1. A computer system comprising: one or more processors; and one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to train a classifier to classify entities to increase confidence with respect to an entity being part of a distributed denial of service attack, including instructions that are executable to configure the computer system to perform at least the following: train a classifier to use a first classification method, to identify probabilities that entities from a set of entities are performing denial of service attacks; using the classifier, identify a subset of entities meeting a threshold probability of performing a denial of service attack; using a second classification method, identify similarity of entities in the subset of entities; and based on the similarity, classify individual entities.