Patent ID: 11886597
Assignee: DATA VISOR, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 16:
17. One or more non-transitory computer storage media encoded with computer program instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:
identifying one or more potential clusters of malicious accounts;
for each cluster, processing a collection of content associated with each account of the cluster, the processing comprising applying a plurality of models in series to determine whether the collection of content indicates a common pattern, the applying the plurality of models in series comprising:
applying a plurality of instances of a single user model to respective portions of the collection of content,
applying a multi-users model to the output of the plurality of instances of the single user model, and
applying a group model to the output of the multi-users model; and

based on the respective determinations, classifying the accounts of each cluster as either ordinary or suspicious.