PRATYAKSH
Trace a data leak back to its source, its route, and the place to cut it.
Built for INNOVATHON 2026 (Problem Statement #18), PRATYAKSH answers the three questions an investigator faces when proprietary customer data surfaces on an unmonitored channel: which export was it, who moved it through incomplete logs, and where can the leak be stopped? The engine uses keyed bottom-k MinHash fingerprinting, penalised custody graph search, and greedy chokepoint isolation without exposing raw personal records.
What it does
- Keyed bottom-k MinHash fingerprinting: To identify which company export originated the leaked file without reading or exposing raw personal data, PRATYAKSH normalises identifier columns and hashes them with HMAC-SHA256 under a per-case key to build 512-hash bottom-k MinHash sketches. Jaccard containment estimates combined with format profiles and arrival-rate watermarks isolate the true source export (matching 100% of leaked identifiers with planted canary records) while deterministically excluding decoy exports on timing or schema mismatches.
- Custody graph search & penalised hidden hops: Moving data across complex infrastructure leaves fragmented logs. PRATYAKSH constructs an interactive provenance custody graph where observed steps cost minimal weight, while unrecorded hops (such as a local download to an unmonitored laptop before surfacing on Telegram) are penalised based on log-loss probabilities estimated from sequence gaps. Inferred hops are rendered with dashed lines and explicit 'no log found' labels, keeping uncertainty honest.
- Actor anomaly scoring & relative likelihood ranking: Candidate custody routes are scored by blending origin fit, custody path cost, and actor anomaly metrics (logarithmic download volume z-scores, off-hours activity, first-time access, and privilege escalation). Rather than fabricating overconfident certainty, scores are converted via softmax into relative likelihood percentages across candidate paths (e.g. Route #1 at 81% relative likelihood for abnormal 47k-row downloads vs. baseline 251 rows).
- Greedy chokepoints & audited reveal guardrails: To immediately contain the breach, the engine identifies greedy chokepoints that sever the highest percentage of candidate routes with minimal operational disruption (such as cutting outbound uploads from the identified endpoint to stop 81% of leak paths) and generates targeted evidence collection requests. Personal data is masked by default across the entire interface, requiring a minimum 8-character written justification to reveal values into an append-only audit log.