Clustering computer security attacks by threat actor based on attack features

A system, comprising:

• a memory;
• and
• at least one processing device, coupled to the memory, operative to:
• obtain attack data for a given computer security attack;
• extract a plurality of features of said given computer security attack from a plurality of attributes of said given computer security attack collected from a plurality of attack attribute sources;
• compute, using at least one processing device, a feature-based score for said given computer security attack based on said extracted features of said given computer security attack relative to each of a plurality of attack clusters, wherein each attack cluster is comprised of a plurality of attacks performed by a particular attacker;
• assign, using said at least one processing device, said given computer security attack to a given attack cluster if said feature-based score for said given computer security attack satisfies one or more predefined score criteria such that said plurality of attack clusters comprises substantially only said plurality of attacks performed by said corresponding particular attacker;
• and
• provide, using said at least one processing device, said plurality of attack clusters each substantially comprised of said plurality of attacks performed by said particular attacker.

An article of manufacture comprising a non-transitory machine readable recordable medium containing one or more programs which when executed by at least one processing device implement the steps of:

• obtaining attack data for a given computer security attack;
• extracting a plurality of features of said given computer security attack from a plurality of attributes of said given computer security attack collected from a plurality of attack attribute sources;
• computing, using at least one processing device, a feature-based score for said given computer security attack based on said extracted features of said given computer security attack relative to each of a plurality of attack clusters, wherein each attack cluster is comprised of a plurality of attacks performed by a particular attacker;
• assigning, using said at least one processing device, said given computer security attack to a given attack cluster if said feature-based score for said given computer security attack satisfies one or more predefined score criteria such that said plurality of attack clusters comprises substantially only said plurality of attacks performed by said corresponding particular attacker;
• and
• providing, using said at least one processing device, said plurality of attack clusters each substantially comprised of said plurality of attacks performed by said particular attacker.