Systems and methods for identifying security threat sources responsible for security events

Abstract

The disclosed computer-implemented method for identifying security threat sources responsible for security events may include (1) identifying security-event data collected from a plurality of security events detected over a network, (2) partitioning the security-event data into a set of single-dimensional security clusters, each grouped by a common feature, (3) determining that a subset of the single-dimensional security clusters exceed a threshold level of similarity relative to one another, (4) grouping the subset of single-dimensional clusters into a multi-dimensional security cluster corresponding to a single threat source in response to determining that the subset of single-dimensional clusters exceed the threshold level of similarity relative to one another, and then (5) determining, based at least in part on grouping the single-dimensional clusters into the multi-dimensional cluster, that the single threat source is likely responsible for some of the security events. Various other methods, systems, and computer-readable media are also disclosed.