System and Method for Identifying Leaked Data and Assigning Guilt to a Suspected Leaker

A method for measuring guilt with respect to a suspected leaked wild file, comprising the steps of:

• a. performing a first search for one of a plurality of salts in the wild file, wherein each salt is associated with a recipient ID, each of which in turn is associated with a recipient data file, the first search resulting in a set of bit counts, each comprising a bit value for each bit position in the recipient ID;
• b. applying a predetermined heuristic to each bit position to assign a heuristic value for each bit value to determine a first calculation of suspected guilty trusted third parties (TTPs);
• c. dividing the probability of guilt for each suspected guilty TTP by the number of suspected guilty TTPs;
• d. weighting the probability of guilt for each suspected guilty TTP by a factor associated with the number of bits matched to the recipient ID during detection to produce a first guilt score;
• e. applying a second search for one of a plurality of salts in the wild file;
• f. calculating a second guilt score for the suspected leaked wild file for each recipient file associated with a detected recipient ID;
• g. increasing the weight of recipient IDs detected after both the first and second searches;
• h. comparing the statistical distribution of data in the suspected leaked wild file to recipient files corresponding to the detected recipient IDs to produce a third guilt score;
• i. applying mixed data fingerprinting with principal components analysis to the wild file to produce a fourth guilt score;
• j. calculating a final guilt score by averaging the previously calculated first, second, third, and fourth guilt scores.