Document behavior analytics—abnormal document flows to identify suspicious exfiltration utility patent

Systems and methods for efficiently detecting and monitoring transmitted documents. The invention provides efficient, scalable, and accurate means to identify anomalous or suspicious access patterns, and related and similar documents based upon their content and their structural characteristics. Transmitted documents that are encrypted may be monitored without revealing the encrypted information.