US 12,086,815 B2
Approaches for analyzing entity relationships
Samuel Kremin, McLean, VA (US); Daniel Chiu, La Jolla, CA (US); Patrick Lii, San Jose, CA (US); and Praveen Kumar Ramalingam, Washington, DC (US)
Assigned to Palantir Technologies Inc., Denver, CO (US)
Filed by Palantir Technologies Inc., Denver, CO (US)
Filed on May 30, 2023, as Appl. No. 18/203,396.
Application 18/203,396 is a continuation of application No. 17/235,905, filed on Apr. 20, 2021, granted, now 11,663,613.
Application 17/235,905 is a continuation of application No. 15/703,895, filed on Sep. 13, 2017, granted, now 10,984,427, issued on Apr. 20, 2021.
Prior Publication US 2023/0325851 A1, Oct. 12, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06Q 30/02 (2023.01); G06F 16/901 (2019.01); H04L 67/306 (2022.01); G06Q 40/02 (2023.01); G06Q 50/00 (2012.01)
CPC G06Q 30/02 (2013.01) [G06F 16/9024 (2019.01); H04L 67/306 (2013.01); G06Q 40/02 (2013.01); G06Q 50/01 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the system to perform:
obtaining log data from at least one computing system, the log data including one or more records that identify one or more Internet Protocol (IP) addresses of one or more computing devices that accessed the at least one computing system and one or more accounts hosted by the at least one computing system that were accessed by the computing devices and one or more timestamps indicating respective times of access of the IP addresses;
determining, based at least in part on the obtained log data, that at least a first account was accessed from a computing device of the computing devices with an IP address of the IP addresses, and a time at which the first account was accessed based on the timestamps;
determining whether the IP address has been permitted based on geolocation log data corresponding to the IP address or based on a type of traffic from one or more particular computing devices assigned to the IP address;
in response to the IP address being permitted:
receiving an indication that a second account was accessed using the IP address;
and flagging the first account and the second account based on the respective times that the first account and the second account were accessed.