The Internet has become a vital source of information. This comes with the attendant problems, namely misuse. Systematic downloading of academic and digitized media have become commonplace. Academic institutions in particular get blacklisted owing to free availability of Internet across campus. The objective of this paper is to pro-actively detect systematic downloading. Time series of number of requests are analyzed with pattern analysis techniques. A characterization of the model in the Z-domain shows that the roots of the transfer function form separate clusters during normal and abnormal behavior of traffic. Stability of the system has been used as a cue to detect systematic downloading. Analyzing the trajectory and location of roots to detect systematic downloading involves complex decisions which may not be robust to evolving traffic. This issue is addressed by using Support Vector Data Description that learns a hypersphere enclosing normal traffic. Our empirical evaluations with features like AutoRegressive model roots and Line Spectral Pairs (LSP) obtained from the request time series along with data description show a lot of promise for detecting systematic downloading with F-measure and accuracy as high as 0.90 and 99.5%, respectively. This hybrid approach ensures low false alarms, misses and guarantees robustness of the system. © 2014 IEEE.