Method of and system for identifying abnormal site visits

A system for determining web hosts receiving abnormal site visits, the system comprising:

• a processor;
• and
• a non-transitory computer-readable medium comprising instructions,
• the processor, upon executing the instructions, being configured to:
• retrieve web search history corresponding to a plurality of users;
• generate a graph of the web search history, wherein each node in the graph is a web host in the web search history, wherein nodes are connected to other nodes via edges, each edge having an associated edge weight, and wherein the edge weight is determined based on an amount of users that visited both hosts connected by the edge;
• cluster, based on the edge weights, the nodes in the graph, thereby forming a plurality of node clusters;
• retrieve user interaction data corresponding to the node clusters, the user interaction data associated with a plurality of users having visited the web hosts associated with the node clusters;
• determine, for each node cluster, whether web hosts in the respective cluster were affiliated based on the user interaction data;
• remove, from the graph, each node cluster comprising web hosts that were affiliated based on the user interaction data;
• and
• store, for each web host associated with a cluster remaining in the graph, an indicator that the respective web host is associated with abnormal site visits.

A method for determining web hosts receiving abnormal site visits, the method executable on a server, the method comprising:

• retrieving web search history corresponding to a plurality of users;
• for each respective web host in the search history:
• determining, based on the web search history, a list of other web hosts visited by users that visited the respective web host, and
• removing, from the list of other web hosts, other web hosts having a natural affiliation with the respective web host;
• clustering, based on the lists of other web hosts, web hosts that are non-naturally affiliated, thereby forming a plurality of clusters of web hosts;
• retrieving user interaction data corresponding to the node clusters, the user interaction data associated with the plurality of users having visited the web hosts associated with the node clusters;
• removing clusters comprising web hosts that are affiliated with each other based on the user interaction data;
• and
• storing, for each web host associated with remaining clusters, an indicator that the respective web host is associated with abnormal site visits.