1. A method, comprising: detecting, at a device in a network, a network attack using aggregated metrics for a set of traffic data; causing, by the device, the traffic data to be clustered into a set of traffic data clusters, in response to detecting the network attack; causing, by the device, one or more attack detectors to analyze the traffic data clusters; and causing, by the device, the traffic data clusters to be segregated into a set of one or more attack-related clusters and into a set of one or more clusters related to normal traffic based on an analysis of the clusters by the one or more attack detectors.