Cyber-threat analyses using machine learning and prior observations

A cyber-security analysis method, comprising:

• receiving, at a compute device, a representation of a first threat indicator and an associated classification of the first threat indicator;
• identifying, via the compute device and based on the classification of the first threat indicator, at least one vote from a source;
• executing a trained machine-learning (ML) model to generate, via the compute device, a cyber-threat score for the first threat indicator based on (1) the at least one vote associated with the first threat indicator, and (2) at least one vote associated with a prior observation of a second threat indicator having a functional or operational relationship to the first threat indicator;
• detecting, via the compute device, data drift of the trained ML model based on the cyber-threat score and the at least one vote;
• and
• retraining, via the compute device, the trained ML model based on a comparison of the data drift to a predetermined threshold;
• and
• in response to a plurality of sources failing to provide sufficient vote information associated with the first threat indicator, searching for the second threat indicator in one or more administrative domains that encompass the first threat indicator to gather at least one additional vote.