Systems and methods for network traffic analysis
View Patent ↗Systems and methods are disclosed for identifying malicious traffic associated with a website. One method includes receiving website traffic metadata comprising a plurality of variables, the website traffic metadata being associated with a plurality of website visitors to the website; determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic metadata; generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic metadata; determining a total number of occurrences associated with each pair of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata; determining a plurality of visitor actions associated with the plurality of variables of the website traffic metadata; clustering each of the plurality of pairs and the plurality of visitor actions associated with the plurality of variables of the website traffic metadata into groups; and determining, based on the clustering of the plurality of pairs and the plurality of visitor actions, whether each of the plurality of website visitors are malicious visitors.
1. A computer-implemented method for identifying malicious traffic associated with a website, comprising:
receiving website traffic metadata comprising a plurality of variables, the website traffic metadata being associated with a plurality of website visitors to the website;
determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic metadata;
generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic metadata;
determining a total number of occurrences associated with each pair of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata;
determining a plurality of visitor actions associated with the plurality of variables of the website traffic metadata;
clustering each of the plurality of pairs and the plurality of visitor actions associated with the plurality of variables of the website traffic metadata into groups; and
determining, based on the clustering of the plurality of pairs and the plurality of visitor actions, whether each of the plurality of website visitors are malicious visitors.
2. The method of claim 1 , wherein clustering each of the plurality of pairs and the plurality of visitor actions comprises:
generating a plurality of multi-dimensional vectors for each of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata; and
executing a clustering algorithm on the vectors to generate the groups.
3. The method of claim 1 , wherein determining whether each of the plurality of website visitors are malicious visitors comprises cross-referencing each member of the groups with known trusted visitors.
4. The method of claim 1 , wherein determining whether each of the plurality of website visitors are malicious visitors comprises cross-referencing each member of the groups with known malicious visitors.
5. The method of claim 1 , further comprising labeling values of each of the plurality of variables based upon the determination whether each of the plurality of website visitors are malicious visitors.
6. The method of claim 1 , further comprising determining a proportion of malicious traffic to the website based on the determined malicious visitors.
7. The method of claim 1 , wherein the plurality of variables comprise at least one of a country of origin of data packets associated with the plurality of website visitors, geographic area of origin of data packets associated with the plurality of website visitors, an Internet Protocol (IP) address of data packets associated with the plurality of website visitors, a browser identifier associated with the plurality of website visitors, and Uniform Resource Locator (URL) base directory associated with the plurality of website visitors.
8. A system for identifying malicious traffic associated with a website, the system including:
a data storage device that stores instructions for identifying malicious traffic associated with a website; and
a processor configured to execute the instructions to perform a method including:
receiving website traffic metadata comprising a plurality of variables, the website traffic metadata being associated with a plurality of website visitors to the website;
determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic metadata;
generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic metadata;
determining a total number of occurrences associated with each pair of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata;
determining a plurality of visitor actions associated with the plurality of variables of the website traffic metadata;
clustering each of the plurality of pairs and the plurality of visitor actions associated with the plurality of variables of the website traffic metadata into groups; and
determining, based on the clustering of the plurality of pairs and the plurality of visitor actions, whether each of the plurality of website visitors are malicious visitors.
9. The system of claim 8 , wherein clustering each of the plurality of pairs and the plurality of visitor actions further comprises:
generating a plurality of multi-dimensional vectors for each of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata; and
executing a clustering algorithm on the vectors to generate the groups.
10. The system of claim 8 , wherein determining whether each of the plurality of website visitors are malicious visitors comprises cross-referencing each member of the groups with known trusted visitors.
11. The system of claim 8 , wherein determining whether each of the plurality of website visitors are malicious visitors comprises cross-referencing each member of the groups with known malicious visitors.
12. The system of claim 8 , further comprising labeling values of each of the plurality of variables based upon the determination whether each of the plurality of website visitors are malicious visitors.
13. The system of claim 8 , further comprising determining a proportion of malicious traffic to the website based on the determined malicious visitors.
14. The system of claim 8 , wherein the plurality of variables comprise at least one of a country of origin of data packets associated with the plurality of website visitors, geographic area of origin of data packets associated with the plurality of website visitors, an Internet Protocol (IP) address of data packets associated with the plurality of website visitors, a browser identifier associated with the plurality of website visitors, and Uniform Resource Locator (URL) base directory associated with the plurality of website visitors.
15. A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying malicious traffic associated with a website, the method including:
receiving website traffic metadata comprising a plurality of variables, the website traffic metadata being associated with a plurality of website visitors to the website;
determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic metadata;
generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic metadata;
determining a total number of occurrences associated with each pair of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata;
determining a plurality of visitor actions associated with the plurality of variables of the website traffic metadata;
clustering each of the plurality of pairs and the plurality of visitor actions associated with the plurality of variables of the website traffic metadata into groups; and
determining, based on the clustering of the plurality of pairs and the plurality of visitor actions, whether each of the plurality of website visitors are malicious visitors.
16. The computer-readable medium of claim 15 , wherein clustering each of the plurality of pairs and the plurality of visitor actions further comprises:
generating a plurality of multi-dimensional vectors for each of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata; and
executing a clustering algorithm on the vectors to generate the groups.
17. The computer-readable medium of claim 15 , wherein determining whether each of the plurality of website visitors are malicious visitors comprises cross-referencing each member of the groups with known trusted visitors.
18. The computer-readable medium of claim 15 , further comprising labeling values of each of the plurality of variables based upon the determination whether each of the plurality of website visitors are malicious visitors.
19. The computer-readable medium of claim 15 , further comprising determining a proportion of malicious traffic to the website based on the determined malicious visitors.
20. The computer-readable medium of claim 15 , wherein the plurality of variables comprise at least one of a country of origin of data packets associated with the plurality of website visitors, geographic area of origin of data packets associated with the plurality of website visitors, an Internet Protocol (IP) address of data packets associated with the plurality of website visitors, a browser identifier associated with the plurality of website visitors, and Uniform Resource Locator (URL) base directory associated with the plurality of website visitors.