13. A computer implemented method for training a classifier for classifying entities to determine whether the entities are part of a distributed denial of service (DDoS) attack, the method comprising: training a classifier to use a first classification method to identify probabilities that entities are performing denial of service attacks, the training comprising applying a captured dataset including data flow protocol information associated with known DDoS attacks; using the trained classifier, identifying a subset of entities from a set of candidate entities that meet or exceed a threshold probability of performing a denial of service attack; using a second classification method, identifying similarity of entities in the subset of identified entities; and based on the similarity, classifying individual entities of the subset of entities as belonging to one or more similarity subgroups, each similarity subgroup comprising entities having a probability of participating in a same DDoS.
13. A computer implemented method for training a classifier for classifying entities to determine whether the entities are part of a distributed denial of service (DDoS) attack, the method comprising: training a classifier to use a first classification method to identify probabilities that entities are performing denial of service attacks, the training comprising applying a captured dataset including data flow protocol information associated with known DDoS attacks; using the trained classifier, identifying a subset of entities from a set of candidate entities that meet or exceed a threshold probability of performing a denial of service attack; using a second classification method, identifying similarity of entities in the subset of identified entities; and based on the similarity, classifying individual entities of the subset of entities as belonging to one or more similarity subgroups, each similarity subgroup comprising entities having a probability of participating in a same DDoS. 17. The method of claim 13 , further comprising identifying entities in a particular botnet based on similarity.