Patent ID: 11868472
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 9:
10. A method comprising:
identifying, by a processor, first features in first messages in a first event hub and second features in second messages in a second event hub, wherein the first and second messages are first and second types of communications between senders and receivers, and wherein the first and second features include information related to the senders of the first and second messages;
determining, by the processor, first patterns in the first features and second patterns in the second features, including identifying that the first messages were received from a same sender within a predefined time window;
grouping, by the processor, the first messages into first clusters based on the first patterns and the second messages into second clusters based on the second patterns;
evaluating, by the processor, the first clusters and the second clusters separately from one another to identify a potentially malicious pattern among the first and second messages in one or more of the first clusters and the second clusters, wherein a potentially malicious pattern is identified in the first clusters when, in the first clusters, a count of the first messages that were received from the same sender within the predefined time window exceeds a threshold number; and
based on the potentially malicious pattern being identified in the first clusters, executing, by the processor, an action with regard to the first messages in the first clusters, wherein the action comprises one of notification or removal of the first messages from the first clusters.