# US 12,113,808 B2 · Campaign intelligence and visualization for combating cyberattacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,808 B2 - Document ID: US12113808B2 - Status: Granted - Kind: B2 - Application number: 17/088,552 - Filed: 2020-11-03 - Published: 2021-05-06 - Granted: 2024-10-08 - Earliest claimed: 2019-11-03 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Mihai Costea; Michael Abraham Betser; Ravi Kiran Reddy Poluri; Hua Ding; Weisheng Li; Phanindra Pampati; David Nicholas Yost - Web page: https://patentgrep.com/patent/US12113808B2 ## CPC - G06F 21/554: {involving event detection and direct action} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 51/08: Annexed information, e.g. attachments - H04L 51/212: using filtering or selective blocking - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and computer storage media for providing a multi-attribute cluster-identifier that supports identifying malicious activity in computing environments. An instance of an activity having an attribute set can be assessed. The attribute set of the instance of the activity is analyzed to determine whether the instance of the activity is a malicious activity. The attribute set of the instance of the activity is compared to a plurality of multi-attribute cluster-identifiers of previous instances of the activity, such that, a determination that the instance of the activity is a malicious activity is made when the attribute set of the instance of the activity corresponds to an identified multi-attribute cluster-identifier. The identified multi-attribute cluster-identifier has a risk score and an attribute set that indicate a likelihood that the instance of the activity is a malicious activity. A visualization that identifies the instance of the activity as a malicious activity is generated. ## Claims ### Claim 1 A computer-implemented method, the method comprising: accessing an instance of an activity in a computing environment, wherein the instance of the activity comprises an attribute set of the instance, wherein attribute set of the instance comprises at least one attribute; receiving the instance of the activity at a malicious activity model that comprises a multi-attribute cluster identifier associated with a previous instance of the activity, the multi-attribute cluster-identifier comprising a risk score and an attribute set of the multi-attribute cluster-identifier, wherein the attribute set of the multi-attribute cluster-identifier comprises at least one attribute, the risk score and the attribute set of the multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity, wherein the risk score is based on the following: a suspicion score, an anomaly score, and an impact score, each based on information from a cluster that is indicative of malicious activity, wherein the suspicion score is based on information about a tenant of the computing environment, wherein the anomaly score is based on information regarding a sender, wherein the impact score is based on a position of one or more individuals targeted by an instance of the activity in a corresponding cluster, wherein the multi-attribute cluster-identifier is based on the suspicion score, the anomaly score, the impact score, and the risk score, wherein the suspicion score, the anomaly score, and the impact score are associated with a cluster segment having a type of activity, wherein the type of activity is associated with an attribute set of the type of activity, determining, using the malicious activity model, that the instance of the activity is a malicious activity based on comparing the attribute set of the instance of the activity to the attribute set of the multi-attribute cluster-identifier, wherein the attribute set of the instance of the activity matches the attribute set of the multi-attribute cluster-identifier, the risk score and the attribute set of the multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity; generating a visualization of malicious activity operations data comprising the instance of the activity, wherein the visualization identifies the instance of the activity as the malicious activity. ### Claim 2 (depends on 1) The method of claim 1, wherein the malicious activity model comprises a plurality of multi-attribute cluster identifiers each associated with corresponding previous instances of the activity, wherein the instance of the activity is an email message, wherein generating the malicious activity model for a plurality of email messages comprising: clustering the plurality of email messages into two or more clusters based on the metadata and attributes associated with the plurality email messages in the cluster; and assigning risk scores to each of the two or more clusters based on historical information, attributes, and metadata associated with the plurality of email messages in the two or more clusters. ### Claim 3 (depends on 2) The method of claim 2, wherein clustering the plurality of email messages into the two or more clusters is based on: identifying centroids with associated metadata attributes of the plurality of email messages, wherein the centroids are calculated based on the fingerprints of the plurality email messages; identifying common metadata attributes among the plurality of email messages; applying filters based on the common metadata attributes, wherein applying filters based on the common metadata attributes identifies two of more subsets of the plurality of email messages; and