Systems and methods for analyzing network data to identify human and non-human users in network communications

A system for identifying human users on a network, the system including:

• a data storage device that stores instructions for identifying human users on a network;
• and
• a processor configured to execute the instructions to perform a method including:
• receiving network data comprising data transmitted over a network over a predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events;
• determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of the plurality of user-initiated events and an associated network address of the plurality of network addresses;
• determining one or more event frequency thresholds, the frequency thresholds based on the user-initiated events and the plurality of network addresses providing an indicia that a user is human;
• determining one or more consistency thresholds based on success and failure rates of the user-initiated events and the plurality of network addresses;
• determining qualifying pairs of the plurality of pairs, the qualifying pairs corresponding to a subset of the plurality of pairs that meet or exceed one or more event frequency thresholds or one or more consistency thresholds;
• determining non-qualifying pairs of the plurality of pairs, the non-qualifying pairs corresponding to the subset of the plurality of pairs that do not meet or exceed one or more event frequency thresholds or one or more consistency thresholds;
• generating at least a first distribution associated with the qualifying pairs and a second distribution associated with the non-qualifying pairs;
• based on at least the first distribution and the second distribution, determining if at least one user-initiated event of the plurality of user-initiated events is associated with a human user or a non-human user;
• and
• based on an indicia that at least one user-initiated event of the plurality of user-initiated events is associated with a non-human user, but should be associated with a human user, adjusting the event frequency threshold.

A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying human users on a network, the method including:

• receiving network data comprising data transmitted over a network over a predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events;
• determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of the plurality of user-initiated events and an associated network address of the plurality of network addresses;
• determining one or more event frequency thresholds, the frequency thresholds based on the user-initiated events and the plurality of network addresses providing an indicia that a user is human;
• determining one or more consistency thresholds based on success and failure rates of the user-initiated events and the plurality of network addresses;
• determining qualifying pairs of the plurality of pairs, the qualifying pairs corresponding to a subset of the plurality of pairs that meet or exceed one or more event frequency thresholds or one or more consistency thresholds;
• determining non-qualifying pairs of the plurality of pairs, the non-qualifying pairs corresponding to the subset of the plurality of pairs that do not meet or exceed one or more event frequency thresholds or one or more consistency thresholds;
• generating at least a first distribution associated with the qualifying pairs and a second distribution associated with the non-qualifying pairs;
• based on at least the first distribution and the second distribution, determining if at least one user-initiated event of the plurality of user-initiated events is associated with a human user or a non-human user;
• and
• based on an indicia that at least one user-initiated event of the plurality of user-initiated events is associated with a non-human user, but should be associated with a human user, adjusting the event frequency threshold.