1. A method of tracing the location of an origin computer system that initially transmits a suspect data payload across a computer network to an end target computer system, the method comprising: retrieving, using a hardware processor, a connection record that contains transmission information between a first computer system across the computer network; generating, using the hardware processor, a byte value statistical distribution of data contained in a data payload corresponding to the connection record; determining, using the hardware processor, a first distance between the byte value statistical distribution of data contained in the data payload and a model distribution representative of normal payloads transmitted across the computer network; identifying, using the hardware processor, the data payload as a suspect data payload based on the calculated distance; designating, using the hardware processor, the first computer system as a suspect computer system in response to identifying the suspect data payload; determining, using the hardware processor, that a second distance between the byte value statistical distribution and another connection record distribution falls within a given tolerance; and designating, using the hardware processor, at least a second computer system associated with the another connection record as the suspect computer system in response to determining that the second distance between the byte value statistical distribution and another connection record distribution falls within the given tolerance.