Abstract: There is disclosed a method and system for determining web hosts receiving abnormal site visits. The method comprises generating a graph of web search history and clustering nodes in the graph. The method then comprises removing clusters that are affiliated based on user interaction data, and storing indicators that the remaining web hosts are associated with abnormal site visits.

Abstract: Systems and methods for determining an abnormal crowd-sourced label for a digital item comprising: analyzing a portion of the plurality of crowd-sourced labels, determining an abnormal subset of crowd-sourced labels having been potentially caused by an occurrence of the external trigger event, acquiring a browsing history associated with a subset of the plurality of users, separating the browsing history into a first browsing history group and a second browsing history group associated, generating a delta set of web resources based on analyzing the first browsing history group and the second browsing history group for differences in web resources visited by the subset of the plurality of users, the delta set containing at least one web resource of the first browsing history set being associated with an abnormal pattern of visits, associating the at least one web resource as being a source of the external trigger event.

Abstract: There is disclosed a method and system for determining web hosts receiving abnormal site visits. The method comprises generating a graph of web search history and clustering nodes in the graph. The method then comprises removing clusters that are affiliated based on user interaction data, and storing indicators that the remaining web hosts are associated with abnormal site visits.

Abstract: Systems and methods for determining an abnormal crowd-sourced label for a digital item comprising: analyzing a portion of the plurality of crowd-sourced labels, determining an abnormal subset of crowd-sourced labels having been potentially caused by an occurrence of the external trigger event, acquiring a browsing history associated with a subset of the plurality of users, separating the browsing history into a first browsing history group and a second browsing history group associated, generating a delta set of web resources based on analyzing the first browsing history group and the second browsing history group for differences in web resources visited by the subset of the plurality of users, the delta set containing at least one web resource of the first browsing history set being associated with an abnormal pattern of visits, associating the at least one web resource as being a source of the external trigger event.