Utilizing clustering to identify ip addresses used by a botnet

One or more computer-readable media having a plurality of executable instructions embodied thereon, which, when executed by one or more processors, cause the one or more processors to perform a method for identifying suspect Internet Protocol (IP) addresses, the method comprising:

• obtaining a set of login pairs, each login pair comprising login identifiers and IP addresses used in attempts to login to a source;
• generating an IP mapping and a login mapping using the set of login pairs, the IP mapping associating each IP address to corresponding login identifiers used for source login attempts and the login mapping associating each login identifier to corresponding IP addresses used for source login attempts;
• generating an IP cluster having a plurality of related IP addresses by traversing the IP mapping and the login mapping to identify the plurality of related IP addresses, wherein the plurality of related IP addresses includes a first IP address and a second IP address that are related based on being used in association with a particular login identifier or based on third IP address being related to the first IP address and the second IP address;
• determining that the IP cluster exceeds a threshold amount of IP addresses;
• and
• enhancing login security for a subsequent login attempt made in association with an IP address of the IP cluster based on the determination that the IP cluster exceeds the threshold amount of IP addresses.

A computing system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable storage media, coupled with the one or more processors, having instructions stored thereon, which, when executed by the one or more processors, cause the computing system to provide:
• means for detecting a botnet by clustering IP addresses related to one another based on a user identifier being used to attempt to login to a source via multiple IP addresses or an IP address being used to attempt to login to the source via multiple user identifiers;
• and
• means for assessing risk of login attempts based on use of the clustered IP addresses associated with the botnet.