Identifying document generators by color footprints

A system comprising:

• one or more computers;
• and
• a computer-readable medium coupled to the one or more computers having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations comprising:
• training, in a training phase, a document generator detector, wherein the training includes training the document generator detector to detect whether input documents are generated by any particular document generator of multiple different known document generators including known valid document generators and known fraudulent document generators, and wherein the training includes, for each given known document generator of the multiple different known document generators:
• identifying a set of training documents that are each generated by the given known document generator and not by any other different document generators in the multiple different known document generators;
• determining, for each respective training document generated by the given known document generator, a document footprint for the respective training document that includes a set of most frequently occurring color values in the respective training document;
• and
• generating a document generator footprint for the given known document generator by determining, based on multiple document footprints of the set of training documents generated by the given known document generator, a set of common color values that occur in the multiple document footprints of the set of training documents generated by the given known document generator;
• receiving, in an inference phase, after document generator footprints are generated for the multiple different known document generators during the training phase, a request to classify a first document;
• generating a document footprint for the first document that includes a set of most frequently occurring color values in the first document;
• determining a classification for the first document that indicates whether the first document was generated by a first known document generator of the multiple different known document generators based on comparing the document footprint for the first document to the document generator footprint for the first known document generator;
• in response to determining that the classification for the first document indicates that the first document was generated by the first known document generator:
• providing an audit alert, in response to the request, in response to determining that the first known document generator is a known fraudulent generator;
• and
• providing an audit pass indication, in response to the request, in response to determining that the first known document generator is a known valid document generator;
• and
• in response to determining that the classification for the first document indicates that the first document was not generated by the first known document generator:
• identifying a next known document generator from the multiple different known document generators;
• and
• generating a next classification for the first document that indicates whether the first document was generated by the next known document generator.

A computer program product encoded on a non-transitory storage medium, the product comprising non-transitory, computer readable instructions for causing one or more processors to perform operations comprising:

• training, in a training phase, a document generator detector, wherein the training includes training the document generator detector to detect whether input documents are generated by any particular document generator of multiple different known document generators including known valid document generators and known fraudulent document generators, and wherein the training includes, for each given known document generator of the multiple different known document generators:
• identifying a set of training documents that are each generated by the given known document generator and not by any other different document generators in the multiple different known document generators;
• determining, for each respective training document generated by the given known document generator, a document footprint for the respective training document that includes a set of most frequently occurring color values in the respective training document;
• and
• generating a document generator footprint for the given known document generator by determining, based on multiple document footprints of the set of training documents generated by the given known document generator, a set of common color values that occur in the multiple document footprints of the set of training documents generated by the given known document generator;
• receiving, in an inference phase, after document generator footprints are generated for the multiple different known document generators during the training phase, a request to classify a first document;
• generating a document footprint for the first document that includes a set of most frequently occurring color values in the first document;
• determining a classification for the first document that indicates whether the first document was generated by a first known document generator of the multiple different known document generators based on comparing the document footprint for the first document to the document generator footprint for the first known document generator;
• in response to determining that the classification for the first document indicates that the first document was generated by the first known document generator:
• providing an audit alert, in response to the request, in response to determining that the first known document generator is a known fraudulent generator;
• and
• providing an audit pass indication, in response to the request, in response to determining that the first known document generator is a known valid document generator;
• and
• in response to determining that the classification for the first document indicates that the first document was not generated by the first known document generator:
• identifying a next known document generator from the multiple different known document generators;
• and
• generating a next classification for the first document that indicates whether the first document was generated by the next known document generator.