Detecting Bulk Document Leakage

Recently enterprises and corporations have reported several incidents of leakage of sensitive data and plagiarism of copyrighted information on the Web. We address the Bulk Document Leakage (BDL) problem: Given a large set of sensitive or copyrighted documents in an enterprise, determine if a portion of the document set has leaked (or has been plagiarized) and been published on the Web. An adversary who wishes to evade detection may partially tamper the content before publishing it. We present an automated tamper-proof low complexity algorithm to solve the BDL problem. We extract embedded signatures from sensitive documents and use them in conjunction with search engines to determine whether near-duplicate versions of the document (or portions of it) are available on the Web. The embedded signature is tamper-proof; even if an adversary partially modifies a document, our mechanism can detect duplicate copies. Also, if a duplicate copy is present in the Web, our system can detect such a copy with a small number of queries to a search engine. We have tested the validity and tamper-proof aspect of our algorithms over a wide range of documents and corpora gathered from different large enterprises. Based on access logs of a large enterprise, we show real-world evidence of bulk leakage across several other domains.