Method of and system for identifying abnormal site visits

1. A method for determining web hosts receiving abnormal site visits, the method executable on a server, the method comprising:

retrieving web search history corresponding to a plurality of users;

generating a graph of the web search history, wherein each node in the graph is a web host in the web search history, wherein nodes are connected to other nodes via edges, each edge having an associated edge weight, and wherein the edge weight is determined based on an amount of users that visited both hosts connected by the edge;

clustering, based on the edge weights, the nodes in the graph, thereby forming a plurality of node clusters;

retrieving user interaction data corresponding to the node clusters, the user interaction data associated with the plurality of users having visited the web hosts associated with the node clusters;

determining, for each node cluster, whether web hosts in the respective cluster were affiliated based on the user interaction data;

removing, from the graph, each node cluster comprising web hosts that were affiliated based on the user interaction data; and

storing, for each web host associated with a cluster remaining in the graph, an indicator that the respective web host is associated with abnormal site visits.

2. The method of claim 1 , further comprising, before clustering the nodes in the graph:

determining, for each node in the graph, one or more themes corresponding to the respective node; and

removing, from the graph, edges connecting two nodes with associated themes.

3. The method of claim 2 , wherein the determining the one or more themes for each node in the graph comprises querying a database for themes associated with a web host corresponding to the respective node.

4. The method of claim 1 , further comprising:

receiving a search query;

generating, based on the search query, a search engine results page ranking a plurality of web hosts corresponding to the search query; and

reducing a rank in the search engine results page of a web host associated with abnormal site visits.

5. The method of claim 1 , further comprising:

receiving a search query;

generating, based on the search query, a search engine results page ranking a plurality of web hosts corresponding to the search query; and

removing, from the search engine results page, a web host associated with abnormal site visits.

6. The method of claim 1 , further comprising removing, from the web search history, data corresponding to web hosts associated with abnormal site visits.

7. The method of claim 1 , further comprising:

determining a plurality of user identifiers corresponding to the abnormal site visits; and

storing, for each user identifier of the plurality of user identifiers, an indicator that the respective user identifier is associated with abnormal site visits.

8. The method of claim 1 , wherein the user interaction data comprises the web search history.

9. The method of claim 1 , wherein the user interaction data comprises web browser usage data.

10. The method of claim 1 , wherein the user interaction data comprises web script data.

11. The method of claim 1 , further comprising determining each edge weight based on a number of matching search queries entered by the users that visited both hosts connected by an edge.

12. A system for determining web hosts receiving abnormal site visits, the system comprising:

a processor; and

a non-transitory computer-readable medium comprising instructions,

the processor, upon executing the instructions, being configured to:

retrieve web search history corresponding to a plurality of users;

generate a graph of the web search history, wherein each node in the graph is a web host in the web search history, wherein nodes are connected to other nodes via edges, each edge having an associated edge weight, and wherein the edge weight is determined based on an amount of users that visited both hosts connected by the edge;

cluster, based on the edge weights, the nodes in the graph, thereby forming a plurality of node clusters;

retrieve user interaction data corresponding to the node clusters, the user interaction data associated with a plurality of users having visited the web hosts associated with the node clusters;

determine, for each node cluster, whether web hosts in the respective cluster were affiliated based on the user interaction data;

remove, from the graph, each node cluster comprising web hosts that were affiliated based on the user interaction data; and

store, for each web host associated with a cluster remaining in the graph, an indicator that the respective web host is associated with abnormal site visits.

13. The system of claim 12 , wherein the processor, upon executing the instructions, is further configured to:

determine, for each node in the graph, one or more themes corresponding to the respective node; and

remove, from the graph, edges connecting two nodes with associated themes.

14. The system of claim 12 , wherein the processor, upon executing the instructions, is further configured to:

receive a search query;

generate, based on the search query, a search engine results page ranking a plurality of web hosts corresponding to the search query; and

reduce a rank in the search engine results page of a web host associated with abnormal site visits.

15. The system of claim 12 , wherein the processor, upon executing the instructions, is further configured to:

receive a search query;

generate, based on the search query, a search engine results page ranking a plurality of web hosts corresponding to the search query; and

remove, from the search engine results page, a web host associated with abnormal site visits.

16. The system of claim 12 , wherein the processor, upon executing the instructions, is further configured to remove, from the web search history, data corresponding to web hosts associated with abnormal site visits.

17. The system of claim 12 , wherein the processor, upon executing the instructions, is further configured to:

determine a plurality of user identifiers corresponding to the abnormal site visits; and

store, for each user identifier of the plurality of user identifiers, an indicator that the respective user identifier is associated with abnormal site visits.

18. The system of claim 12 , wherein the processor, upon executing the instructions, is further configured to determine the edge weight based on a number of matching queries entered by the users that visited both web hosts connected by an edge.

19. A method for determining web hosts receiving abnormal site visits, the method executable on a server, the method comprising:

retrieving web search history corresponding to a plurality of users;

for each respective web host in the search history:

determining, based on the web search history, a list of other web hosts visited by users that visited the respective web host, and

removing, from the list of other web hosts, other web hosts having a natural affiliation with the respective web host;

clustering, based on the lists of other web hosts, web hosts that are non-naturally affiliated, thereby forming a plurality of clusters of web hosts;

retrieving user interaction data corresponding to the node clusters, the user interaction data associated with the plurality of users having visited the web hosts associated with the node clusters;

removing clusters comprising web hosts that are affiliated with each other based on the user interaction data; and

storing, for each web host associated with remaining clusters, an indicator that the respective web host is associated with abnormal site visits.

20. The method of claim 19 , wherein the removing the other web hosts having a natural affiliation with the respective web host comprises, for each other web host in the list of other web hosts, comparing one or more themes corresponding to the respective web host to one or more themes corresponding to the respective other web host.