Systems and methods for network traffic analysis
Systems and methods are disclosed for identifying malicious traffic associated with a website. One method includes receiving website traffic metadata comprising a plurality of variables, the website traffic metadata being associated with a plurality of website visitors to the website; determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic metadata; generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic metadata; determining a total number of occurrences associated with each pair of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata; determining a plurality of visitor actions associated with the plurality of variables of the website traffic metadata; clustering each of the plurality of pairs and the plurality of visitor actions associated with the plurality of variables of the website traffic metadata into groups; and determining, based on the clustering of the plurality of pairs and the plurality of visitor actions, whether each of the plurality of website visitors are malicious visitors.
1. A computer-implemented method for identifying malicious traffic associated with a website, comprising:
receiving website traffic data comprising a plurality of variables;
determining a total number of occurrences associated with at least two variables, of the plurality of variables of the received website traffic data;
generating a plurality of combinations of the at least two variables;
clustering each of the plurality of combinations of the at least two variables into groups; and
determining, based on the clustering of the plurality of combinations of the at least two variables into groups, whether malicious traffic is associated with the website.
2. The method of claim 1 , wherein clustering each of the plurality of combinations of the at least two variables into groups and determining whether malicious traffic is associated with the website further comprise:
determining a total number of occurrences associated with each combination, of the plurality of combinations of the at least two variables;
determining a plurality of visitor actions associated with the at least two variables;
clustering each combination, of the plurality of combinations of the at least two variables, and the plurality of visitor actions associated with the at least two variables; and
determining, based on the clustering of the plurality of combinations and the plurality of visitor actions, whether malicious traffic is associated with the website.
3. The method of claim 2 , wherein clustering each combination, of the plurality of combinations, and the plurality of visitor actions comprises:
generating a plurality of multi-dimensional vectors for each combination, of the plurality of combinations, of the at least two variables; and
executing a clustering algorithm on the vectors to generate the groups.
4. The method of claim 1 , wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website comprises cross-referencing each member of the groups with known trusted visitors.
5. The method of claim 1 , wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website comprises cross-referencing each member of the groups with known malicious visitors.
6. The method of claim 1 , wherein the received website traffic data includes a plurality of website visitors to the website, and wherein the method further comprises:
determining whether at least one visitor, of the plurality of visitors, is a malicious visitor; and
labeling values of each of the plurality of variables based upon a determination that at least one visitor, of the plurality of website visitors, is a malicious visitor.
7. The method of claim 6 , further comprising determining a proportion of malicious traffic to the website based on the determination that at least one visitor, of the plurality of website visitors, is a malicious visitor.
8. The method of claim 1 , wherein the received website traffic data includes a plurality of website visitors to the website, and
wherein the plurality of variables comprise at least one of a country of origin of data packets associated with the plurality of website visitors, geographic area of origin of data packets associated with the plurality of website visitors, an Internet Protocol (IP) address of data packets associated with the plurality of website visitors, a browser identifier associated with the plurality of website visitors, and Uniform Resource Locator (URL) base directory associated with the plurality of website visitors.
9. A system for identifying malicious traffic associated with a website, the system including:
a data storage device that stores instructions for identifying malicious traffic associated with a website; and
a processor configured to execute the instructions to perform a method including:
receiving website traffic data comprising a plurality of variables;
determining a total number of occurrences associated with at least two variables, of the plurality of variables of the received website traffic data;
generating a plurality of combinations of the at least two variables;
clustering each of the plurality of combinations of the at least two variables into groups; and
determining, based on the clustering of the plurality of combinations of the at least two variables into groups, whether malicious traffic is associated with the website.
10. The system of claim 9 , wherein clustering each of the plurality of combinations of the at least two variables into groups and determining whether malicious traffic is associated with the website further include:
determining a total number of occurrences associated with each combination, of the plurality of combinations of the at least two variables;
determining a plurality of visitor actions associated with the at least two variables;
clustering each combination, of the plurality of combinations of the at least two variables, and the plurality of visitor actions associated with the at least two variables; and
determining, based on the clustering of the plurality of combinations and the plurality of visitor actions, whether malicious traffic is associated with the website.
11. The system of claim 10 , wherein clustering each combination, of the plurality of combinations, and the plurality of visitor actions includes:
generating a plurality of multi-dimensional vectors for each combination, of the plurality of combinations, of the at least two variables; and
executing a clustering algorithm on the vectors to generate the groups.
12. The system of claim 9 , wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website includes cross-referencing each member of the groups with known trusted visitors.
13. The system of claim 9 , wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website includes cross-referencing each member of the groups with known malicious visitors.
14. The system of claim 9 , wherein the received website traffic data includes a plurality of website visitors to the website, and wherein the method further includes:
determining whether at least one visitor, of the plurality of visitors, is a malicious visitor; and
labeling values of each of the plurality of variables based upon a determination that at least one visitor, of the plurality of website visitors, is a malicious visitor.
15. The system of claim 14 , wherein the method further includes determining a proportion of malicious traffic to the website based on the determination that at least one visitor, of the plurality of website visitors, is a malicious visitor.
16. The system of claim 9 , wherein the received website traffic data includes a plurality of website visitors to the website, and
wherein the plurality of variables comprise at least one of a country of origin of data packets associated with the plurality of website visitors, geographic area of origin of data packets associated with the plurality of website visitors, an Internet Protocol (IP) address of data packets associated with the plurality of website visitors, a browser identifier associated with the plurality of website visitors, and Uniform Resource Locator (URL) base directory associated with the plurality of website visitors.
17. A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying malicious traffic associated with a website, the method including:
receiving website traffic data comprising a plurality of variables;
determining a total number of occurrences associated with at least two variables, of the plurality of variables of the received website traffic data;
generating a plurality of combinations of the at least two variables;
clustering each of the plurality of combinations of the at least two variables into groups; and
determining, based on the clustering of the plurality of combinations of the at least two variables into groups, whether malicious traffic is associated with the website.
18. The computer-readable medium of claim 17 , wherein clustering each of the plurality of combinations of the at least two variables into groups and determining whether malicious traffic is associated with the website further include:
determining a total number of occurrences associated with each combination, of the plurality of combinations of the at least two variables;
determining a plurality of visitor actions associated with the at least two variables;
clustering each combination, of the plurality of combinations of the at least two variables, and the plurality of visitor actions associated with the at least two variables; and
determining, based on the clustering of the plurality of combinations and the plurality of visitor actions, whether malicious traffic is associated with the website.
19. The computer-readable medium of claim 18 , wherein clustering each combination, of the plurality of combinations, and the plurality of visitor actions includes:
generating a plurality of multi-dimensional vectors for each combination, of the plurality of combinations, of the at least two variables; and
executing a clustering algorithm on the vectors to generate the groups.
20. The computer-readable medium of claim 17 , wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website includes cross-referencing each member of the groups with known trusted visitors.