information, interrogating the file to glean a context in which the word/phrase is used; and determining whether the file is classified as sensitive responsive to results of the interrogation; responsive to a determination that the file being opened by the obfuscation tool is classified as sensitive, determining that the obfuscation tool produces an output file and classifying the output file as sensitive; computing a signature of the output file; and using the signature of the output file to prevent extrusion of obfuscated sensitive content within the output file.