Automated fraudulent document detection
Techniques are disclosed for determining the authenticity of a digital-origin document based, at least in part, on the code of the document. By determining authenticity based on the code of the document, authentication may take into account several features that are not detectable on the rendered image of a digital-origin document. The document class of a target document is initially determined. Anomalies are then detected in the code using various detectors, including but not limited to metadata-based detectors and content-based detectors. The output of the detectors may be combined to generate a document anomaly score that indicates likelihood that the document is not authentic.
1 . A method comprising:
receiving, at a document authentication system, a captured-image that includes a region that depicts a target document;
wherein the document authentication system includes a set of one or more detectors;
wherein the set of one or more detectors includes a common-surrounding-content detector;
identifying, by the document authentication system, target surrounding-content corresponding to the captured-image, wherein the target surrounding-content is content that corresponds to the captured-image;
using the common-surrounding-content detector, the document authentication system performing a comparison of the target surrounding-content to previously stored surrounding-content data; and
based at least in part on the comparison, the document authentication system generating a document anomaly score for the target document that indicates a likelihood that the target document is authentic;
wherein the method is performed by one or more computing devices.
2 . The method of claim 1 wherein generating the document anomaly score includes:
the common-surrounding-content detector generating a feature-specific anomaly score that reflects a degree of deviation between the target surrounding-content in the captured-image and the surrounding-content extracted from a population of captured-images of documents; and
generating the document anomaly score based at least in part on the feature-specific anomaly score.
3 . The method of claim 2 wherein the feature-specific anomaly score increases with an increase in a number of captured-images that have surrounding-content that matches the target surrounding-content.
4 . The method of claim 2 wherein the feature-specific anomaly score increases with an increase in how closely the target surrounding-content matches surrounding-content in the population of captured-images.
5 . The method of claim 2 further comprising:
based on the document anomaly score, the document authentication system performing at least one of:
indicating that the target document is authentic responsive to the document anomaly score falling below a first threshold, or
indicating that the target document is not authentic responsive to the document anomaly score exceeding a second threshold.
6 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a stripped-metadata detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the stripped-metadata detector.
7 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a suspicious-software detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the suspicious-software detector.
8 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a date-mismatch detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the date-mismatch detector.
9 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a suspicious-metadata-type detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the suspicious-metadata-type detector.
10 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a metadata-anomaly detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the metadata-anomaly detector.
11 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes an editing-tags detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the editing-tags detector.
12 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a mask-overlap detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the mask-overlap detector.
13 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a fonts-embedded-types detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the fonts-embedded-types detector.
14 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a multiple-fonts-types-within-element detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the multiple-fonts-types-within-element detector.
15 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes an annotation-masks detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the annotation-masks detector.
16 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes a previous-version-hidden detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the previous-version-hidden detector.
17 . The method of claim 2 wherein:
the feature-specific anomaly score is a first feature-specific anomaly score upon which the document anomaly score is based;
the set of one or more detectors includes an in-class-code-anomaly detector; and
generating the document anomaly score is based, at least in part, on a second feature-specific anomaly score generated by the in-class-code-anomaly detector.
18 . One or more non-transitory computer-readable media comprising instructions that, when executed by one or more hardware processors, cause performance of operations comprising:
receiving, at a document authentication system, a captured-image that includes a region that depicts a target document;
wherein the document authentication system includes a set of one or more detectors;
wherein the set of one or more detectors includes a common-surrounding-content detector;
identifying, by the document authentication system, target surrounding-content corresponding to the captured-image, wherein the target surrounding-content is content that corresponds to the captured-image;
using the common-surrounding-content detector, the document authentication system performing a comparison of the target surrounding-content to previously stored surrounding-content data; and
based at least in part on the comparison, the document authentication system generating a document anomaly score for the target document that indicates a likelihood that the target document is authentic.
19 . A system comprising:
one or more hardware processors;
one or more non-transitory computer-readable media; and
program instructions stored on the one or more non-transitory computer-readable media which, when executed by the one or more hardware processors, cause the system to perform operations comprising:
receiving, at a document authentication system, a captured-image that includes a region that depicts a target document;
wherein the document authentication system includes a set of one or more detectors;
wherein the set of one or more detectors includes a common-surrounding-content detector;
identifying, by the document authentication system, target surrounding-content corresponding to the captured-image, wherein the target surrounding-content is content that corresponds to the captured-image;
using the common-surrounding-content detector, the document authentication system performing a comparison of the target surrounding-content to previously stored surrounding-content data; and
based at least in part on the comparison, the document authentication system generating a document anomaly score for the target document that indicates a likelihood that the target document is authentic.