# US 11,310,255 B2 · Systems and methods for network traffic analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,255 B2 - Document ID: US11310255B2 - Status: Granted - Kind: B2 - Application number: 16/995,347 - Filed: 2020-08-17 - Published: 2020-12-03 - Granted: 2022-04-19 - Earliest claimed: 2017-05-09 - Assignees: Yahoo Ad Tech LLC - Applicants: Verizon Media Inc. - Inventors: Lachlan A. Maxwell; Donald J. McQueen - Web page: https://patentgrep.com/patent/US11310255B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04W 12/63: Location-dependent; Proximity-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods are disclosed for identifying malicious traffic associated with a website. One method includes receiving website traffic metadata comprising a plurality of variables, the website traffic metadata being associated with a plurality of website visitors to the website; determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic metadata; generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic metadata; determining a total number of occurrences associated with each pair of the plurality of pairs of combinations of the plurality of variables of the website traffic metadata; determining a plurality of visitor actions associated with the plurality of variables of the website traffic metadata; clustering each of the plurality of pairs and the plurality of visitor actions associated with the plurality of variables of the website traffic metadata into groups; and determining, based on the clustering of the plurality of pairs and the plurality of visitor actions, whether each of the plurality of website visitors are malicious visitors. ## Claims ### Claim 1 A computer-implemented method for identifying malicious traffic associated with a website, comprising: receiving website traffic data comprising a plurality of variables; determining a total number of occurrences associated with at least two variables, of the plurality of variables of the received website traffic data; generating a plurality of combinations of the at least two variables; clustering each of the plurality of combinations of the at least two variables into groups; and determining, based on the clustering of the plurality of combinations of the at least two variables into groups, whether malicious traffic is associated with the website. ### Claim 2 (depends on 1) The method of claim 1, wherein clustering each of the plurality of combinations of the at least two variables into groups and determining whether malicious traffic is associated with the website further comprise: determining a total number of occurrences associated with each combination, of the plurality of combinations of the at least two variables; determining a plurality of visitor actions associated with the at least two variables; clustering each combination, of the plurality of combinations of the at least two variables, and the plurality of visitor actions associated with the at least two variables; and determining, based on the clustering of the plurality of combinations and the plurality of visitor actions, whether malicious traffic is associated with the website. ### Claim 3 (depends on 2) The method of claim 2, wherein clustering each combination, of the plurality of combinations, and the plurality of visitor actions comprises: generating a plurality of multi-dimensional vectors for each combination, of the plurality of combinations, of the at least two variables; and executing a clustering algorithm on the vectors to generate the groups. ### Claim 4 (depends on 1) The method of claim 1, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website comprises cross-referencing each member of the groups with known trusted visitors. ### Claim 5 (depends on 1) The method of claim 1, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website comprises cross-referencing each member of the groups with known malicious visitors. ### Claim 6 (depends on 1) The method of claim 1, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein the method further comprises: determining whether at least one visitor, of the plurality of visitors, is a malicious visitor; and labeling values of each of the plurality of variables based upon a determination that at least one visitor, of the plurality of website visitors, is a malicious visitor. ### Claim 7 (depends on 6) The method of claim 6, further comprising determining a proportion of malicious traffic to the website based on the determination that at least one visitor, of the plurality of website visitors, is a malicious visitor. ### Claim 8 (depends on 1) The method of claim 1, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein the plurality of variables comprise at least one of a country of origin of data packets associated with the plurality of website visitors, geographic area of origin of data packets associated with the plurality of website visitors, an Internet Protocol (IP) address of data packets associated with the plurality of website visitors, a browser identifier associated with the plurality of website visitors, and Uniform Resource Locator (URL) base directory associated with the plurality of website visitors. ### Claim 9 A system for identifying malicious traffic associated with a website, the system including: a data storage device that stores instructions for identifying malicious traffic associated with a website; and a processor configured to execute the instructions to perform a method including: receiving website traffic data comprising a plurality of variables; determining a total