# US 8,788,405 B1 · Generating data clusters with customizable analysis strategies

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,788,405 B1
- Document ID: US8788405B1
- Status: Granted
- Kind: B1
- Application number: 13/968,265
- Filed: 2013-08-15
- Granted: 2014-07-22
- Earliest claimed: 2013-03-15
- Assignees: Palantir Technologies Inc.
- Applicants: Palantir Technologies, Inc.
- Inventors: Matthew Sprague; Michael Kross; Adam Borochoff; Parvathy Menon; Michael Harris
- Web page: https://patentgrep.com/patent/US8788405B1

## CPC

- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- G06F 16/23: Updating
- G06F 16/244: {Grouping and aggregation}
- G06F 16/24578: {using ranking}
- G06F 16/2465: {Query processing support for facilitating data mining operations in structured databases}
- G06F 16/26: Visual data mining; Browsing structured data
- G06F 16/283: {Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP}
- G06F 16/285: {Clustering or classification}
- G06F 16/287: {Visualization; Browsing}
- G06F 16/288: {Entity relationship models}
- G06F 16/335: Filtering based on additional data, e.g. user or group profiles (filtering in web context G06F16/9535, G06F16/9536)
- G06F 16/35: Clustering; Classification
- G06F 16/355: Creation or modification of classes or clusters
- G06F 16/9535: Search customisation based on user profiles and personalisation
- G06Q 10/10: Office automation; Time management
- G06Q 20/382: {insuring higher security of transaction}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 30/0185: {Product, service or business identity fraud}
- G06Q 40/00: Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q 40/02: Banking, e.g. interest calculation or account maintenance (credit or loans G06Q40/03)
- G06Q 40/03: Credit; Loans; Processing thereof
- G06Q 40/10: Tax strategies
- G06Q 40/123: {Tax preparation or submission}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Techniques are disclosed for generating a collection of clusters of related data from a seed. Doing so may generally include retrieving a seed and adding the seed to a first cluster and include retrieving a cluster strategy referencing one or more data bindings. Each data binding specifies a search protocol for retrieving data. For each of the one or more data bindings, data parameters input to the search protocol are identified, the search protocol is performed using the identified data parameters, and data returned by the search protocol is evaluated for inclusion in the first cluster.

## Claims

### Claim 1

A computer-implemented method for generating a cluster of related data entities, the method comprising:
communicating with one or more electronic data stores storing a plurality of data entities and respective data entity attributes, the one or more electronic data stores in communication with one or more hardware computer processors, the one or more hardware computer processors configured with specific computer executable instructions, and the plurality of data entities related to financial data and including at least one of:
an account data entity,
a transaction data entity,
a customer data entity, or
a phone number data entity;
retrieving, from the one or more electronic data stores and by the one or more hardware computer processors, a seed data entity selected from the plurality of data entities;
adding, by the one or more hardware computer processors, the seed data entity to a data entity cluster;
identifying, by the one or more hardware computer processors, at least one data entity attribute associated with the seed data entity;
determining, by the one or more hardware computer processors and based on a cluster strategy and the at least one data entity attribute, one or more additional data entities related to the seed data entity, wherein the cluster strategy is configured to identify related data entities for detection of possible fraudulent financial activity, wherein the cluster strategy includes one or more search protocols, and wherein determining one or more additional data entities related to the seed data entity comprises:
executing at least one search protocol on the one or more electronic data stores to access particular data entities; and
evaluating the particular data entities returned by the at least one search protocol to identify one or more additional data entities for inclusion in the data entity cluster, the one or more additional data entities sharing the at least one data entity attribute with the seed data entity; and
adding, by the one or more hardware computer processors and based on the cluster strategy, the one or more additional data entities to the data entity cluster,
wherein the data entity cluster is useable by an analyst to determine various data entities related to each other and to possible fraudulent financial activity,
wherein a first search protocol returns particular data entities that are used as data parameter inputs to a second search protocol.

### Claim 2 (depends on 1)

The method of claim 1 further comprising:
comparing, by the one or more hardware computer processors, data entities associated with the data entity cluster to data entities associated with a second data entity cluster; and
in response to determining that at least one data entity associated with the data entity cluster shares an attribute with and/or is related to at least one data entity associated with the second data entity cluster, merging the data entity cluster and the second data entity cluster.

### Claim 3 (depends on 1)

The method of claim 1, wherein the at least one search protocol uses the data entity seed as a data parameter input to the at least one search protocol.

### Claim 4 (depends on 1)

The method of claim 1, wherein the first search protocol searches for particular data entities in a first electronic data store and the second search protocol searches for particular data entities in a second electronic data store.

### Claim 5 (depends on 1)

The method of claim 1 further comprising:
identifying, by the one or more hardware computer processors, at least one other data entity attribute associated with the one or more additional data entities;
determining, by the one or more hardware computer processors and based on the cluster strategy and the at least one other data entity attribute, one or more tertiary data entities related to the one or more additional data entities; and
adding, by the one or more hardware computer processors and based on the cluster strategy, the one or more tertiary data entities to the data entity cluster.

### Claim 6 (depends on 1)

The method of claim 1 further comprising:
assigning a ranking score to the data entity cluster, wherein the ranking score is used to order the data entity cluster relative to a plurality of other data entity clusters generated from respective data entity seeds according to the cluster strategy.

