Patent ID: 11909750
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A method implemented using a computing device, the method comprising:
accessing a dataset that is associated with a plurality of entities, wherein each entity is associated with a unique identifier, and wherein the dataset further includes a plurality of instances of a first data element, wherein a value of each instance is indicative of a corresponding one of the plurality of entities;
identifying duplicate values of the first data element from amongst the plurality of instances of the first data element corresponding to the plurality of entities;
linking, in a data structure, entities that have duplicate values of the first data element to produce a connected set of linked entities, wherein a linked path exists between each unique pair of entities in the connected set of linked entities, wherein the linked path is a set of uninterrupted links between entities that share a duplicate value data element with another entity on the linked path;
determining whether the entities in the connected set of linked entities collectively satisfy a specified threshold; and
in response to determining that the entities in the connected set of linked entities collectively satisfy the specified threshold, outputting an indication of each entity in the data structure that is part of the connected set of linked entities as at least a part of an indication of malicious behavior on the network.