number of occurrences associated with at least two variables, of the plurality of variables of the received website traffic data; generating a plurality of combinations of the at least two variables; clustering each of the plurality of combinations of the at least two variables into groups; and determining, based on the clustering of the plurality of combinations of the at least two variables into groups, whether malicious traffic is associated with the website. ### Claim 10 (depends on 9) The system of claim 9, wherein clustering each of the plurality of combinations of the at least two variables into groups and determining whether malicious traffic is associated with the website further include: determining a total number of occurrences associated with each combination, of the plurality of combinations of the at least two variables; determining a plurality of visitor actions associated with the at least two variables; clustering each combination, of the plurality of combinations of the at least two variables, and the plurality of visitor actions associated with the at least two variables; and determining, based on the clustering of the plurality of combinations and the plurality of visitor actions, whether malicious traffic is associated with the website. ### Claim 11 (depends on 10) The system of claim 10, wherein clustering each combination, of the plurality of combinations, and the plurality of visitor actions includes: generating a plurality of multi-dimensional vectors for each combination, of the plurality of combinations, of the at least two variables; and executing a clustering algorithm on the vectors to generate the groups. ### Claim 12 (depends on 9) The system of claim 9, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website includes cross-referencing each member of the groups with known trusted visitors. ### Claim 13 (depends on 9) The system of claim 9, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website includes cross-referencing each member of the groups with known malicious visitors. ### Claim 14 (depends on 9) The system of claim 9, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein the method further includes: determining whether at least one visitor, of the plurality of visitors, is a malicious visitor; and labeling values of each of the plurality of variables based upon a determination that at least one visitor, of the plurality of website visitors, is a malicious visitor. ### Claim 15 (depends on 14) The system of claim 14, wherein the method further includes determining a proportion of malicious traffic to the website based on the determination that at least one visitor, of the plurality of website visitors, is a malicious visitor. ### Claim 16 (depends on 9) The system of claim 9, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein the plurality of variables comprise at least one of a country of origin of data packets associated with the plurality of website visitors, geographic area of origin of data packets associated with the plurality of website visitors, an Internet Protocol (IP) address of data packets associated with the plurality of website visitors, a browser identifier associated with the plurality of website visitors, and Uniform Resource Locator (URL) base directory associated with the plurality of website visitors. ### Claim 17 A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying malicious traffic associated with a website, the method including: receiving website traffic data comprising a plurality of variables; determining a total number of occurrences associated with at least two variables, of the plurality of variables of the received website traffic data; generating a plurality of combinations of the at least two variables; clustering each of the plurality of combinations of the at least two variables into groups; and determining, based on the clustering of the plurality of combinations of the at least two variables into groups, whether malicious traffic is associated with the website. ### Claim 18 (depends on 17) The computer-readable medium of claim 17, wherein clustering each of the plurality of combinations of the at least two variables into groups and determining whether malicious traffic is associated with the website further include: determining a total number of occurrences associated with each combination, of the plurality of combinations of the at least two variables; determining a plurality of visitor actions associated with the at least two variables; clustering each combination, of the plurality of combinations of the at least two variables, and the plurality of visitor actions associated with the at least two variables; and determining, based on the clustering of the plurality of combinations and the plurality of visitor actions, whether malicious traffic is associated with the website. ### Claim 19 (depends on 18) The computer-readable medium of claim 18, wherein clustering each combination, of the plurality of combinations, and the plurality of visitor actions includes: generating a plurality of multi-dimensional vectors for each combination, of the plurality of combinations, of the at least two variables; and executing a clustering algorithm on the vectors to generate the groups. ### Claim 20 (depends on 17) The computer-readable medium of claim 17, wherein the received website traffic data includes a plurality of website visitors to the website, and wherein determining whether malicious traffic is associated with the website includes cross-referencing each member of the groups with known trusted visitors.