generating campaign guides associated with each of the two or more subsets of the plurality of email messages, wherein a campaign guide links to the common metadata attributes corresponding to a subset of the plurality of email messages. ### Claim 4 (depends on 1) The method of claim 1, wherein the impact score is further based on classification of content in the corresponding cluster, or website information included in the previous instances of the activity. ### Claim 5 (depends on 1) The method of claim 1, wherein the malicious activity model is a machine learning model that is generated based on processing a plurality of email messages associated with a plurality cyberattacks, wherein the processing the plurality of emails messages is based on clustering the plurality of emails based on action taken by recipients of the plurality of emails, attachments in the email, and corresponding fingerprints of the plurality of emails. ### Claim 6 (depends on 1) The method of claim 1, wherein the malicious activity model is a malicious activity determination model that is used to compare the attribute set of the instance of the activity to identify the multi-attribute cluster-identifier that indicates the likelihood that the instance of the activity is a malicious activity. ### Claim 7 (depends on 1) The method of claim 1, wherein the malicious activity model is configurable for processing a plurality of instances of the activity at a tenant level, a global level, or a combined tenant-global level. ### Claim 8 (depends on 1) The method of claim 1, wherein the malicious activity operations data is selected from each of clustering analysis, risks scores, attribute sets, evaluation results for generating corresponding clustering analysis visualizations, risk scores visualization, attributes set visualization and evaluation results visualizations. ### Claim 9 (depends on 1) The method of claim 1, the method further comprising executing one or more remediation actions that are associated with instance of the activity, wherein the one or more remediation actions are executed based on a severity of the risk score, wherein the risk score value corresponds to one of the following: high, medium, or low. ### Claim 10 A system comprising: one or more computer processors; and computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations comprising: accessing an instance of an activity in a computing environment, wherein the instance of the activity comprises an attribute set of the instance, wherein attribute set of the instance comprises at least one attribute; receiving the instance of the activity at a malicious activity model that comprises a multi-attribute cluster identifier associated with a previous instance of the activity, the multi-attribute cluster-identifier comprising a risk score and an attribute set of the multi-attribute cluster-identifier, wherein the attribute set of the multi-attribute cluster-identifier comprises at least one attribute, the risk score and the attribute set of the multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity, wherein the risk score is based on the following: a suspicion score, an anomaly score, and an impact score, each based on information from a cluster that is indicative of malicious activity, wherein the suspicion score is based on information about a tenant of the computing environment, wherein the anomaly score is based on information regarding a sender, wherein the impact score is based on a position of one or more individuals targeted by an instance of the activity in a corresponding cluster, wherein the multi-attribute cluster-identifier is based on the suspicion score, the anomaly score, the impact score, and the risk score, wherein the suspicion score, the anomaly score, and the impact score are associated with a cluster segment having a type of activity, wherein the type of activity is associated with an attribute set of the type of activity, determining, using the malicious activity model, that the instance of the activity is a malicious activity based on comparing the attribute set of the instance of the activity to the attribute set of the multi-attribute cluster-identifiers, wherein the attribute set of the instance of the activity matches the attribute set of the multi-attribute cluster-identifier, the risk score and the attribute set of the multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity; and generating a visualization of malicious activity operations data comprising the instance of the activity, wherein the visualization identifies the instance of the activity as the malicious activity. ### Claim 11 (depends on 10) The system of claim 10, wherein the malicious activity model comprises a plurality of multi-attribute cluster identifiers each associated with corresponding previous instances of the activity, wherein the instance of the activity is an email message, wherein generating the malicious activity model for a plurality of email messages comprising: clustering the plurality of email messages into two or more clusters based on the metadata and attributes associated with the plurality email messages in the cluster; and assigning risk scores to each of the two or more clusters based on historical information, attributes, and metadata associated with the plurality of email messages in the two or more clusters. ### Claim 12 (depends on 11) The system of claim 11, wherein clustering the plurality of email messages into the two or more