Systems and methods for analyzing network data to identify human and non-human users in network communications

1 . A computer-implemented method for identifying human users on a network, comprising:

receiving network data over a predetermined time period, the network data comprising one or more groupings wherein each group includes one or more user-initiated events and a corresponding network address;

determining one or more consistency thresholds based on device usage consistency and device utilization of the one or more user-initiated events, the device usage consistency based on a number of successful login attempts from a respective IP address;

determining qualifying pairs of the groupings, the qualifying pairs corresponding to a subset of the groupings that meet or exceed the one or more consistency thresholds;

receiving external source information comprising whether a qualifying pair has paid for one or more features;

determining a first user-initiated event of the qualifying pairs is associated with a non-human user, but should be associated with a human user, by comparing an IP address associated with the first user-initiated event with a list of IP addresses associated with human users and based on the qualifying pair corresponding to the first user-initiated event paying for one or more features associated with an external source; and

adjusting the one or more consistency thresholds such that the first user-initiated event of the qualifying pairs is associated with a human user.

2 . The method of claim 1 , wherein a plurality of network addresses comprises a number of successful login attempts and/or a number of failed login attempts associated with each user-initiated event, and further comprising:

determining if the each user-initiated event is associated with a human user or a non-human user based upon the number of successful login attempts and the number of failed login attempts for each of the user-initiated events.

3 . The method of claim 1 , further comprising:

determining an indicia that a user is human is based on a user's address book.

4 . The method of claim 1 , further comprising:

receiving additional network data associated with a plurality of known human users; and

determining at least one of the consistency thresholds based, at least in part, on the plurality of known human users.

5 . The method of claim 1 , further comprising:

associating, for the user-initiated events, a plurality of booleans with the one or more consistency thresholds;

determining, for each user-initiated event, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more consistency thresholds are met or exceeded; and

determining if each user-initiated event is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false.

6 . The method of claim 5 , further comprising:

determining at least one uncertain user-initiated event of the plurality of user-initiated events that neither meets criteria for being associated with a human user or a non-human user;

adjusting the one or more consistency thresholds; and

determining if the at least one uncertain user-initiated event is associated with a human user or a non-human user based upon the adjusted one or more consistency thresholds.

7 . The method of claim 1 , further comprising:

generating pairs of user-initiated events from the user-initiated events;

determining communications between user-initiated events associated with each of the pairs of user-initiated events; and

labeling the user-initiated events as trusted or untrusted based upon the communications between user-initiated events associated with each of the pairs of user-initiated events.

8 . A system for identifying human users on a network, the system including:

a data storage device that stores instructions for identifying human users on a network; and

a processor configured to execute the instructions to perform a method including:

receiving network data over a predetermined time period, the network data comprising one or more groupings wherein each group includes one or more user-initiated events and a corresponding network address;

determining one or more consistency thresholds based on device usage consistency and device utilization of the one or more user-initiated events, the device usage consistency based on a number of successful login attempts from a respective IP address;

determining qualifying pairs of the groupings, the qualifying pairs corresponding to a subset of the groupings that meet or exceed the one or more consistency thresholds;

receiving external source information comprising whether a qualifying pair has paid for one or more features;

determining a first user-initiated event of the qualifying pairs is associated with a non-human user, but should be associated with a human user, by comparing an IP address associated with the first user-initiated event with a list of IP addresses associated with human users and based on the qualifying pair corresponding to the first user-initiated event paying for one or more features associated with an external source; and

adjusting the one or more consistency thresholds such that the first user-initiated event of the qualifying pairs is associated with a human user.

9 . The system of claim 8 , wherein the network addresses comprise a number of successful login attempts and/or a number of failed login attempts associated with each user-initiated event, and the method further comprising:

determine if each user-initiated event is associated with a human user or a non-human user based upon the number of successful login attempts and the number of failed login attempts for each of the user-initiated events.

10 . The system of claim 8 , the method further comprising:

determining an indicia that a user is human is based on a user's address book.

11 . The system of claim 8 , the method further comprising:

receiving additional network data associated with a plurality of known human users; and

determining at least one of the one or more consistency thresholds based, at least in part, on the plurality of known human users.

12 . The system of claim 8 , the method further comprising:

associating, for the user-initiated events, a plurality of booleans with the one or more consistency thresholds;

determining, for each of the plurality of user-initiated events, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more consistency thresholds are met or exceeded; and

determining if each of the plurality of user-initiated events is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false.

13 . The system of claim 12 , the method further comprising:

determining at least one uncertain user-initiated event of the plurality of user-initiated events that neither meets criteria for being associated with a human user or a non-human user;

adjusting the one or more consistency thresholds; and

determining if the at least one uncertain user-initiated event is associated with a human user or a non-human user based upon the adjusted one or more consistency thresholds.

14 . The system of claim 8 , the method further comprising:

generating pairs of user-initiated events from the user-initiated events;

determining communications between user-initiated events associated with each of the pairs of user-initiated events; and

labeling the user-initiated events as trusted or untrusted based upon the communications between user-initiated events associated with each of the pairs of user-initiated events.

15 . A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying human users on a network, the method including:

receiving network data over a predetermined time period, the network data comprising one or more groupings wherein each group includes one or more user-initiated events and a corresponding network address;

determining one or more consistency thresholds based on device usage consistency and device utilization of the one or more user-initiated events, the device usage consistency based on a number of successful login attempts from a respective IP address;

determining qualifying pairs of the groupings, the qualifying pairs corresponding to a subset of the groupings that meet or exceed the one or more consistency thresholds;

receiving external source information comprising whether a qualifying pair has paid for one or more features;

determining a first user-initiated event of the qualifying pairs is associated with a non-human user, but should be associated with a human user, by comparing an IP address associated with the first user-initiated event with a list of IP addresses associated with human users and based on the qualifying pair corresponding to the first user-initiated event paying for one or more features associated with an external source; and

adjusting the one or more consistency thresholds such that the first user-initiated event of the qualifying pairs is associated with a human user.

16 . The computer-readable medium of claim 15 , wherein the network addresses comprises a number of successful login attempts and/or a number of failed login attempts associated with each user-initiated event, and the method further comprising:

determine if each user-initiated event is associated with a human user or a non-human user based upon the number of successful login attempts and the number of failed login attempts for each of the user-initiated events.

17 . The computer-readable medium of claim 15 , the method further comprising:

receiving additional network data associated with a plurality of known human users; and

determining at least one or more consistency thresholds based, at least in part, on the plurality of known human users.

18 . The computer-readable medium of claim 15 , the method further comprising:

associating, for the user-initiated events, a plurality of booleans with the one or more consistency thresholds;

determining, for each of the plurality of user-initiated events, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more consistency thresholds are met or exceeded; and

determining if each of the plurality of user-initiated events is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false.

19 . The computer-readable medium of claim 18 , the method further comprising:

determining at least one uncertain user-initiated event of the user-initiated events that neither meets criteria for being associated with a human user or a non-human user;

adjusting the one or more consistency thresholds; and

determining if the user-initiated event is associated with a human user or a non-human user based upon the adjusted one or more consistency thresholds.

20 . The computer-readable medium of claim 15 , the method further comprising:

generating pairs of user-initiated events;

determining communications between user-initiated events; and

labeling the user-initiated events as trusted or untrusted based upon the communications between user-initiated events associated with each of the pairs of user-initiated events.