Patent Document ID: 9245115
Application ID: 13765635
Patent Status: 1

Claim One:
1. A system, comprising: a processor configured to: receive an electronic communication; obtain, from a data store, a first collection of terms, wherein: the first collection of terms corresponds to a first attack strategy; the first attack strategy is associated with a plurality of narrative points, wherein the plurality of narrative points comprises a plurality of equivalence classes; each narrative point of the first attack strategy is associated with a corresponding group of terms representative of the narrative point; the groups of terms corresponding to the narrative points collectively comprise the first collection of terms; and a second attack strategy that is different from the first attack strategy is associated with a second collection of terms; evaluate the received communication to determine whether the received communication is indicative of the first attack strategy, wherein the evaluating includes: for each narrative point of the first attack strategy, determining whether the received communication includes the presence of one or more terms matching to the group of terms corresponding to the narrative point; determining whether the received communication includes the presence of terms matching to a threshold number of narrative points; and determining whether terms present in the communication that match to the narrative points of the first attack strategy occur in a particular order; and classify the received communication based at least in part on the evaluation; and a memory coupled to the processor and configured to provide the processor with instructions.