clusters is based on: identifying centroids with associated metadata attributes of the plurality of email messages, wherein the centroids are calculated based on the fingerprints of the plurality email messages; identifying common metadata attributes among the plurality of email messages; applying filters based on the common metadata attributes, wherein applying filters based on the common metadata attributes identifies two of more subsets of the plurality of email messages; and generating campaign guides associated with each of the two or more subsets of the plurality of email messages, wherein a campaign guide links to the common metadata attributes corresponding to a subset of the plurality of email messages. ### Claim 13 (depends on 10) The system of claim 10, herein the impact score is further based on classification of content in the corresponding cluster, or website information included in the previous instances of the activity. ### Claim 14 (depends on 10) The system of claim 10, wherein the malicious activity model is a machine learning model that is generated based on processing a plurality of email messages associated with a plurality cyberattacks, wherein the processing the plurality of emails messages is based on clustering the plurality of emails based on action taken by recipients of the plurality of emails, attachments in the email, and corresponding fingerprints of the plurality of emails. ### Claim 15 (depends on 10) The system of claim 10, the operations further comprising executing one or more remediation actions that are associated with the instance of the activity, wherein the one or more remediation actions are executed based on a severity of the risk score, wherein the risk score value corresponds to one of the following: high, medium, or low. ### Claim 16 (depends on 10) The system of claim 10, wherein the malicious activity model is configurable for processing a plurality of instances of the activity at a tenant level, a global level, or a combined tenant-global level. ### Claim 17 One or more hardware computer-storage media device having computer executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to execute operations comprising: accessing an instance of an activity in a computing environment, wherein the instance of the activity comprises an attribute set of the instance, wherein attribute set of the instance comprises at least one attribute; receiving the instance of the activity at a malicious activity model that comprises a multi-attribute cluster identifier associated with a previous instance of the activity, the multi-attribute cluster-identifier comprising a risk score and an attribute set of the multi-attribute cluster-identifier, wherein the attribute set of the multi-attribute cluster-identifier comprises at least one attribute, the risk score and the attribute set of the multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity, wherein the risk score is based on the following: a suspicion score, an anomaly score, and an impact score, each based on information from a cluster that is indicative of malicious activity, wherein the suspicion score is based on information about a tenant of the computing environment, wherein the anomaly score is based on information regarding a sender, wherein the impact score is based on a position of one or more individuals targeted by an instance of the activity in a corresponding cluster, wherein the multi-attribute cluster-identifier is based on the suspicion score, the anomaly score, the impact score, and the risk score, wherein the suspicion score, the anomaly score, and the impact score are associated with a cluster segment having a type of activity, wherein the type of activity is associated with an attribute set of the type of activity, determining, using the malicious activity model, that the instance of the activity is a malicious activity based on comparing the attribute set of the instance of the activity to the attribute set of the multi-attribute cluster-identifiers, wherein the attribute set of the instance of the activity matches the attribute set of the multi-attribute cluster-identifier, the risk score and the attribute set of the multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity; and generating a visualization of malicious activity operations data comprising the instance of the activity, wherein the visualization identifies the instance of the activity as the malicious activity. ### Claim 18 (depends on 17) The media of claim 17, wherein the visualization of malicious activity operations data support visually exploring a campaign associated with the instance of the activity, executing bulk actions on all emails in a campaign, identifying indicators of compromise, and identifying tenant policies. ### Claim 19 (depends on 17) The media of claim 17, wherein the malicious activity operations data is selected from each of clustering analysis, risks scores, attribute sets, evaluation results for generating corresponding clustering analysis visualizations, risk scores visualization, attributes set visualization and evaluation results visualizations. ### Claim 20 (depends on 17) The media of claim 17, the operations further comprising executing one or more remediation actions that are associated with instance of the activity, wherein the one or more remediation actions are executed based on a severity of the risk score, wherein the risk score value corresponds to one of the following: high, medium, or low.