Systems and methods for excluding undesirable network transactions

One or more non-transitory media storing instructions that upon execution by a computer cause the computer to identify sites for transaction exclusion by a cloud security system by performing the steps comprising:

• A) receiving a log of real-time network transactions processed by the cloud security system over a fixed period of time;
• B) applying a plurality of filters that exclude transactions that are benign or have little indication of being suspicious from the network transactions in the log to generate a pool of suspect network transactions by removing the excluded transactions;
• C) generating a suspicion score for a selected network transaction from the pool of suspect network transaction based upon a plurality of indicator checks, wherein the plurality of indicator checks comprises one or more transaction information checks, one or more listing checks, one or more site history checks, one or more requester history checks, one or more URL character usage checks, one or more domain meta-data checks, one or more ratio checks, one or more site page checks, and one or more modeling checks;
• and
• D) if the suspicion score for the selected network transaction meets a specified threshold, performing content analysis on a network site associated with the selected network transaction to determine if the network site hosts malicious content, and if the network site is determined to host malicious content, adding information to the cloud security system that that blocks subsequent real-time network transactions involving the network site;
• wherein steps A)-C) are performed offline to enhance real-time transaction processing by the cloud security system.

A transaction analysis system that identifies sites for transaction exclusion by a cloud security system, the system comprising:

• A) a data store capable of storing:
• i) a log of real-time network transactions;
• ii) transaction filtering information;
• and
• iii) transaction suspicion scoring information;
• B) a system processor comprising one or more processing elements, the system processor in communication with the data store and programmed or adapted to perform steps comprising of:
• i) receiving a log of real-time network transactions processed by the cloud security system over a fixed period of time;
• ii) applying a plurality of filters that exclude transactions that are benign or have little indication of being suspicious from the network transactions in the log to generate a pool of suspect network transactions by removing the excluded transactions;
• iii) generating a suspicion score for a selected network transaction from the pool of suspect network transaction based upon a plurality of indicator checks, wherein the plurality of indicator checks comprises one or more transaction information checks, one or more listing checks, one or more site history checks, one or more requester history checks, one or more URL character usage checks, one or more domain meta-data checks, one or more ratio checks, one or more site page checks, and one or more modeling checks;
• and
• iv) if the suspicion score for the selected network transaction meets specified threshold, performing content analysis on a network site associated with the selected network transaction to determine if the network site hosts malicious content, and if the network site is determined to host malicious content, adding information to the cloud security system that that blocks subsequent real-time network transactions involving the network site;
• wherein steps i)-iii) are performed offline to enhance real-time transaction processing by the cloud security system.