12 lines
870 B
Markdown
12 lines
870 B
Markdown
___Co-Occurrence___ allows you to find requests that happen often at the same time as the selected domain. Hence, it will give you a hint what apps might be involved in the activity.
|
|
|
|
How do you interpret these results? Lets look at an example:
|
|
|
|
<IMG>
|
|
|
|
The domain __example.org__ has __14__ requests with an _average time divergence_ of __0.71 seconds__. That is, these 14 domain calls happend, on average, less then a second before or after the original request of the selected domain.
|
|
|
|
Close temporal proximity and high occurrence counts are both indicators for domain correlation. Results are sorted by a ranking index (__9.__) which strikes a balance between the two. Preferring entries with higher counts as well as low time divergence.
|
|
|
|
_Tip:_ As a visual guide, you can look for the colored bar beside each value. The larger the bar, the greater the correlation.
|