Abstract: Methods and systems for detection and estimation of fraudulent online advertisement attribution are disclosed. A plurality of network domains and a corresponding plurality of network locations for each network domain are determined based on network traffic data associated with webpage ad placement. The number of the plurality of network locations corresponding to each plurality of network domains is greater than a first threshold value. From the plurality of network locations, a second plurality of network locations is determined in which each network location is associated with two or more network domains of a predefined set of network domains. The number of the two or more network domains exceeds a second threshold value. A report is generated indicating the second plurality of network locations.

Abstract: A network anomaly detector evaluates two complementary measurements of network statistics, a time variation and correlation among those statistics, to provide an extremely robust detection of network anomalies. In one embodiment, the variability and correspondence are compared against historically derived thresholds to provide for a system that accommodates to local network conditions and evolving network qualities.

Abstract: A monitor of malicious network traffic attaches to unused addresses and monitors communications with an active responder that has constrained-state awareness to be highly scalable. In a preferred embodiment, the active responder provides a response based only on the previous statement from the malicious source, which in most cases is sufficient to promote additional communication with the malicious source, presenting a complete record of the transaction for analysis and possible signature extraction.

Abstract: A network monitor provides improved understanding of the type of data being transmitted by packets by capturing rendezvous packets, such as domain name server queries and responses, to extract text domain names that may then be associated with later packets using a common numeric addresses. Text domain names intended for human understanding and recollection provide a unique insight into the content of the packets not readily obtained by analysis of the packet data itself.

Abstract: A network monitor provides improved understanding of the type of data being transmitted by packets by capturing rendezvous packets, such as domain name server queries and responses, to extract text domain names that may then be associated with later packets using a common numeric addresses. Text domain names intended for human understanding and recollection provide a unique insight into the content of the packets not readily obtained by analysis of the packet data itself.

Abstract: A network anomaly detector evaluates two complementary measurements of network statistics, a time variation and correlation among those statistics, to provide an extremely robust detection of network anomalies. In one embodiment, the variability and correspondence are compared against historically derived thresholds to provide for a system that accommodates to local network conditions and evolving network qualities.