Systems and methods for network traffic analysis

A computer-implemented method for identifying malicious traffic associated with a website, comprising:

• receiving website traffic data comprising a plurality of variables, the website traffic data being associated with a plurality of website visitors to the website;
• determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic data;
• generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic data;
• clustering each of the plurality of pairs into groups;
• and
• determining, based on the clustering of the plurality of pairs, whether each of the plurality of website visitors are malicious visitors.

A system for identifying malicious traffic associated with a website, the system including:

• a data storage device that stores instructions for identifying malicious traffic associated with a website;
• and
• a processor configured to execute the instructions to perform a method including:
• receiving website traffic data comprising a plurality of variables, the website traffic data being associated with a plurality of website visitors to the website;
• determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic data;
• generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic data;
• clustering each of the plurality of pairs into groups;
• and
• determining, based on the clustering of the plurality of pairs, whether each of the plurality of website visitors are malicious visitors.

A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying malicious traffic associated with a website, the method including:

• receiving website traffic data comprising a plurality of variables, the website traffic data being associated with a plurality of website visitors to the website;
• determining a total number of occurrences associated with at least two of the plurality of variables of the website traffic data;
• generating a plurality of pairs comprising combinations of the plurality of variables of the website traffic data;
• clustering each of the plurality of pairs into groups;
• and
• determining, based on the clustering of the plurality of pairs, whether each of the plurality of website visitors are malicious visitors.