Abstract: A system communicates a request to a plurality of network nodes to provide user information associated with a document. The system receives a plurality of log files that comprises data communications among the network nodes and responses to the request. The system determines a first number of network nodes that are associated with a first anomaly from the plurality of log files. The system determines a second number of network nodes that are associated with a second anomaly from the plurality of log files. The system determines the number of malicious network nodes by combining the first number and the second number of network nodes. If the system determines that the number of malicious network nodes exceeds a threshold percentage, it assigns one or more network nodes to store the user information until the number of malicious network nodes is less than the threshold percentage.

Abstract: A system accesses a scan of a document that shows first user information. The system extracts the first user information from the scan of the document. The system identifies an entity associated with the document, where an identifier associated with the entity is shown on the scan of the document. The system communicates a request to provide second user information to a computing device associated with the entity. The system receives a response comprising the second user information and compares each component in the first user information with a counterpart component in the second user information. The determines whether the document is valid based on the comparison between the first user information and the second user information.