### Claim 7

A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed by a computer system, configure the computer system to perform operations comprising:
communicating with one or more electronic data stores storing a plurality of data entities and respective data entity attributes, the plurality of data entities related to financial data and including at least one of:
an account data entity,
a transaction data entity,
a customer data entity, or
a phone number data entity;
retrieving, from the one or more electronic data stores, a seed data entity selected from the plurality of data entities;
adding the seed data entity to a data entity cluster;
identifying at least one data entity attribute associated with the seed data entity;
determining, based on a cluster strategy and the at least one data entity attribute, one or more additional data entities related to the seed data entity, wherein the cluster strategy is configured to identify related data entities for detection of possible fraudulent financial activity, wherein the cluster strategy includes one or more search protocols, and wherein determining one or more additional data entities related to the seed data entity comprises:
executing at least one search protocol on the one or more electronic data stores to access particular data entities; and
evaluating the particular data entities returned by the at least one search protocol to identify one or more additional data entities for inclusion in the data entity cluster, the one or more additional data entities sharing the at least one data entity attribute with the seed data entity; and
adding, based on the cluster strategy, the one or more additional data entities to the data entity cluster,
wherein the data entity cluster is useable by an analyst to determine various data entities related to each other and to possible fraudulent financial activity,
wherein a first search protocol returns particular data entities that are used as data parameter inputs to a second search protocol.

### Claim 8 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, wherein the computer-executable instructions configure the computer system to perform further operations comprising:
comparing data entities associated with the data entity cluster to data entities associated with a second data entity cluster; and
in response to determining that at least one data entity associated with the data entity cluster shares an attribute with and/or is related to at least one data entity associated with the second data entity cluster, merging the data entity cluster and the second data entity cluster.

### Claim 9 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, wherein the at least one search protocol uses the data entity seed as a data parameter input to the at least one search protocol.

### Claim 10 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, wherein the first search protocol searches for particular data entities in a first electronic data store and the second search protocol searches for particular data entities in a second electronic data store.

### Claim 11 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, wherein the computer-executable instructions configure the computer system to perform further operations comprising:
Identifying at least one other data entity attribute associated with the one or more additional data entities;
determining, based on the cluster strategy and the at least one other data entity attribute, one or more tertiary data entities related to the one or more additional data entities; and
adding, based on the cluster strategy, the one or more tertiary data entities to the data entity cluster.

### Claim 12 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, wherein the computer-executable instructions configure the computer system to perform further operations comprising:
assigning a ranking score to the data entity cluster, wherein the ranking score is used to order the data entity cluster relative to a plurality of other data entity clusters generated from respective data entity seeds according to the cluster strategy.

### Claim 13

A computer system comprising:
one or more non-transitory computer readable storage devices configured to store one or more software programs; and
one or more hardware computer processors in communication with the one or more non-transitory computer readable storage devices and configured to execute the one or more software programs in order to cause the computer system to:
communicate with one or more electronic data stores storing a plurality of data entities and respective data entity attributes, the plurality of data entities related to financial data and including at least one of:
an account data entity,
a transaction data entity,
a customer data entity, or
a phone number data entity;
retrieve, from the one or more electronic data stores and by the one or more hardware computer processors, a seed data entity selected from the plurality of data entities;
add, by the one or more hardware computer processors, the seed data entity to a data entity cluster;
identify, by the one or more hardware computer processors, at least one data entity attribute associated with the seed data entity;
determine, by the one or more hardware computer processors and based on a cluster strategy and the at least one data entity attribute, one or more additional data entities related to the seed data entity, wherein the cluster strategy is configured to identify related data entities for detection of possible fraudulent financial activity, wherein the cluster strategy includes one or more search protocols, and wherein determining one or more additional data entities related to the seed data entity comprises:
executing at least one search protocol on the one or more electronic data stores to access particular data entities; and
evaluating the particular data entities returned by the at least one search protocol to identify one or more additional data entities for inclusion in the data entity cluster, the one or more additional data entities sharing the at least one data entity attribute with the seed data entity; and
add, by the one or more hardware computer processors and based on the cluster strategy, the one or more additional data entities to the data entity cluster,
wherein the data entity cluster is useable by an analyst to determine various data entities related to each other and to possible fraudulent financial activity,
wherein a first search protocol returns particular data entities that are used as data parameter inputs to a second search protocol.

### Claim 14 (depends on 13)

The computer system of claim 13, wherein the one or more hardware computer processors are further configured to execute the one or more software programs in order to cause the computer system to:
compare, by the one or more hardware computer processors, data entities associated with the data entity cluster to data entities associated with a second data entity cluster; and
in response to determining that at least one data entity associated with the data entity cluster shares an attribute with and/or is related to at least one data entity associated with the second data entity cluster, merge the data entity cluster and the second data entity cluster.

### Claim 15 (depends on 13)

The computer system of claim 13, wherein the at least one search protocol uses the data entity seed as a data parameter input to the at least one search protocol.

### Claim 16 (depends on 13)

The computer system of claim 13, wherein the first search protocol searches for particular data entities in a first electronic data store and the second search protocol searches for particular data entities in a second electronic data store.

### Claim 17 (depends on 13)

The computer system of claim 13, wherein the one or more hardware computer processors are further configured to execute the one or more software programs in order to cause the computer system to:
identify, by the one or more hardware computer processors, at least one other data entity attribute associated with the one or more additional data entities;
determine, by the one or more hardware computer processors and based on the cluster strategy and the at least one other data entity attribute, one or more tertiary data entities related to the one or more additional data entities; and
add, by the one or more hardware computer processors and based on the cluster strategy, the one or more tertiary data entities to the data entity cluster.

### Claim 18 (depends on 13)

The method of claim 13, wherein the one or more hardware computer processors are further configured to execute the one or more software programs in order to cause the computer system to:
assign a ranking score to the data entity cluster, wherein the ranking score is used to order the data entity cluster relative to a plurality of other data entity clusters generated from respective data entity seeds according to the cluster strategy.