US 11,895,137 B2Granted

Phishing data item clustering and analysis

AssigneePalantir Technologies Inc.

InventorsDavid Cohen, Jason Ma, Bing Jie Fu, Ilya Nepomnyashchiy, Steven Berler, Alex Smaliy, Jack Grossman, James Thompson, Julia Boortz, Matthew Sprague, Parvathy Menon, Michael Kross, Michael Harris, Adam Borochoff

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, and provide results of the automated analysis in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a compact, human-readable analysis of the data clusters. The human-readable analyses (also referred to herein as “summaries” or “conclusions”) of the data clusters may be organized into an interactive user interface so as to enable an analyst to quickly navigate among information associated with various data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation. Embodiments of the present disclosure also relate to automated scoring of the clustered data structures.

Claims21

Dependent claims

A computer-implemented method comprising:

by one or more hardware computer processors executing code:
communicating with one or more electronic data structures configured to store:
a data clustering strategy;
and
a plurality of data items including at least:
a plurality of email data items, each of the plurality of email data items including at least a subject and a sender, each of the plurality of email data items potentially associated with phishing activity;
and
a plurality of phishing-related data items related to a communications network of an organization, the plurality of phishing-related data items including at least one of:
internal Internet Protocol addresses of the communications network, computerized devices of the communications network, users of particular computerized devices, organizational positions associated with users of particular computerized devices, or URLs and/or external domains visited by users of particular computerized devices;
accessing an email data item transmitted to one or more of the users of respective computerized devices within the network of the organization, the email data item including at least a subject and a sender, the email data item potentially associated with phishing activity;
designating the accessed email data item as a seed;
and
generating a data item cluster based on the data clustering strategy by at least:
adding the seed to the data item cluster;
determining the subject and the sender associated with the seed;
identifying one or more of the plurality of email data items having a same subject as the determined subject or a same sender as the determined sender;
adding the identified one or more email data items to the data item cluster;
parsing one or more URLs from the email data items of the data item cluster;
adding the parsed URLs to the data item cluster;
identifying one or more users who are both recipients of at least one of the email data items of the data item cluster and visitors of one of the URLs of the data item cluster;
adding the identified one or more users, including data related to the one or more users, to the data item cluster;
identifying additional one or more data items associated with any data items of the data item cluster;
and
adding, to the data item cluster, the additional one or more data items.

21 more elements

A computer-implemented method comprising:

by one or more hardware computer processors executing code:
communicating with one or more electronic data structures configured to store:
a data clustering strategy;
and
a plurality of data items including at least:
a plurality of email data items, each of the plurality of email data items including at least a subject and a sender, each of the plurality of email data items potentially associated with phishing activity;
and
a plurality of phishing-related data items related to customers of an organization, the plurality of phishing-related data items including indicators of at least one of:
customers of the organization or URLs identified as malicious by a third-party service;
receiving a plurality of email data items from customers of the organization, each of the email data items including at least a subject and a sender, each of the email data items potentially associated with phishing activity;
designating each of the received email data items as seeds;
and
for each of the designated seeds, generating a data item cluster based on the data clustering strategy by at least:
adding the seed to the data item cluster;
determining the subject and the sender associated with the seed;
accessing the one or more electronic data structures and identifying one or more of the plurality of email data items having a same subject as the determined subject or a same sender as the determined sender;
adding the identified one or more email data items to the data item cluster;
parsing one or more URLs from the email data items of the data item cluster;
adding the URLs to the data item cluster;
in response to determining that the data item cluster includes at least a predetermined threshold quantity of email data items, designating the data item cluster as a campaign cluster;
identifying additional one or more data items associated with any data items of the data item cluster;
and
adding, to the data item cluster, the additional one or more data items.

