Systems and methods for analyzing network data to identify human and non-human users in network communications

A system for identifying human users on a network, the system including:

• a data storage device that stores instructions for identifying human users on a network;
• and
• a processor configured to execute the instructions to perform a method including:
• receiving network data comprising data transmitted over a network over predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events;
• determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of a first user-initiated event type from the plurality of user-initiated events and a network address of the plurality of network addresses, wherein, for each pair, the user-initiated event of the first user-initiated event type corresponds to the network address of the plurality of network addresses;
• determining which of the plurality of pairs are qualifying pairs, the qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, meets or exceeds one or more predetermined event frequency thresholds of the first user-initiated even type;
• determining which of the plurality of pairs are non-qualifying pairs, the non-qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, does not meet or exceed the one or more predetermined event frequency thresholds of the first user-initiated event type;
• determining a plurality of user counts, a first user count of the plurality of user counts corresponding to a number of users associated with the qualifying pairs, a second user count of the plurality of user counts corresponding to a number of users associated with the non-qualifying pairs;
• determining a plurality of distributions, a first distribution of the plurality of distributions associated with the first user count and a second distribution of the plurality of distributions associated with the second user count;
• determining a first threshold associated with the first distribution of the plurality of distributions and a second threshold associated with the second distribution of the plurality of distributions;
• and
• determining if at a user is human or non-human based on the first threshold associated with the first distribution of the plurality of distributions and the second threshold associated with the second distribution of the plurality of distributions.

A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying human users on a network, the method including:

• receiving network data comprising data transmitted over a network over predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events;
• determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of a first user-initiated event type from the plurality of user-initiated events and a network address of the plurality of network addresses, wherein, for each pair, the user-initiated event of the first user-initiated event type corresponds to the network address of the plurality of network addresses;
• determining which of the plurality of pairs are qualifying pairs, the qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, meets or exceeds one or more predetermined event frequency thresholds of the first user-initiated even type;
• determining which of the plurality of pairs are non-qualifying pairs, the non-qualifying pairs corresponding to a subset of the plurality of pairs where a user-initiated event of the first user-initiated event type, for a corresponding network address of the plurality of network addresses, does not meet or exceed the one or more predetermined event frequency thresholds of the first user-initiated event type;
• determining a plurality of user counts, a first user count of the plurality of user counts corresponding to a number of users associated with the qualifying pairs, a second user count of the plurality of user counts corresponding to a number of users associated with the non-qualifying pairs;
• determining a plurality of distributions, a first distribution of the plurality of distributions associated with the first user count and a second distribution of the plurality of distributions associated with the second user count;
• determining a first threshold associated with the first distribution of the plurality of distributions and a second threshold associated with the second distribution of the plurality of distributions;
• and
• determining if at a user is human or non-human based on the first threshold associated with the first distribution of the plurality of distributions and the second threshold associated with the second distribution of the plurality of distributions.