Network security tool

A method comprising:

• storing, by a memory, a threshold;
• receiving, by a hardware processor communicatively coupled to the memory, a first message comprising a first word and a second word;
• receiving, by the hardware processor, a second message comprising a third word and a fourth word;
• receiving, by the hardware processor, a third message comprising a fifth word and a sixth word;
• determining, by the hardware processor, a first number of occurrences of the first word in the first message;
• determining, by the hardware processor, a second number of occurrences of the second word in the first message;
• determining, by the hardware processor, a third number of occurrences of the third word in the second message;
• determining, by the hardware processor, a fourth number of occurrences of the fourth word in the second message;
• determining, by the hardware processor, a fifth number of occurrences of the fifth word in the third message;
• determining, by the hardware processor, a sixth number of occurrences of the sixth word in the third message;
• calculating, by the hardware processor, a first probability that a word in the first message is the first word by dividing the first number of occurrences by a total number of words in the first message;
• calculating, by the hardware processor, a second probability that a word in the first message is the second word by dividing the second number of occurrences by the total number of words in the first message;
• calculating, by the hardware processor, a third probability that a word in the second message is the third word by dividing the third number of occurrences by a total number of words in the second message;
• calculating, by the hardware processor, a fourth probability that a word in the second message is the fourth word by dividing the fourth number of occurrences by the total number of words in the second message;
• calculating, by the hardware processor, a fifth probability that a word in the third message is the fifth word by dividing the fifth number of occurrences by a total number of words in the third message;
• calculating, by the hardware processor, a sixth probability that a word in the sixth message is the sixth word by dividing the sixth number of occurrences by the total number of words in the third message;
• calculating, by the hardware processor, a seventh probability that a word in the first message and a word in the second message are both the first word;
• calculating, by the hardware processor, an eighth probability that a word in the first message and a word in the second message are both the second word;
• calculating, by the hardware processor a ninth probability that a word in the first message and a word in the third message are both the first word;
• calculating, by the hardware processor, a tenth probability that a word in the first message and a word in the third message are both the second word;
• calculating, by the hardware processor, a first probability distribution for the first message, the first probability distribution comprising the first probability and the second probability;
• calculating, by the hardware processor, a second probability distribution for the second message, the second probability distribution comprising the third probability, the fourth probability, the seventh probability, and the eighth probability;
• calculating, by the hardware processor, a third probability distribution for the third message, the third probability distribution comprising the fifth probability, the sixth probability, the ninth probability, and the tenth probability;
• calculating, by the hardware processor, based on the first probability distribution and the second probability distribution, an eleventh probability;
• calculating, by the hardware processor, based on the first probability distribution and the third probability distribution, a twelfth probability;
• comparing, by the hardware processor, the eleventh probability to the threshold;
• comparing, by the hardware processor, the twelfth probability to the threshold;
• based on the comparison of the eleventh probability to the threshold, identifying, by the hardware processor, the second message as related to the first message;
• and
• based on the comparison of the twelfth probability to the threshold, identifying, by the hardware processor, the third message as unrelated to the first message.

A system comprising:

• a network;
• and
• a network security tool communicatively coupled to the network, the network security tool configured to:
• store a threshold;
• receive a first message over the network, the first message comprising a first word and a second word;
• receive a second message over the network, the second message comprising a third word and a fourth word;
• receive a third message over the network, the third message comprising a fifth word and a sixth word;
• determine a first number of occurrences of the first word in the first message;
• determine a second number of occurrences of the second word in the first message;
• determine a third number of occurrences of the third word in the second message;
• determine a fourth number of occurrences of the fourth word in the second message;
• determine a fifth number of occurrences of the fifth word in the third message;
• determine a sixth number of occurrences of the sixth word in the third message;
• calculate a first probability that a word in the first message is the first word by dividing the first number of occurrences by a total number of words in the first message;
• calculate a second probability that a word in the first message is the second word by dividing the second number of occurrences by the total number of words in the first message;
• calculate a third probability that a word in the second message is the third word by dividing the third number of occurrences by a total number of words in the second message;
• calculate a fourth probability that a word in the second message is the fourth word by dividing the fourth number of occurrences by the total number of words in the second message;
• calculate a fifth probability that a word in the third message is the fifth word by dividing the fifth number of occurrences by a total number of words in the third message;
• calculate a sixth probability that a word in the sixth message is the sixth word by dividing the sixth number of occurrences by the total number of words in the third message;
• calculate a seventh probability that a word in the first message and a word in the second message are both the first word;
• calculate an eighth probability that a word in the first message and a word in the second message are both the second word;
• calculate a ninth probability that a word in the first message and a word in the third message are both the first word;
• calculate a tenth probability that a word in the first message and a word in the third message are both the second word;
• calculate a first probability distribution for the first message, the first probability distribution comprising the first probability and the second probability;
• calculate a second probability distribution for the second message, the second probability distribution comprising the third probability, the fourth probability, the seventh probability, and the eighth probability;
• calculate a third probability distribution for the third message, the third probability distribution comprising the fifth probability, the sixth probability, the ninth probability, and the tenth probability;
• calculate, based on the first probability distribution, the second probability distribution, an eleventh probability;
• calculate, based on the first probability distribution and the third probability distribution, a twelfth probability;
• compare the eleventh probability to the threshold;
• compare the twelfth probability to the threshold;
• based on the comparison of the eleventh probability to the threshold, identify the second message as related to the first message;
• and
• based on the comparison of the twelfth probability to the threshold, identify the third message as unrelated to the first message.