Method and system for tracing information leaks in organizations through syntactic and linguistic signatures

1. A computer-executable method for tracing information leaks, comprising:

obtaining, by a computing device, a disseminated document to analyze;

determining, from a collection of original documents, an original document that is most similar to the disseminated document;

comparing the disseminated document to the most similar original document to determine differences between the disseminated document and the most similar original document;

querying a database containing changes to documents, using the determined differences, to determine a most similar changed document;

determining a distance value by comparing changes from the most similar changed document with the determined differences from the disseminated document; and

responsive to determining that the distance value is less than a threshold value, determining a user identifier for a user associated with the most similar changed document.

2. The method of claim 1 , further comprising:

searching among change records for changes that are most similar to a determined difference between a second most similar original document and a second disseminated document; and

determining a second user identifier associated with the changes that are most similar to the determined difference.

3. The method of claim 1 , further comprising:

receiving a request for a specific document from a user;

retrieving the requested document from a storage;

determining a change to be applied to the requested document;

changing the requested document according to the determined change; and

providing the requested document to the user.

4. The method of claim 3 , wherein the change includes one or more of:

replacing a character in the requested document with an alternative character,

replacing a word in the requested document with a synonym for the word,

determining a part of speech category for the synonym,

repeating a character in the requested document, and/or

adding typographical errors to the requested document.

5. The method of claim 3 , further comprising:

storing, in a database, the determined changes with a document identifier and a particular user identifier associated with the user.

6. A computing system for tracing information leaks, the system comprising:

one or more processors,

a computer-readable medium coupled to the one or more processors having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

obtaining a disseminated document to analyze;

determining, from a collection of original documents, an original document that is most similar to the disseminated document;

comparing the disseminated document to the most similar original document to determine differences between the disseminated document and the most similar original document;

querying a database containing changes to documents, using the determined differences, to determine a most similar changed document;

determining a distance value by comparing changes from the most similar changed document with the determined differences from the disseminated document; and

responsive to determining that the distance value is less than a threshold value, determining a user identifier for a user associated with the most similar changed document.

7. The computing system of claim 6 , further comprising:

searching among change records for changes that are most similar to a determined difference between a second most similar original document and a second disseminated document; and

determining a second user identifier associated with the changes that are most similar to the determined difference.

8. The computing system of claim 6 , wherein the computer-readable storage medium stores additional instructions that, when executed, cause the one or more processors to perform additional steps comprising:

receiving a request for a specific document from a user;

retrieving the requested document from a storage;

determining a change to be applied to the requested document;

changing the requested document according to the determined change; and

providing the requested document to the user.

9. The computing system of claim 8 , wherein the change includes one or more of:

replacing a character in the requested document with an alternative character,

replacing a word in the requested document with a synonym for the word,

determining a part of speech category for the synonym,

repeating a character in the requested document, and/or

adding typographical errors to the requested document.

10. The computing system of claim 8 , wherein the computer-readable storage medium stores additional instructions that, when executed, cause the one or more processors to perform additional steps comprising:

storing, in a database, the determined changes with a document identifier and a particular user identifier associated with the user.

11. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for tracing information leaks, the method comprising:

obtaining a disseminated document to analyze;

determining, from a collection of original documents, an original document that is most similar to the disseminated document;

comparing the disseminated document to the most similar original document to determine differences between the disseminated document and the most similar original document;

querying a database containing changes to documents, using the determined differences, to determine a most similar changed document;

determining a distance value by comparing changes from the most similar changed document with the determined differences from the disseminated document; and

responsive to determining that the distance value is less than a threshold value, determining a user identifier for a user associated with the most similar changed document.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the method further comprises:

searching among change records for changes that are most similar to a determined difference between a second most similar original document and a second disseminated document; and

determining a second user identifier associated with the changes that are most similar to the determined difference.

13. The non-transitory computer-readable storage medium of claim 11 , wherein the computer-readable storage medium stores additional instructions that, when executed, cause the one or more processors to perform additional steps comprising:

receiving a request for a specific document from a user;

retrieving the requested document from a storage;

determining a change to be applied to the requested document;

changing the requested document according to the determined change; and

providing the requested document to the user.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the computer-readable storage medium stores additional instructions that, when executed, cause the one or more processors to perform additional steps comprising:

replacing a character in the requested document with an alternative character,

replacing a word in the requested document with a synonym for the word,

determining a part of speech category for the synonym,

repeating a character in the requested document, and/or

adding typographical errors to the requested document.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the computer-readable storage medium stores additional instructions that, when executed, cause the one or more processors to perform additional steps comprising:

storing, in a database, the determined changes with a document identifier and a particular user identifier associated with the user.

16. The method of claim 1 , wherein the changes associated with the most similar changed document include syntactical changes.