Systems and methods for detecting, localizing, and visualizing manipulations of portable document format files
Systems and methods for detecting and localizing manipulations of portable document format (PDF) files are provided. The system receives one or more PDF files and processes each PDF file using a plurality of check processes. Each check process includes a defined or learned weight that determines that process's level of influence on any document's overall suspicion score, as well as an opinion score for each PDF file based on unique logic and a plurality of factors related to the particular PDF file. The system can generate an overall suspicion score for the PDF file based on the results of the check processes, which can be calculated by aggregating the weight and an opinion score associated with each check process and file. The system can then determine whether the PDF file is a suspicious file using the overall suspicion score.
1 . A system for detecting manipulation of a file, comprising:
means for receiving at least one file to be analyzed; and
a processor in communication with the said means, the processor programmed to:
process the at least one file using a plurality of check processes, each of the plurality of check processes generating a weight and a confidence score after processing the at least one file;
generate an overall suspicion score for the at least one file based on the weights and confidence scores generated by the plurality of check processes;
determine whether the at least one file is suspicious based on the overall suspicion score;
identify one or more areas of overlap in the at least one file;
apply a highlight to the at least one file based on bounding boxes of each object detected in each overlapping area;
identify layers in the at least one file and any objects that obscure underlying text of the at least one file; and
create a document mockup with overlapping areas removed and original text or images of the at least one file highlighted.
2 . The system of claim 1 , wherein the plurality of check processes includes a claim date check process for checking a date of a claim indicated in the at least one file.
3 . The system of claim 2 , wherein the claim date check process retrieves a claim date or range, determines a creation date of the at least one file, and compares the creation date to the claim date or range.
4 . The system of claim 1 , wherein the plurality of check processes includes a signature check process for checking a digital signature associated with the at least one file.
5 . The system of claim 1 , wherein the plurality of check processes includes an encryption check process for checking encryption of the at least one file.
6 . The system of claim 1 , wherein the plurality of check processes includes a blocklist check processes for checking an editor used to edit the at least one file.
7 . The system of claim 1 , wherein the plurality of check processes includes an end-of-file and identification check process for checking at least one of an end-of-file indicator or a file identifier associated with the at least one file.
8 . The system of claim 1 , wherein the plurality of check processes includes a creation or modification date check process for checking at least one of a creation date or a modification date of the at least one file.
9 . The system of claim 1 , wherein the plurality of check processes includes a creator or producer check process for checking at least one of a creator or a producer of the at least one file.
10 . The system of claim 1 , wherein the plurality of check processes includes an overlapping objects check process for checking whether one or more overlapping objects exist in the at least one file.
11 . The system of claim 1 , wherein the plurality of check processes includes a fonts check process for checking a font associated with the at least one file.
12 . The system of claim 1 , wherein the plurality of check processes includes a tagged check process for checking whether the at least one file has been tagged for suspicious content.
13 . The system of claim 1 , wherein the processor generates overlap location coordinates for the overlapping areas.
14 . The system of claim 1 , wherein the processor determines whether the at least one file was saved using an incremental save or a full save.
15 . The system of claim 14 , wherein the processor reads a file trailer to find a cross-reference table or stream if the at least one file was saved using an incremental save.
16 . The system of claim 15 , wherein the processor uses the cross-reference table or stream to locate all objects in the document.
17 . The system of claim 16 , wherein the processor uses generation information for each object in the at least one file to determine which objects contain changes from an original version of the at least one file.
18 . The system of claim 17 , wherein the processor regenerates a file corresponding to each generation of the at least one file and highlights each change between each generation.
19 . The system of claim 18 , wherein the processor identifies location coordinates for each change.
20 . A method for detecting manipulation of a file, comprising:
receiving at least one file at a processor;
processing the at least one file using a plurality of check processes, each of the plurality of check processes generating a weight and a confidence score after processing the at least one file;
generating an overall suspicion score for the at least one file based on the weights and confidence scores generated by the plurality of check processes;
determining whether the at least one file is suspicious based on the overall suspicion score;
identifying one or more areas of overlap in the at least one file;
applying a highlight to the at least one file based on bounding boxes of each object detected in each overlapping area;
identifying layers in the at least one file and any objects that obscure underlying text of the at least one file; and
creating a document mockup with overlapping areas removed and original text or images of the at least one file highlighted.
21 . The method of claim 20 , wherein the plurality of check processes includes a claim date check process for checking a date of a claim indicated in the at least one file.
22 . The method of claim 21 , wherein the claim date check process retrieves a claim date or range, determines a creation date of the at least one file, and compares the creation date to the claim date or range.
23 . The method of claim 20 , wherein the plurality of check processes includes a signature check process for checking a digital signature associated with the at least one file.
24 . The method of claim 20 , wherein the plurality of check processes includes an encryption check process for checking encryption of the at least one file.
25 . The method of claim 20 , wherein the plurality of check processes includes a blocklist check processes for checking an editor used to edit the at least one file.
26 . The method of claim 20 , wherein the plurality of check processes includes an end-of-file and identification check process for checking at least one of an end-of-file indicator or a file identifier associated with the at least one file.
27 . The method of claim 20 , wherein the plurality of check processes includes a creation or modification date check process for checking at least one of a creation date or a modification date of the at least one file.
28 . The method of claim 20 , wherein the plurality of check processes includes a creator or producer check process for checking at least one of a creator or a producer of the at least one file.
29 . The method of claim 20 , wherein the plurality of check processes includes an overlapping objects check process for checking whether one or more overlapping objects exist in the at least one file.
30 . The method of claim 20 , wherein the plurality of check processes includes a fonts check process for checking a font associated with the at least one file.
31 . The method of claim 20 , wherein the plurality of check processes includes a tagged check process for checking whether the at least one file has been tagged for suspicious content.
32 . The method of claim 20 , further comprising generating overlap location coordinates for the overlapping areas.
33 . The method of claim 20 , further comprising determining whether the at least one file was saved using an incremental save or a full save.
34 . The method of claim 33 , further comprising finding a cross-reference table or stream if the at least one file was saved using an incremental save.
35 . The method of claim 34 , further comprising using the cross-reference table or stream to locate all objects in the document.
36 . The method of claim 35 , further comprising using generation information for each object in the at least one file to determine which objects contain changes from an original version of the at least one file.
37 . The method of claim 36 , further comprising regenerating a file corresponding to each generation of the at least one file and highlights each change between each generation.
38 . The method of claim 37 , further comprising identifying location coordinates for each change.