Patent ID: 11895137
Assignee: PALANTIR TECHNOLOGIES INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 10:
11. A computer-implemented method comprising:
by one or more hardware computer processors executing code:
communicating with one or more electronic data structures configured to store:
a data clustering strategy; and
a plurality of data items including at least:
a plurality of email data items, each of the plurality of email data items including at least a subject and a sender, each of the plurality of email data items potentially associated with phishing activity; and
a plurality of phishing-related data items related to customers of an organization, the plurality of phishing-related data items including indicators of at least one of: customers of the organization or URLs identified as malicious by a third-party service;

receiving a plurality of email data items from customers of the organization, each of the email data items including at least a subject and a sender, each of the email data items potentially associated with phishing activity;
designating each of the received email data items as seeds; and
for each of the designated seeds, generating a data item cluster based on the data clustering strategy by at least:
adding the seed to the data item cluster;
determining the subject and the sender associated with the seed;
accessing the one or more electronic data structures and identifying one or more of the plurality of email data items having a same subject as the determined subject or a same sender as the determined sender;
adding the identified one or more email data items to the data item cluster;
parsing one or more URLs from the email data items of the data item cluster;
adding the URLs to the data item cluster;
in response to determining that the data item cluster includes at least a predetermined threshold quantity of email data items, designating the data item cluster as a campaign cluster;
identifying additional one or more data items associated with any data items of the data item cluster; and
adding, to the data item cluster, the additional one or more data items.