System and method for detecting leaked documents on a computer network

Abstract

A system and a method of obtaining a location of a document on a computer network based on a document property. The method may include: receiving at least one basic marker and an encoding function associated with the document property; generating a search term according to the encoding function, based on the at least one basic marker; providing the search term to at least one search engine and obtaining therefrom one or more search results corresponding, where each search result may include one or more references to locations of documents on the computer network; discovering at least one document having the document property from the one or more search results and obtaining a discovered location of the document on the computer network; and performing at least one rule-based action, according to at least one document property of the discovered document.

1 - 14 . (canceled) 
     
     
         15 . A method for detecting leaked documents, the method comprising:
 using at least one processor to perform: 
 obtaining, from at least one search engine, one or more search results corresponding to one or more search terms generated using at least one marker and at least one encoding function associated with at least one document property of a document; 
 identifying, from among the one or more search results and using at least one decoding function, at least one document having the at least one document property and a respective at least one identified location on a computer network; 
 identifying at least one action to apply to a network entity using at least one identified location, content, and/or property of the at least one identified document; and 
 applying the at least one action to the network entity. 
   
     
     
         16 . The method of  claim 15 , wherein the encoding function comprises at least one obfuscation element. 
     
     
         17 . The method of  claim 15 , wherein the at least one marker comprises a character string or an image data element. 
     
     
         18 . The method of  claim 15 , wherein the at least one document property comprises a property selected from the group consisting of: a subject of the document, a title of the document, an owner of the document, a pertinence of the document, and a level of secrecy associated with the document. 
     
     
         19 . The method of  claim 15 , wherein the identifying the at least one document comprises: 
 retrieving one or more documents according to the at least one identified location, and   applying the at least one decoding function to the one or more retrieved documents to identify the at least one document having the at least one document property.   
     
     
         20 . The method of  claim 15 , wherein the identifying the at least one action comprises:
 classifying, using a machine-learning (ML) based classifier model, the at least one identified document based on the at least one identified location, content, and/or property of the at least one identified document on the computer network, and   selecting, based on the classification of the at least one identified document, the at least one action to apply to the network entity.   
     
     
         21 . The method of  claim 20 , wherein the ML-based classifier model comprises a natural language processing (NLP) model. 
     
     
         22 . A system for detecting leaked documents, the system comprising:
 a non-transitory memory storing executable code; and   at least one processor that, upon executing the executable code, performs a method comprising: 
 obtaining, from at least one search engine, one or more search results corresponding to one or more search terms generated using at least one marker and at least one encoding function associated with at least one document property of a document; 
 identifying, from among the one or more search results and using at least one decoding function, at least one document having the at least one document property and a respective at least one identified location on a computer network; 
 identifying at least one action to apply to a network entity using at least one identified location, content, and/or property of the at least one identified document; and 
 applying the at least one action to the network entity. 
   
     
     
         23 . The system of  claim 22 , wherein the encoding function comprises at least one obfuscation element. 
     
     
         24 . The system of  claim 22 , wherein the at least one marker comprises a character string or an image data element. 
     
     
         25 . The system of  claim 22 , wherein the at least one document property comprises a property selected from the group consisting of: a subject of the document, a title of the document, an owner of the document, a pertinence of the document, and a level of secrecy associated with the document. 
     
     
         26 . The system of  claim 22 , wherein the identifying at least one document comprises: 
 retrieving one or more documents according to the at least one identified location, and   applying the at least one decoding function to the one or more retrieved documents to identify the at least one document having the at least one document property.   
     
     
         27 . The system of  claim 22 , wherein the identifying at least one action comprises:
 classifying, using a machine-learning (ML) based classifier model, the at least one identified document based on the at least one identified location, content, and/or property of the at least one identified document on the computer network, and   selecting, based on the classification of the at least one identified document, the at least one action to apply to the network entity.   
     
     
         28 . The system of  claim 27 , wherein the ML-based classifier model comprises a natural language processing (NLP) model. 
     
     
         29 . At least one non-transitory memory storing executable code that, when executed by at least one processor, causes the at least one processor to perform a method for detecting leaked documents, the method comprising:
 obtaining, from at least one search engine, one or more search results corresponding to one or more search terms generated using at least one marker and at least one encoding function associated with at least one document property of a document;   identifying, from among the one or more search results and using at least one decoding function, at least one document having the at least one document property and a respective at least one identified location on a computer network;   identifying at least one action to apply to a network entity using at least one identified location, content, and/or property of the at least one identified document; and   applying the at least one action to the network entity.   
     
     
         30 . The method of  claim 29 , wherein the encoding function comprises at least one obfuscation element. 
     
     
         31 . The method of  claim 29 , wherein the at least one marker comprises a character string or an image data element. 
     
     
         32 . The method of  claim 29 , wherein the at least one document property comprises a property selected from the group consisting of: a subject of the document, a title of the document, an owner of the document, a pertinence of the document, and a level of secrecy associated with the document. 
     
     
         33 . The method of  claim 29 , wherein the identifying at least one document comprises: 
 retrieving one or more documents according to the at least one identified location, and   applying the at least one decoding function to the one or more retrieved documents to identify the at least one document having the at least one document property.   
     
     
         34 . The method of  claim 29 , wherein the identifying at least one action comprises:
 classifying, using a machine-learning (ML) based classifier model, the at least one identified document based on the at least one identified location, content, and/or property of the at least one identified document on the computer network, and selecting, based on the classification of the at least one identified document, the at least one action to apply to the network entity.