1. A method comprising: determining one or more features from one or more network transfers among a plurality of network entities; determining a baseline behavioral profile of the plurality of network entities based on the one or more features; and determining at least one malicious network entity from among the plurality of network entities based on a systematic deviation from the baseline behavioral profile of at least one of the one or more features.