Granted Patent B2

US 10,937,034 · App. 16/297,028 · Granted Mar 2, 2021

Inventors: Peter Maag (New York, NY); Tom O'Brien (New York, NY); Phil Cross (New York, NY); Sarun Peter Tosirisuk (Oakland, CA)

Assignee: Palantir Technologies Inc.

G06Q30/0185G06Q40/00G06Q40/04

Abstract

Claims (83)

1. A computer-implemented method comprising:

determining a user identifier associated with a transaction data item;

determining a first electronic communication that was sent or received by a user associated with the user identifier;

accessing a keyword filter configured to detect sensitive or confidential information transmitted through electronic communications, wherein the keyword filter comprises one or more keywords indicative of sensitive or confidential information;

applying the keyword filter to the first electronic communication;

determining that the first electronic communication comprises one or more keywords associated with the keyword filter;

in response to determining that the first electronic communication comprises one or more keywords associated with the keyword filter, identifying a plurality of transaction-related data items from one or more databases, wherein the transaction-related data items are related to one or more of: the transaction data item, the user associated with the user identifier, or the first electronic communication;

generating a data item cluster from the plurality of transaction-related data items; and

generating user interface data usable for rendering a user interface configured to display a summary of the data item cluster and at least a portion of the plurality of transaction-related data items.

2. The computer-implemented method of claim 1 , further comprising:

determining a volume of electronic communications sent or received by the user over a period of time, the volume of electronic communications including the first electronic communication and one or more other electronic communications;

determining a volume score for the volume of electronic communications based at least in part on an extent to which the one or more keywords are present in the volume of electronic communications; and

generating the data item cluster based at least in part on a determination that the volume score exceeds a predetermined volume threshold.

3. The computer-implemented method of claim 1 , further comprising:

identifying at least one property associated with a first data item of the data item cluster, wherein the first data item comprises a second data item;

identifying at least one property associated with the second data item of the data item cluster;

comparing the at least one property associated with the first data item with the at least one property associated with the second data item;

determining a mismatch is present between the at least one property associated with the first data item and the at least one property associated with the second data item; and

scoring the first data item based at least in part on the presence of the mismatch.

4. The computer-implemented method of claim 3 , wherein the at least one property comprises a domain name associated with a recipient of the electronic communication.

5. The computer-implemented method of claim 3 , further comprising:

determining that a direct recipient and a sender of the first electronic communication comprise a same domain name, and an indirect recipient of the first electronic communication comprises a different domain name; and

scoring the data item cluster based at least in part on the determination that the direct recipient and the sender of the first electronic communication comprise a same domain name, and an indirect recipient of the first electronic communication comprises a different domain name.

6. The computer-implemented method of claim 1 , further comprising:

determining that the first electronic communication comprises an external personal account of the user or an account of a participant that is associated with the external personal account of the user; and

scoring the data item cluster based at least in part on the determination that the first electronic communication comprises the external personal account of the user or the account of the participant that is associated with the external personal account of the user.

7. The computer-implemented method of claim 6 , further comprising:

determining a volume of electronic communications that comprises the external personal account of the user or the account of a participant that is associated with the external personal account of the user;

determining a volume score for the volume of electronic communications based at least in part on an extent to which the volume of electronic communications comprises the external personal account of the user or the account of a participant that is associated with the external personal account of the user over a period of time; and

generating the data item cluster based at least in part on a determination that the volume score exceeds a predetermined volume threshold.

8. A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed by a computer system, configure the computer system to perform operations comprising:

determining a user identifier associated with a transaction data item;

determining a first electronic communication that was sent or received by a user associated with the user identifier;

determining a keyword filter configured to detect sensitive or confidential information transmitted through electronic communications, wherein the keyword filter comprises one or more keywords indicative of sensitive or confidential information;

applying the keyword filter to the first electronic communication;

determining that the first electronic communication comprises one or more keywords associated with the keyword filter;

in response to determining that the first electronic communication comprises one or more keywords associated with the keyword filter, identifying a plurality of transaction-related data items from one or more databases, wherein the transaction-related data items are related to one or more of: the transaction data item, the user associated with the user identifier, or the first electronic communication;

generating a data item cluster from a plurality of transaction-related data items; and

generating user interface data usable for rendering a user interface configured to display a summary of the data item cluster and at least a portion of the plurality of transaction-related data items.

