Abstract: Techniques are described herein that are capable of generating a content signature of a textual communication using OCR and text processing. The textual communication is rendered. Text is extracted from the rendered textual communication using OCR. Customization is removed from the text to provide a templatized version of the rendered textual communication that includes de-customized text. The de-customized text is parsed into tokens. Each token includes a respective subset of a plurality of characters. The tokens are converted into respective numbers. Each number is processed using fuzzy hash functions to provide respective hash values associated with the respective token. Representative hash values are selected for the respective fuzzy hash functions by selecting each representative hash value from the hash values that are processed using the respective fuzzy hash function.

Abstract: According to examples, an apparatus may include a processor may identify features in a plurality of data items, determine similarities and/or patterns in the identified features, and group the plurality of data items into a plurality of clusters of data items based on the determined similarities and/or patterns in the identified features in the plurality of data items. The processor may also evaluate the plurality of clusters to identify a potentially malicious pattern among the data items in the plurality of clusters. In addition, the processor may, based on a potentially malicious pattern being identified in a generated cluster of the generated clusters, execute an action with regard to the data items in the generated cluster.

Abstract: According to examples, an apparatus may include a processor may identify features in a plurality of data items, determine similarities and/or patterns in the identified features, and group the plurality of data items into a plurality of clusters of data items based on the determined similarities and/or patterns in the identified features in the plurality of data items. The processor may also evaluate the plurality of clusters to identify a potentially malicious pattern among the data items in the plurality of clusters. In addition, the processor may, based on a potentially malicious pattern being identified in a generated cluster of the generated clusters, execute an action with regard to the data items in the generated cluster.