20 more elements

One or more non-transitory computer-readable storage devices storing software instructions, the software instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

communicating with one or more electronic data structures configured to store:
a data clustering strategy;
and
a plurality of data items including at least:
a plurality of email data items, each of the plurality of email data items including at least a subject and a sender, each of the plurality of email data items potentially associated with phishing activity;
and
a plurality of phishing-related data items related to a communications network of an organization, the plurality of phishing-related data items including at least one of:
internal Internet Protocol addresses of the communications network, computerized devices of the communications network, users of particular computerized devices, organizational positions associated with users of particular computerized devices, or URLs and/or external domains visited by users of particular computerized devices;
accessing an email data item transmitted to one or more of the users of respective computerized devices within the network of the organization, the email data item including at least a subject and a sender, the email data item potentially associated with phishing activity;
designating the accessed email data item as a seed;
and
generating a data item cluster based on the data clustering strategy by at least:
adding the seed to the data item cluster;
determining the subject and the sender associated with the seed;
identifying one or more of the plurality of email data items having a same subject as the determined subject or a same sender as the determined sender;
adding the identified one or more email data items to the data item cluster;
parsing one or more URLs from the email data items of the data item cluster;
adding the parsed URLs to the data item cluster;
identifying one or more users who are both recipients of at least one of the email data items of the data item cluster and visitors of one of the URLs of the data item cluster;
adding the identified one or more users, including data related to the one or more users, to the data item cluster;
identifying additional one or more data items associated with any data items of the data item cluster;
and
adding, to the data item cluster, the additional one or more data items.

20 more elements

communicating with one or more electronic data structures configured to store:
a data clustering strategy;
and
a plurality of data items including at least:
a plurality of email data items, each of the plurality of email data items including at least a subject and a sender, each of the plurality of email data items potentially associated with phishing activity;
and
a plurality of phishing-related data items related to customers of an organization, the plurality of phishing-related data items including indicators of at least one of:
customers of the organization or URLs identified as malicious by a third-party service;
receiving a plurality of email data items from customers of the organization, each of the email data items including at least a subject and a sender, each of the email data items potentially associated with phishing activity;
designating each of the received email data items as seeds;
and
for each of the designated seeds, generating a data item cluster based on the data clustering strategy by at least:
adding the seed to the data item cluster;
determining the subject and the sender associated with the seed;
accessing the one or more electronic data structures and identifying one or more of the plurality of email data items having a same subject as the determined subject or a same sender as the determined sender;
adding the identified one or more email data items to the data item cluster;
parsing one or more URLs from the email data items of the data item cluster;
adding the URLs to the data item cluster;
in response to determining that the data item cluster includes at least a predetermined threshold quantity of email data items, designating the data item cluster as a campaign cluster;
identifying additional one or more data items associated with any data items of the data item cluster;
and
adding, to the data item cluster, the additional one or more data items.

19 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/061,195Filed 2 Dec 2022 · continuation
Priority: 3 Jul 2014
Published: US 2023/0096596 A130 Mar 2023
Granted: 6 Feb 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
G06F 16/285
Relational databases: clustering or classification
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06Q 10/10
Administration; Management: office automation; Time management

Family

Application62/020,876Us provisional application · filed 3 Jul 2014
Application14/473,920Parent of this continuation · filed 29 Aug 2014
Application14/487,021Parent of this continuation · filed 15 Sep 2014
Application15/961,431Parent of this continuation · filed 24 Apr 2018
US 9,965,937 B2Parent of this continuation · filed 8 May 2018
US 9,998,485 B2Parent of this continuation · filed 12 Jun 2018
Application17/003,398Parent of this continuation · filed 26 Aug 2020
US 10,798,116 B2Parent of this continuation · filed 6 Oct 2020
US 2023/0096596 A1Pre-grant publication · published 30 Mar 2023
US 11,546,364 B2Parent of this continuation
US 2016/0344758 A1Published application
US 2016/0366164 A1Published application
US 2018/0270264 A1Published application
US 2020/0396237 A1Published application
US 11,895,137 B2This patent

From the US filing history. Foreign family members aren’t listed.