Patent Number: 
Section: claims

1. A method comprising:monitoring characteristics associated with one or more sampled transaction components of a plurality of transaction components;determining whether a value for a first monitored characteristic of the monitored characteristics is unusual based on whether the value is located within a predefined portion of a distribution of values for the first monitored characteristic;identifying one or more sampled transaction components as unusual when a predetermined number of values for the monitored characteristics are determined to be unusual; andgenerating clusters comprising a plurality of permutations of the monitored characteristics identified as unusual. 2. The method of claim 1, further comprising associating the one or more sampled transaction components having substantially similar unusual monitored characteristics with clusters that have corresponding permutations of monitored characteristics. 3. The method of claim 2, further comprising discarding a cluster when monitored characteristics for the one or more sampled transaction components associated with the cluster do not meet a homogeneity measure. 4. The method of claim 3, wherein the homogeneity measure comprises a standard deviation measure. 5. The method of claim 2, further comprising outputting one or more of the clusters for inspection by a user. 6. The method of claim 1, wherein the monitored characteristics comprise logged information associated with network traffic. 7. The method of claim 1, wherein the values included in the distribution comprise values for the first monitored characteristic associated with the plurality of transaction components. 8. The method of claim 1, wherein the one or more sampled transaction components are selected from a group consisting of IP addresses, landing pages, networking domains, and cookies. 9. The method of claim 1, further comprising determining when the first monitored characteristic is unusual based on previous values for the first monitored characteristic. 10. The method of claim 9, wherein the first monitored characteristic is determined to be unusual when the value of the first monitored characteristic exceeds a number of standard deviations from a mean or a predicted value of a linear prediction based on previous values for the first monitored characteristic. 11. The method of claim 10, wherein the first monitored characteristic is determined to be unusual when a slope of a line fit to current and previous values exceeds a predetermined slope threshold. 12. The method of claim 11, wherein the first monitored characteristic is determined to be unusual when current and historical values of the first monitored characteristic vary less than a variation threshold that specifies a minimum amount of variation between the values. 13. The method of claim 1, further comprising generating the distribution of the values for the first monitored characteristic based on a histogram of the values segmented by frequency of occurrence. 14. The method of claim 13, wherein the predefined portion of the distribution comprises a value range greater than a threshold value based on a distribution of the segments of the histogram. 15. The method of claim 13, wherein the predefined portion of the distribution comprises a value range less than a threshold value based on a distribution of the segments of the histogram. 16. The method of claim 1, further comprising generating an index that includes identifiers for the monitored characteristics associated with the one or more sampled transaction components. 17. The method of claim 16, wherein keys for the index comprise identifiers for the one or more sampled transaction components. 18. The method of claim 16, further comprising associating an identifier for the first monitored characteristic with a value signifying whether the first monitored characteristic is unusual. 19. The method of claim 17, wherein values signifying whether the monitored characteristics are unusual are stored as bits in a bit vector associated with a key representing the one or more sampled transaction components associated with the monitored characteristics. 20. A system comprising:a network traffic monitor to monitor characteristics associated with one or more sampled transaction components of a plurality of transaction components; andmeans for:determining whether a value for a first monitored characteristic of the monitored characteristics is unusual based on whether the value is located within a predefined portion of a distribution of values for the first monitored characteristic;identifying the one or more sampled transaction components as unusual when a predetermined number of values for the monitored characteristics are determined to be unusual; andgenerating clusters comprising a plurality of permutations of the monitored characteristics identified as unusual.