Abstract: Approaches presented herein relate to the monitoring of network traffic, and identification of potentially malicious behavior, in a networked resource environment. Values for key features of interest can be extracted from monitored network traffic. This data can be aggregated for one or more data dimensions, such as for a given region, and modeling can be performed to generate distributions for those values in that region. A threshold can be applied to this distribution to identify anomalous activity, where the same threshold can be applied to distributions for different regions and the values that meet or exceed that threshold will differ across regions based at least in part upon different levels of activity or different behavior. Such an approach scales with changes in the amount or type of traffic to be monitored, and can handle very large numbers of resources and volumes of traffic. If potentially malicious behavior is identified, one or more remedial or mitigation actions may be taken.

Abstract: This disclosure describes building a graph that is based on which IP address sources are active in the same time periods. By creating a node for each IP address with some moderate level of suspicious activity and connecting the nodes for any IP addresses that are engaging in that activity at roughly the same time, the graph represents scenarios of possible cooperation between sets of IP addresses. Nodes in this graph and the links between are assigned values based on how much suspicious activity they engage in during each time window. These values decay over time if no new suspicious activity occurs. By analyzing the resulting graph at any particular point in time, how similar two IP addresses have been behaving recently can be measured without having to keep track of their total history of activity over the last time period.