1. A computer system comprising: one or more computer readable storage devices configured to store one or more software modules including computer executable instructions; and one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the computer executable instructions in order to cause the computer system to: receive information indicative of an access to a network by a user, wherein the information comprises at least: an identity associated with the user; a hostname of a machine associated with the user; a time associated with the access to the network; and location information associated with the identity; determine, based at least on the information, a host score indicative of a first likelihood that the user access to the network was malicious, wherein the host score is determined based, at least in part, on a number of unique machines associated with the user; determine, based on the information, a speed score indicative of a second likelihood that the user access to the network was malicious, wherein the speed score is determined based, at least in part, on a calculated travel speed for the user; determine, based on the information, a location score indicative of a third likelihood that the user access to the network was malicious, wherein the location score is determined based, at least in part, on attack origin distribution data; and determine an aggregate score based at least in part on the host score, the speed score, and the location score.