Identifying phishing communications using templates

A computer-implemented method, comprising:

• matching, by one or more processors, a communication to a first subset of a plurality of templates using a forward index, wherein each template of the plurality of templates represents content shared among a cluster of communications sent by a known legitimate entity, and wherein the forward index is indexed on metadata associated with the plurality of templates;
• matching, by one or more of the processors, the communication to a second subset of the plurality of templates using a reverse index, wherein the reverse index is indexed on content of the plurality of templates;
• determining, by one or more of the processors, that there is no intersection between the first subset and the second subset;
• classifying, by one or more of the processors based on the determining, the communication as a phishing attempt;
• and
• discarding or re-routing, by one or more of the processors, the communication based on the classifying.

A computer-implemented method, comprising:

• grouping, by one or more processors, a corpus of communications sent by a plurality of known legitimate entities into a plurality of clusters based at least in part on metadata associated with the corpus of communications, wherein each cluster includes communications sent by a known legitimate entity;
• generating, by one or more of the processors based on the plurality of clusters, a plurality of templates, wherein each template of the plurality of templates represents content shared among a cluster of the plurality of clusters that includes communications sent by a known legitimate entity;
• creating, by one or more of the processors, a forward index that is indexed on metadata associated with the plurality of templates;
• creating, by one or more of the processors, a reverse index, wherein the reverse index is indexed on content of the plurality of templates;
• and
• discarding or re-rerouting subsequent communications that match one or more templates in one of the forward or reverse indices, but not the other.