Heuristic1: Grouping all the input addresses of transactions to the same cluster.
No, because
CoinJoin.
Heuristic2: Grouping the change addresses (shadow addresses) to the same cluster of the input addresses.
How do you distinguish change addresses form normal outputs?
What I want to do is to develop another heuristic. So far I am thinking to group addresses based on its transaction patterns.
Such as peeling chain, or the addresses that distributed bitcoin to many other addresses and converge in the end.
Is there any other transaction patterns that we can identify its ownership?
It is just the initial idea. Any idea, advice or relative works would be appreciated

Problem is, most addresses are used only once. Especially now that pretty much every wallet is HD.