102 and to receive and process responses from the server 102.

The end-user client device 104 and the auditor client device 105 are each generally intended to encompass any client computing device such as a laptop/notebook computer, wireless data port, smart phone, personal data assistant (PDA), tablet computing device, one or more processors within these devices, or any other suitable processing device. For example, a client device may comprise a computer that includes an input device, such as a keypad, touch screen, or other device that can accept user information, and an output device that conveys information associated with the operation of the server 102, or the respective client device itself, including digital data, visual information, or a GUI 162 or 163.

The GUI 162 and the GUI 163 each interface with at least a portion of the system 100 for any suitable purpose, including generating a visual representation of the expense report application 110 or the audit application 121, respectively. In particular, the GUI 162 and the GUI 163 may each be used to view and navigate various Web pages. Generally, the GUI 162 and the GUI 163 each provide a respective user with an efficient and user-friendly presentation of data provided by or communicated within the system. The GUI 162 and the GUI 163 may each comprise a plurality of customizable frames or views having interactive fields, pull-down lists, and buttons operated by the user. The GUI 162 and the GUI 163 each contemplate any suitable graphical user interface, such as a combination of a generic web browser, intelligent engine, and command line interface (CLI) that processes information and efficiently presents the results to the user visually.

Memory 164 and memory 165 included in the end-user client device 104 and the auditor client device 105 may each include any memory or database module and may take the form of volatile or non-volatile memory including, without limitation, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), removable media, or any other suitable local or remote memory component. The memory 164 and the memory 165 may each store various objects or data, including user selections, caches, classes, frameworks, applications, backup data, business objects, jobs, web pages, web page templates, database tables, repositories storing business and/or dynamic information, and any other appropriate information including any parameters, variables, algorithms, instructions, rules, constraints, or references thereto associated with the purposes of the associated client device.

There may be any number of end-user client devices 104, auditor client devices 105, fraudulent entities 106a, and valid entities 106b associated with, or external to, the system 100. Further, the term “client,” “client device,” and “user” may be used interchangeably as appropriate without departing from the scope of this disclosure. Moreover, while client devices may be described in terms of being used by a single user, this disclosure contemplates that many users may use one computer, or that one user may use multiple computers.

FIG. 2A illustrates an example process 200 for generating a document generator footprint. In an input stage 202, generated documents 204 previously generated by a document generator are identified. A processing stage 206 includes processing steps 208. The processing steps 208 include calculation of a histogram of color values for each generated document. The histograms are evaluated to determine common colors present in the generated documents. An output stage 210 includes providing the common colors 212, for example, to an inference engine.

FIG. 2B is a diagram 250 that illustrates generation of a footprint 252 for a particular document generator. In the example of FIG. 2B, the footprint 252 is generated based on colors of three documents (e.g., documents 254a, 254b, and 254c) known to have been generated by the particular document generator. Although three documents are shown, a footprint can be generated from a set of documents that includes more than three documents.

For each of the document 254a, the document 254b, and the document 254c, a respective histogram 256a, 256b, or 256c can be generated. Each of the histograms 256a, 256b, and 256c represent counts of most-frequently occurring colors included in a respective document 254a, 254b, or 254c. Each of the histogram 256a, 256b, and 256c include counts of the top ten most-occurring colors in a respective document 254a, 254b, or 254c. Although a value of ten is used as a count of top-occurring color values, a value other than ten can be used. A top N (e.g., top 10) most frequent colors, as illustrated by the histograms 256a, 256b, and 256c, can represent footprints of particular documents (e.g., documents 254a, 254b, and 254c).

The histograms 256a, 256b, and 256c include counts for color values that are represented by three values, representing Red, Green, and Blue values of pixels in a respective document. Other types of color values can be used. For example, for grayscale documents, a single number representing a single intensity value may be used. In some cases, four values may be used (e.g., representing RGB (Red, Green, Blue) and a fourth alpha value representing transparency). In some cases, generation of the histograms 256a, 256b, and 256c includes ignoring color values that represent black (e.g., RGB(0,0,0) and/or white (e.g., RGB(255, 255, 255).

