Systems and methods for analyzing network data to identify human and non-human users in network communications

1. A computer-implemented method for identifying human users on a network, comprising:

receiving network data comprising data transmitted over a network over predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events;

determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of a first user-initiated event type from the plurality of user-initiated events and a network address of the plurality of network addresses, wherein, for each pair, the user-initiated event of the first user-initiated event type corresponds to the network address of the plurality of network addresses;

determining which of the plurality of pairs are qualifying pairs, the qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, meets or exceeds one or more predetermined event frequency thresholds of the first user-initiated even type;

determining which of the plurality of pairs are non-qualifying pairs, the non-qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, does not meet or exceed the one or more predetermined event frequency thresholds of the first user-initiated event type;

determining a plurality of user counts, a first user count of the plurality of user counts corresponding to a number of users associated with the qualifying pairs, a second user count of the plurality of user counts corresponding to a number of users associated with the non-qualifying pairs;

determining a plurality of distributions, a first distribution of the plurality of distributions associated with the first user count and a second distribution of the plurality of distributions associated with the second user count;

determining a first threshold associated with the first distribution of the plurality of distributions and a second threshold associated with the second distribution of the plurality of distributions; and

determining if at a user is human or non-human based on the first threshold associated with the first distribution of the plurality of distributions and the second threshold associated with the second distribution of the plurality of distributions.

2. The method of claim 1 , wherein the first user-initiated event type comprises a number of successful login attempts and/or a number of failed login attempts, and further comprising:

determining which of the plurality of pairs are qualifying pairs based on the number of successful login attempts and/or the number of failed login attempts.

3. The method of claim 1 , further comprising:

determining at least one of the predetermined event frequency thresholds for each of the user-initiated events.

4. The method of claim 1 , further comprising:

receiving additional network data associated with a plurality of known human users; and

determining at least one of the predetermined event frequency thresholds based, at least in part, on the plurality of known human users.

5. The method of claim 1 , further comprising:

associating, for the plurality of user-initiated events, a plurality of booleans with the one or more predetermined event frequency thresholds;

determining, for each of the plurality of user-initiated events, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more predetermined event frequency thresholds are met or exceeded; and

determining if each of the plurality of user-initiated events is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false and based upon the plurality of distributions.

6. The method of claim 5 , further comprising:

upon determining at least one uncertain user that neither meets criteria for being associated with a human or a non-human, adjusting the one or more predetermined event frequency thresholds; and

determining if the at least one uncertain user is associated with a human or a non-human based upon the adjusted predetermined event frequency thresholds.

7. The method of claim 1 , further comprising:

generating pairs of users from a plurality of users;

determining communications between users associated with each of the pairs of users; and

determining if at a user is human or non-human based upon the communications between users associated with each of the pairs of users.

8. A system for identifying human users on a network, the system including:

a data storage device that stores instructions for identifying human users on a network; and

a processor configured to execute the instructions to perform a method including:

receiving network data comprising data transmitted over a network over predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events;

determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of a first user-initiated event type from the plurality of user-initiated events and a network address of the plurality of network addresses, wherein, for each pair, the user-initiated event of the first user-initiated event type corresponds to the network address of the plurality of network addresses;

determining which of the plurality of pairs are qualifying pairs, the qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, meets or exceeds one or more predetermined event frequency thresholds of the first user-initiated even type;

determining which of the plurality of pairs are non-qualifying pairs, the non-qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, does not meet or exceed the one or more predetermined event frequency thresholds of the first user-initiated event type;

determining a plurality of user counts, a first user count of the plurality of user counts corresponding to a number of users associated with the qualifying pairs, a second user count of the plurality of user counts corresponding to a number of users associated with the non-qualifying pairs;

determining a plurality of distributions, a first distribution of the plurality of distributions associated with the first user count and a second distribution of the plurality of distributions associated with the second user count;

determining a first threshold associated with the first distribution of the plurality of distributions and a second threshold associated with the second distribution of the plurality of distributions; and

determining if at a user is human or non-human based on the first threshold associated with the first distribution of the plurality of distributions and the second threshold associated with the second distribution of the plurality of distributions.

