Computerized system and method for automatically determining malicious IP clusters using network activity data

A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions, such that when a server executes the instructions, a method is performed comprising:

• identifying, via the server on a network, an access log comprising a first set of IP addresses and a type of network activity performed by each IP address in said first set, said access log indicating a relationship between each IP address and each type of activity performed;
• clustering, via the server, each first IP address based on said relationship;
• identifying, via the server, an Internet Protocol (IP) blacklist comprising a second set of IP addresses associated with malicious activity on said network;
• analyzing, via the server, the IP blacklist, and determining, based on said analysis, a set of parameters defining relationships between each second IP address and the malicious activity;
• analyzing, via the server, each first IP cluster based on said set of parameters, and, based on said analysis, identifying a set of IP clusters that are performing the malicious activity;
• modifying, via the server, the access log by extracting said identified IP clusters from said access log;
• receiving, via the server, a request from a first device to perform a task on said network;
• and
• determining, via the server, whether said task is capable of being performed based on an IP address associated with said request, wherein if the IP address is on said modified access log, said task is permitted.

A server comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium for tangibly storing thereon program logic for execution by the processor, the program logic comprising:
• logic executed by the processor for identifying, via the server on a network, an access log comprising a first set of IP addresses and a type of network activity performed by each IP address in said first set, said access log indicating a relationship between each IP address and each type of activity performed;
• logic executed by the processor for clustering, via the server, each first IP address based on said relationship;
• logic executed by the processor for identifying, via the server, an Internet Protocol (IP) blacklist comprising a second set of IP addresses associated with malicious activity on said network;
• logic executed by the processor for analyzing, via the server, the IP blacklist, and determining, based on said analysis, a set of parameters defining relationships between each second IP address and the malicious activity;
• logic executed by the processor for analyzing, via the server, each first IP cluster based on said set of parameters, and, based on said analysis, identifying a set of IP clusters that are performing the malicious activity;
• logic executed by the processor for modifying, via the server, the access log by extracting said identified IP clusters from said access log;
• logic executed by the processor for receiving, via the server, a request from a first device to perform a task on said network;
• and
• logic executed by the processor for determining, via the server, whether said task is capable of being performed based on an IP address associated with said request, wherein if the IP address is on said modified access log, said task is permitted.