Methods and apparatus to analyze network traffic for malicious activity

A non-transitory computer readable storage medium comprising instructions which, when executed, cause at least one processor to at least:

• generate, in response to obtaining internet protocol addresses included within input data, a graph data structure based on one or more features of the internet protocol addresses in the input data;
• generate a first matrix using the graph data structure, the first matrix to represent nodes in the graph data structure, the nodes each corresponding to a respective internet protocol address of the internet protocol addresses;
• generate a second matrix using the graph data structure, the second matrix to represent edges in the graph data structure, the edges each corresponding to a relationship between the nodes based on a geographic location of the internet protocol addresses associated with the nodes;
• and
• classify, using the first matrix and the second matrix, the nodes to identify a reputation of the internet protocol addresses.

A method comprising:

• generating, in response to obtaining internet protocol addresses included within input data, a graph data structure based on one or more features of the internet protocol addresses in the input data;
• generating a first matrix using the graph data structure, the first matrix to represent nodes in the graph data structure, the nodes each corresponding to a respective internet protocol address of the internet protocol addresses;
• generating a second matrix using the graph data structure, the second matrix to represent edges in the graph data structure, the edges indicative of respective ones of the nodes that share a same autonomous system number;
• and
• classifying, using the first matrix and the second matrix, the nodes to identify a reputation of the internet protocol addresses.