9. The non-transitory computer-readable storage medium of claim 8 , wherein generating the data item cluster further comprises:

assigning a score to the first electronic communication based at least in part on an extent to which the one or more keywords is present in the first electronic communication; and

generating the data item cluster based at least in part on the score assigned to the first electronic communication exceeding a predetermined threshold.

10. The non-transitory computer-readable storage medium of claim 8 , wherein applying the keyword filter to the first electronic communication further comprises:

identifying a subset of keywords from the keyword filter based at least in part on properties associated with the first electronic communication.

11. The non-transitory computer-readable storage medium of claim 8 , further comprising:

determining a plurality of electronic communications sent or received by the user over a period of time, the number of electronic communications including the first electronic communication;

determining that the plurality of electronic communications comprises a number of keyword instances that exceeds a predetermined threshold; and

generating the data item cluster from the plurality of transaction-related data items based at least in part on the electronic communications including the first electronic communication.

12. The non-transitory computer-readable storage medium of claim 11 , further comprising:

determining a subset of electronic communications from the plurality of electronic communications, the subset including one or more electronic communications from the plurality of electronic communications that have a number of keyword instances that exceed another predetermined threshold; and

generating the data item cluster based at least in part on the subset of electronic communications.

13. The non-transitory computer-readable storage medium of claim 8 , further comprising:

determining that the first electronic communication is being sent to or received from an external account external; and

scoring the data item cluster based at least in part on the determination that the first electronic communication is being sent to or received from the external account external.

14. The non-transitory computer-readable storage medium of claim 13 , further comprising:

determining that the first electronic communication has occurred proximal to a transaction-related event, wherein the first electronic communication comprises keywords associated with the transaction-related event; and

scoring the data item cluster based at least in part on the determination that the first electronic communication has occurred proximal to the transaction-related event.

15. A computer system comprising:

one or more computer readable storage devices configured to store:

a plurality of transaction-related data items, wherein a data item of the plurality of transaction-related data items comprises information associated with at least one of: a user, an electronic communication, a transaction, or an institution, and

a keyword filter configured to detect sensitive or confidential information transmitted through electronic communications, wherein the keyword filter comprises one or more keywords indicative of sensitive or confidential information; and

one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute computer executable instructions in order to cause the one or more hardware computer processors to:

determine a user identifier associated with a transaction data item;

determine a first electronic communication that was sent or received by a user associated with the user identifier;

apply the keyword filter to the first electronic communication, the keyword filter configured to detect sensitive or confidential information on a computer network;

determine that the first electronic communication comprises one or more keywords associated with the keyword filter;

in response to determining that the first electronic communication comprises one or more keywords associated with the keyword filter, identify a plurality of transaction-related data items from one or more databases, wherein the transaction-related data items are related to one or more of: the transaction data item, the user associated with the user identifier, or the first electronic communication;

generate a data item cluster from the plurality of transaction-related data items; and

generate user interface data usable for rendering a user interface configured to display a summary of the data item cluster and at least a portion of the plurality of transaction-related data items.

16. The computer system of claim 15 , wherein the one or more hardware computer processors are further configured to:

determine that the first electronic communication is being sent to or received from an external account; and

assign a score to the data item cluster based at least in part on the first electronic communication being sent to or received from the external account.

17. The computer system of claim 15 , wherein the one or more hardware computer processors are further configured to:

apply an abnormality rule based at least in part on the first electronic communication to determine an existence of an abnormality associated with the user; and

generate the data item cluster based at least in part on the abnormality.

18. The computer system of claim 15 , wherein the one or more hardware computer processors are further configured to:

apply a mismatch rule to the first electronic communication, the mismatch rule indicating that content of the electronic communication does not match a domain where the first electronic communication is originating or being sent; and

assign a score to the data item cluster based at least in part on application of the mismatch rule.

19. The computer system of claim 15 , wherein the one or more hardware computer processors are further configured to:

determine a false positive match for a transaction-related data item; and

remove the false positive match from the data item cluster.

20. The computer system of claim 15 , wherein the one or more hardware computer processors are further configured to:

dynamically update the keyword filter based at least in part on transaction-related events that are associated with the user.

Assignments (8)

Cited By (3)

US 12,267,283 US 12,267,460 US 12,375,438