Contextual analyses of network traffic

A method for analyzing network traffic, comprising:

• receiving, from a plurality of network listeners, network traffic data;
• aggregating the network traffic data to generate a database of mass scanning network traffic, the database associating the mass scanning network traffic with respective sources of the mass scanning network traffic;
• querying the database with a first source associated with first network traffic;
• determining whether at least one source in the database matches the first source;
• receiving, from multiple users, multiple queries, each comprising a respective network scanning activity from a same source;
• determining that the network scanning activities are targeted scanning activities;
• and
• tagging the source as suspicious of conducting micro-targeting network scans.

A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform a method for analyzing network traffic, the method comprising:

• receiving, from a plurality of network listeners, network traffic data;
• aggregating the network traffic data to generate a database of mass scanning network traffic, the database associating the mass scanning network traffic with respective sources of the mass scanning network traffic;
• querying the database with a first source associated with first network traffic;
• determining whether at least one source in the database matches the first source;
• receiving, from multiple users, multiple queries, each comprising a respective network scanning activity from a same source;
• determining that the network scanning activities are targeted scanning activities;
• and
• tagging the source as suspicious of conducting micro-targeting network scans.