9. The system of claim 8 , wherein the first user-initiated event type comprises a number of successful login attempts and/or a number of failed login attempts, and further comprising:

determining which of the plurality of pairs are qualifying pairs based on the number of successful login attempts and/or the number of failed login attempts.

10. The system of claim 8 , the method further comprising:

determining at least one of the predetermined event frequency thresholds for each of the user-initiated events.

11. The system of claim 8 , the method further comprising:

receiving additional network data associated with a plurality of known human users; and

determining at least one of the predetermined event frequency thresholds based, at least in part, on the plurality of known human users.

12. The system of claim 8 , the method further comprising:

associating, for the plurality of user-initiated events, a plurality of booleans with the one or more predetermined event frequency thresholds;

determining, for each of the plurality of user-initiated events, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more predetermined event frequency thresholds are met or exceeded; and

determining if each of the plurality of user-initiated events is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false and based upon the plurality of distributions.

13. The system of claim 12 , the method further comprising:

upon determining at least one uncertain user that neither meets criteria for being associated with a human or a non-human, adjusting the one or more predetermined event frequency thresholds; and

determining if the at least one uncertain user is associated with a human or a non-human based upon the adjusted predetermined event frequency thresholds.

14. The system of claim 8 , the method further comprising:

generating pairs of users from a plurality of users;

determining communications between users associated with each of the pairs of users; and

determining if at a user is human or non-human based upon the communications between users associated with each of the pairs of users.

15. A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying human users on a network, the method including:

receiving network data comprising data transmitted over a network over predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events;

determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of a first user-initiated event type from the plurality of user-initiated events and a network address of the plurality of network addresses, wherein, for each pair, the user-initiated event of the first user-initiated event type corresponds to the network address of the plurality of network addresses;

determining which of the plurality of pairs are qualifying pairs, the qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, meets or exceeds one or more predetermined event frequency thresholds of the first user-initiated even type;

determining which of the plurality of pairs are non-qualifying pairs, the non-qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, does not meet or exceed the one or more predetermined event frequency thresholds of the first user-initiated event type;

determining a plurality of user counts, a first user count of the plurality of user counts corresponding to a number of users associated with the qualifying pairs, a second user count of the plurality of user counts corresponding to a number of users associated with the non-qualifying pairs;

determining a plurality of distributions, a first distribution of the plurality of distributions associated with the first user count and a second distribution of the plurality of distributions associated with the second user count;

determining a first threshold associated with the first distribution of the plurality of distributions and a second threshold associated with the second distribution of the plurality of distributions; and

determining if at a user is human or non-human based on the first threshold associated with the first distribution of the plurality of distributions and the second threshold associated with the second distribution of the plurality of distributions.

16. The computer-readable medium of claim 15 , wherein the first user-initiated event type comprises a number of successful login attempts and/or a number of failed login attempts, and further comprising:

determining which of the plurality of pairs are qualifying pairs based on the number of successful login attempts and/or the number of failed login attempts.

17. The computer-readable medium of claim 15 , the method further comprising:

receiving additional network data associated with a plurality of known human users; and

determining at least one of the predetermined event frequency thresholds based, at least in part, on the plurality of known human users.

18. The computer-readable medium of claim 15 , the method further comprising:

associating, for the plurality of user-initiated events, a plurality of booleans with the one or more predetermined event frequency thresholds;

determining, for each of the plurality of user-initiated events, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more predetermined event frequency thresholds are met or exceeded; and

determining if each of the plurality of user-initiated events is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false and based upon the plurality of distributions.

19. The computer-readable medium of claim 18 , the method further comprising:

upon determining at least one uncertain user that neither meets criteria for being associated with a human or a non-human, adjusting the one or more predetermined event frequency thresholds; and

determining if the at least one uncertain user is associated with a human or a non-human based upon the adjusted predetermined event frequency thresholds.

20. The computer-readable medium of claim 15 , the method further comprising:

generating pairs of users from a plurality of users;

determining communications between users associated with each of the pairs of users; and

determining if at a user is human or non-human based upon the communications between users associated with each of the pairs of users.