Generation of the footprint 252 can include determining whether at least k (e.g., 4) colors appear in each of the histograms 256a, 256b, and 256c (or appear in each histogram with at least a threshold frequency). If at least k colors appear in each of the histograms 256a, 256b, and 256c, then the footprint 252 can include k colors, as shown.

In the example of FIG. 2B, the histogram 256a includes four top colors 258a, 258b, 258c, and 258d, with corresponding counts of 260a, 260b, 260c, and 260d, respectively. Each of the colors 258a, 258b, 258c, and 258d occur in both the histogram 256b and the histogram 256c. For example, the color 258a is included in the histogram 256b as color 262a and in the histogram 256c as color 264a, the color 258b is included in the histogram 256b as color 262b and in the histogram 256c as color 264b, the color 258c is included in the histogram 256b as color 262c and in the histogram 256c as color 264c, and the color 258d is included in the histogram 256b as color 262d and in the histogram 256c as color 264d.

Accordingly, the footprint 252 includes a color 266a (matching the colors 258a, 262a, and 264a), a color 266b (matching the colors 258b, 262b, and 264b), a color 266c (matching the colors 258c, 262c, and 264c), and a color 266d (matching the colors 258d, 262d, and 264d). The colors in the footprint 252 can be referred to as template colors for the document generator (e.g., colors generally included in documents generated by the document generator). The footprint 252, therefore, represents a footprint for the document generator itself. The footprint 252 can be used in an inference phase, as described below.

FIG. 3 illustrates an example system 300 for determining whether a document has been generated by a particular document generator. In an input stage 302, a document to classify 304 (e.g., a document 304a) is identified. The input stage 302 can also include identifying a generator footprint 305 (e.g., common colors) of a document generator generated during a learning phase, as described above. The generator footprint 305 includes colors 305a, 305b, 305c, and 305d.

A processing (e.g., inference) stage 306 includes a comparison step 308 of comparing top colors 309 in the document to classify 304 to the generator footprint. The top colors 309 can include a top N (e.g., 10) occurring colors in the document to classify 304. The comparison step 308 can include determining whether each of the colors 305a, 305b, 305c, and 305d in the generator footprint 305 are included in the top colors 309 of the document to classify 304. For example, colors 309a, 309b, 309c, and 309d correspond to (e.g., have the same color values as) the colors 305b, 305a, 305d, and 305c, respectively.

In general, a result of the comparison can be either a generated classification 310 (e.g., indicating the document to classify 304 was likely generated by the document generator) or a not-generated classification 312 (e.g., indicating the document to classify 304 was not likely generated by the document generator. For instance, for the document 304a, since each of the colors in the footprint 305 are included in the top colors 309, the generated classification 310 can be applied to the document 304a.

An output stage 314 can include providing either the generated classification 310 or the not-generated classification 312 to a receiving system, process, or user. The process can be repeated for the document to classify 304 for multiple different document generators.

In some implementations, each run of the process for a given generator can produce a likelihood that the document was generated by the given generator. A generator with a highest likelihood can be identified and a determination can be made that the generator with the highest likelihood is a generator that was used to generate the document, if the likelihood for that generator is more than a threshold. For example, the threshold may be 90%. For a first document, likelihoods of 92%, 65%, and 5% may be generated for generators A, B, and C. The generator A may be identified as a generator that generated the document, based on the generator A having a highest likelihood and the likelihood for the generator A being more than the threshold of 90%.

A probability of a false positive computation of the generated classification 310 can be determined. For example, the probability can be calculated using formula (1) shown below, assuming that m represents a number of possible color values (e.g., 256 for grayscale, 256³for RGB values), n represents a number of top colors to determine for each generated document (e.g., 10, 15), and k represents a number of colors that are common in the top-n colors of each generated document (e.g., 4).

probability
⁢

of
⁢

false
⁢

positive

=

n
!

·

(

m
-
k

)

!

(

n
-
k

)

!

·

m
!

(
1
)

As an example, assuming m=256, n=15, and k=4, the probability for a false positive (e.g., a random match of a document footprint to a footprint of a given document generator) can be calculated as shown below in equation (2):

15
!

·

(

256
-
4

)

!

(

15
-
4

)

!

·

256
!

=

15
·
14
·
13
·
12

256
·
255
·
254
·
253

≈

8

1
,
000
,
000

<

1

100
,
000

(
2
)