1. A system configured to train and use a classifier to classify entities to determine whether the entities are part of a distributed denial of service (DDoS) attack, the system comprising: one or more hardware processors; and one or more computer-readable storage devices having stored thereon instructions that are executable by the one or more hardware processors to configure the system to perform at least the following: train a classifier to use a first classification method to identify probabilities that entities are performing denial of service attacks, the training comprising applying a captured dataset including data flow protocol information associated with known DDoS attacks; using the trained classifier, identify a subset of entities from a set of candidate entities that meet or exceed a threshold probability of performing a denial of service attack; using a second classification method, identify similarity of entities in the identified subset of entities; and based on the similarity, classify individual entities of the subset of entities as belonging to one or more similarity subgroups, each similarity subgroup comprising entities having a probability of participating in a same DDoS.
1. A system configured to train and use a classifier to classify entities to determine whether the entities are part of a distributed denial of service (DDoS) attack, the system comprising: one or more hardware processors; and one or more computer-readable storage devices having stored thereon instructions that are executable by the one or more hardware processors to configure the system to perform at least the following: train a classifier to use a first classification method to identify probabilities that entities are performing denial of service attacks, the training comprising applying a captured dataset including data flow protocol information associated with known DDoS attacks; using the trained classifier, identify a subset of entities from a set of candidate entities that meet or exceed a threshold probability of performing a denial of service attack; using a second classification method, identify similarity of entities in the identified subset of entities; and based on the similarity, classify individual entities of the subset of entities as belonging to one or more similarity subgroups, each similarity subgroup comprising entities having a probability of participating in a same DDoS. 6. The system of claim 1 , wherein the one or more computer-readable storage devices further have stored thereon instructions that are executable by the one or more processors to configure the computer system to identify entities infected by the same means based on similarity.