1. A computer-implemented method to identify connection records associated with malicious locational references, the method comprising: as implemented by one or more computer readable storage devices configured to store one or more software modules including computer executable instructions, and by one or more hardware computer processors in communication with the one or more computer readable storage devices configured to execute the one or more software modules, identifying connection records, stored in the one or more computer readable storage devices, indicating communications involving a local network, each of the connection records associated with a respective device identifier for a computerized device within the local network, a respective locational reference to a resource external to the local network, and a respective time of communication, performing one or more filtering operations on the connection records to identify, within the connection records, first connection records more likely to be associated with malicious locational references than connection records not included in the first connection records, such that, once initiated, the one or more filtering operations are performed with the one or more computer readable storage devices and the one or more hardware computer processors and without the need for manually performing the filtering operations; numerically scoring at least some of the first connection records using a machine learning model incorporating a plurality of factors relating to the locational references associated with the first connection records; filtering the scored first connection records to identify, within the first connection records, second connection records more likely to be associated with malicious locational references than first connection records not included in the second connection records; receiving a disposition generated by a user regarding one or more of the second connection records; and applying the disposition to the machine learning model.
1. A computer-implemented method to identify connection records associated with malicious locational references, the method comprising: as implemented by one or more computer readable storage devices configured to store one or more software modules including computer executable instructions, and by one or more hardware computer processors in communication with the one or more computer readable storage devices configured to execute the one or more software modules, identifying connection records, stored in the one or more computer readable storage devices, indicating communications involving a local network, each of the connection records associated with a respective device identifier for a computerized device within the local network, a respective locational reference to a resource external to the local network, and a respective time of communication, performing one or more filtering operations on the connection records to identify, within the connection records, first connection records more likely to be associated with malicious locational references than connection records not included in the first connection records, such that, once initiated, the one or more filtering operations are performed with the one or more computer readable storage devices and the one or more hardware computer processors and without the need for manually performing the filtering operations; numerically scoring at least some of the first connection records using a machine learning model incorporating a plurality of factors relating to the locational references associated with the first connection records; filtering the scored first connection records to identify, within the first connection records, second connection records more likely to be associated with malicious locational references than first connection records not included in the second connection records; receiving a disposition generated by a user regarding one or more of the second connection records; and applying the disposition to the machine learning model. 9. The method of claim 1 , the one or more filtering operations comprising a filtering operation including parsing the respective locational reference associated with a certain connection record in the connection records for a domain name; and based on a registration date of the domain name, identifying the certain connection record to be in the first connection records.