Patent ID: 11868472
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 16:
17. A non-transitory computer-readable medium on which is stored computer-readable instructions that when executed by a processor, cause the processor to:
identify features in messages communicated between senders and receivers, wherein the identified features include information related to the senders of the messages;
determine common patterns in the identified features of the messages, including identifying messages that were received from a same sender within a predefined time window;
group the messages into a plurality of clusters based on the determined common patterns in the identified features of the messages;
evaluate the plurality of clusters separately from one another to identify a potentially malicious pattern among the messages in one or more of the plurality of clusters, wherein a potentially malicious pattern is identified in a particular cluster when, in the particular cluster, a count of the messages that were received from the same sender within the predefined time window exceeds a threshold number; and
based on the potentially malicious pattern being identified in the particular cluster, execute an action with regard to the messages in the particular cluster, wherein the action comprises one of notification or removal of specific messages from the particular cluster.