Palantir Technologies Inc.

Michael Kross

Parvathy Menon

Adam Borochoff

Michael Harris

Matthew Sprague

David Cohen

Harkirat Singh

Jack Grossman

Jason Ma

Ilya Nepomnyashchiy

Bing Jie Fu

Steven Berler

Alex Smaliy

Julia Boortz

James Thompson

Carl Freeland

Jacob Scott

Brendan Weickert

Huey Kwik

Eric Sadur

Timothy Ronan

Geoff Stowe

Brian Lee

Geoffrey Stowe

Kevin Morgan

Stefan Bach

Gaspard Van Koningsveld

Stephen Freiberg

Alexander Visbal

Jacob Albertson

Jeffrey Chen

Christopher Rogers

Robert Liu

Daniel Campos

Matthew Betten

Trevor Austin

In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

Malware data clustering

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, and provide results of the automated analysis in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a compact, human-readable analysis of the data clusters. The human-readable analyses (also referred to herein as 'summaries' or “conclusions”) of the data clusters may be organized into an interactive user interface so as to enable an analyst to quickly navigate among information associated with various data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation. Embodiments of the present disclosure also relate to automated scoring of the clustered data structures.

Phishing data item clustering and analysis

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, and provide results of the automated analysis in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a compact, human-readable analysis of the data clusters. The human-readable analyses (also referred to herein as 'summaries' or 'conclusions') of the data clusters may be organized into an interactive user interface so as to enable an analyst to quickly navigate among information associated with various data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation. Embodiments of the present disclosure also relate to automated scoring of the clustered data structures.

In an embodiment, a computer-implemented method comprises receiving a plurality of identifiers of first versions of electronic documents that have been stored in a distributed data storage system and queuing the identifiers in a queue table of a database; obtaining, from the queue table, a set of the identifiers of the first versions of the electronic documents; invoking, using the set of the identifiers, a query indexing function of a search engine system and receiving a set of matching identifiers of electronic documents, from among the set of identifiers, that match queries that have been registered using the query indexing function; storing the matching identifiers in a last-processed table; processing second versions of the electronic documents associated with the matching identifiers, using the query indexing function; updating a feed associated with a user account to show messages referring to the first versions of the electronic documents in response to determining that the second versions of the electronic documents do not match the queries.

Query indexing with permissions integration and federated search

The present disclosure relates to systems and techniques for multi-stage rendering of data pages for display in a data page display window. The present disclosure also relates to rendering data as part of a background instance of a data page renderer. The present disclosure also relates to displaying data requested from a workspace application in a data page window once the requested data is sufficiently rendered as part of a background instance of a data page renderer. The present disclosure also relates to providing a pool of background instances of multiple data page renderers for rendering and pre-rendering data pages for storage and eventual display in a data page window.

Multi-stage data page rendering

Techniques are disclosed for prioritizing a plurality of clusters. Prioritizing clusters may generally include identifying a scoring strategy for prioritizing the plurality of clusters. Each cluster is generated from a seed and stores a collection of data retrieved using the seed. For each cluster, elements of the collection of data stored by the cluster are evaluated according to the scoring strategy and a score is assigned to the cluster based on the evaluation. The clusters may be ranked according to the respective scores assigned to the plurality of clusters. The collection of data stored by each cluster may include financial data evaluated by the scoring strategy for a risk of fraud. The score assigned to each cluster may correspond to an amount at risk.

Generating data clusters

External malware data item clustering and analysis

A mobile data analysis system is provided that enables mobile device location tracking, secure messaging, and real-time sharing of intelligence information, among other features. In one embodiment, a method and apparatus is provided for creating data objects from one or more digital images captured by a mobile device. A computing device receives a first digital image file comprising first image metadata, wherein the first image metadata includes one or more image properties each having an image property value. The computing device transforms one or more of the image property values of the one or more image properties into one or more particular values. The computing device populates one or more data object property values of a data object with the one or more particular values. The computing device stores the data object in a data repository.

Populating property values of event objects of an object-centric data model using image metadata

Systems and user interfaces for dynamic and interactive investigation based on automatic clustering of related data in various data structures

Growing community of inventors

Palo Alto, CA, United States of America

Michael Kross