Automated fraudulent document detection

1. A method comprising:

receiving, at a document authentication system, a target document file that corresponds to a target document;

wherein the target document is in a format in which visual display of the target document is rendered based on target document code contained the target document file;

obtaining, at the document authentication system, information that indicates a target document class of the target document;

wherein the document authentication system includes a set of one or more detectors;

wherein the one or more detectors includes an in-class-code-anomaly detector;

using the in-class-code-anomaly detector, the document authentication system performing a comparison between (a) a feature of the target document code, and (b) a corresponding feature of sample set code contained in a sample set of documents that belong to the target document class, wherein the sample set of documents contains a plurality of documents;

based on the comparison, the in-class-code-anomaly detector generating a feature-specific anomaly score that reflects a degree of deviation between the feature of the target document code and the corresponding feature of the sample set code; and

based at least in part on the feature-specific anomaly score, the document authentication system generating a document anomaly score that indicates a likelihood that the target document is authentic;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 further comprising:

based on the document anomaly score, the document authentication performing at least one of:

indicating that the target document is authentic responsive to the document anomaly score falling below a first threshold, or

indicating that the target document is not authentic responsive to the document anomaly score exceeding a second threshold.

3. The method of claim 1 wherein:

the in-class-code-anomaly detector is an anomalous-tag-count detector; and

performing the comparison comprises performing a comparison between a number of occurrences of each tag in the target document code with a number of occurrences of each tag in the sample set code of each document in the sample set of documents.

4. The method of claim 1 wherein performing the comparison comprises comparing tags contained in the target document code against at least one of:

an expected set of tags that occur regularly in the sample set code, or an unexpected set of tags that occur rarely or never in the sample set code.

5. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a stripped-metadata detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the stripped-metadata detector.

6. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a suspicious-software detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the suspicious-software detector.

7. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a date-mismatch detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the date-mismatch detector.

8. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a suspicious-metadata-type detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the suspicious-metadata-type detector.

9. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a metadata-anomaly detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the metadata-anomaly detector.

10. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes an editing-tags detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the editing-tags detector.

11. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a mask-overlap detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the mask-overlap detector.

12. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a fonts-embedded-types detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the fonts-embedded-types detector.

13. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a multiple-fonts-types-within-element detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the multiple-fonts-types-within-element detector.

14. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes an annotation-masks detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the annotation-masks detector.

15. The method of claim 1 wherein:

the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;

the set of one or more detectors includes a previous-version-hidden detector; and

generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the previous-version-hidden detector.

16. The method of claim 1 further comprising generating a user interface that displays:

an image of the target document as rendered based on the target document code; and

overlayed on the image of the target document, indications of regions of the target document that correspond to anomalies detected by the one or more detectors.

17. The method of claim 16 wherein:

the anomaly associated with a particular region hides content that would otherwise be depicted in the image of the target document; and

the method further comprising displaying the content in association with the indication of the region that is associated with the anomaly.

18. The method of claim 16 wherein:

the anomalies detected by the one or more detectors include:

a first set of one or anomalies detected by a first detector; and

a second set of one or more anomalies detected by a second detector;

the indications of the regions that correspond to the first set of one or more anomalies are depicted in a first color that is different than a second color used for indications of the regions that correspond to the second set of one or more anomalies.