System and method for detecting potentially harmful data

A method, comprising:

• receiving electronic data;
• extracting a first identifier from the electronic data;
• extracting first attributes from the electronic data;
• searching a database for identifiers that match the first identifier to determine a number of matching identifiers;
• determining that the number of matching identifiers exceeds a first threshold;
• searching the database for attributes associated with each of the matching identifiers to determine a subset of matching attributes, wherein the first attributes and the attributes associated with each of the matching identifiers each comprise the subset of matching attributes;
• calculating a specificity for the subset of matching attributes;
• determining that the specificity of the subset of matching attributes is less than or equal to a second threshold;
• and
• creating a filter based at least in part on the determination that the specificity of the subset of matching attributes is less than or equal to the second threshold.

A non-transitory computer readable medium comprising instructions for causing processing circuitry to:

• receive electronic data;
• extract a first identifier from the electronic data;
• and
• extract first attributes from the electronic data;
• search a database for identifiers that match the first identifier to determine a number of matching identifiers;
• determine that the number of matching identifiers exceeds a first threshold;
• search the database for attributes associated with each of the matching identifiers to determine a subset of matching attributes, wherein the first attributes and the attributes associated with each of the matching identifiers each comprise the subset of matching attributes;
• calculate a specificity for the subset of matching attributes;
• determine that the specificity of the subset of matching attributes is less than or equal to a second threshold;
• and
• create a filter based at least in part on the determination that the specificity of the subset of matching attributes is less than or equal to the second threshold.