Multi-dimensional drift nuance intelligence threat engine

1. A system, comprising:

a non-transitory memory; and

one or more hardware processors coupled with the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:

assigning weights to first collective characteristics of a group of risk sources;

comparing first attributes of a first risk source from the group of risk sources against the first collective characteristics of the group of risk sources, wherein the first risk source comprises a network address;

classifying, based on (i) the comparing the first attributes of the first risk source against the first collective characteristics and (ii) the weights of the first collective characteristics, the first risk source according to a first risk level;

adding a second risk source to the group of risk sources;

adjusting the first collective characteristics of the group of risk sources based on the second risk source;

comparing, in response to the adjusting, the first attributes of the first risk source against the adjusted first collective characteristics of the group of risk sources;

reclassifying, based on (i) the comparing the first attributes of the first risk source against the adjusted first collective characteristics, the first risk source according to a second risk level; and

denying an electronic request associated with the first risk source based on the reclassifying of the first risk source according to the second risk level.

2. The system of claim 1 , wherein the operations further comprise:

generating, from the group of risk sources, first clusters of risk sources using a clustering algorithm; and

deriving the first collective characteristics of the group based on the first clusters of risk sources.

3. The system of claim 2 , wherein the operations further comprise:

subsequent to adding the second risk source to the group of risk source, generating, from the group of risk sources comprising the second risk source, second clusters of risk sources using the clustering algorithm; and

deriving the adjusted first collective characteristics of the group based on the second clusters of risk sources.

4. The system of claim 1 , wherein the operations further comprise:

identifying, from the group of risk sources, a first sub-group of risk sources classified according to the second risk level;

extracting a common attribute among the risk sources in the first sub-group of risk sources;

receiving a second electronic request from a third risk source;

comparing an attribute of the third risk source against the extracted common attribute; and

assessing a risk level of the second electronic request based on the comparing the attribute of the third risk source against the extracted common attribute.

5. The system of claim 4 , wherein the first attributes are associated with a first set of attribute types, and wherein the extracted common attribute is associated with a second attribute type not included in the first set of attribute types.

6. The system of claim 1 , wherein the assigning the weights to the first collective characteristics comprises assigning a higher weight to a first collective characteristic that is more indicative to a risk level of the group of risk sources and assigning a lower weight to a second collective characteristic that is less indicative to a risk level of the group of risk sources.

7. The system of claim 1 , wherein the operations further comprise in response to adjusting the first collective characteristics of the group of risk sources, reclassifying a third risk source from the second risk level to the first risk level by comparing second attributes of the third risk source against the adjusted collective characteristics of the group of risk sources.

8. A method comprising:

deriving, by one or more hardware processors for a group of risk sources comprising a first risk source, collective characteristics based on attributes of each risk source in the group of risk sources, wherein the first risk source corresponds to a first network address;

accessing, by the one or more hardware processors, weights for the collective characteristics;

assigning, by the one or more hardware processors, a first risk level from a plurality of risk levels to the first risk source based on (i) comparing first attributes of the first risk source against the collective characteristics of the group of risk sources and (ii) the weights of the collective characteristics;

adding, by the one or more hardware processors, a second risk source to the group of classified risk sources;

adjusting, by the one or more hardware processors, the collective characteristics of the group of risk sources based at least in part on second attributes of the second risk source;

in response to adjusting the collective characteristics of the group of risk sources, reassigning, by the one or more hardware processors, a second risk level from the plurality of risk levels to the first risk source based on a comparison of the first attributes of the first risk source against the adjusted collective characteristics of the group of risk sources, wherein the second risk level is different from the first risk level; and

denying an electronic request corresponding to the first risk source based on the reassigning the second risk level to the first risk source.

9. The method of claim 8 , wherein the deriving the collective characteristics comprises:

performing a clustering algorithm on the attributes of each risk source in the group of risk sources; and

determining a plurality of centroids within a clustering space based on the performing the clustering algorithm, wherein the plurality of centroids comprises a first centroid corresponding to the first risk level and a second centroid corresponding to the second risk level.

10. The method of claim 9 , wherein the adjusting the collective characteristics comprises moving the second centroid within the clustering space.

11. The method of claim 10 , further comprising:

identifying, from the group of risk sources, a first sub-group of risk sources that have moved toward the second centroid by a predetermined percentage;

extracting a common attribute among the risk sources in the first sub-group of risk sources; and

configuring a risk engine based on the extracted common attribute.

12. The method of claim 11 , wherein the configuring the risk engine comprises instructing the risk engine to block network connection requests from a risk source associated with the common attribute.

13. The method of claim 11 , wherein the first network address is an Internet Protocol (IP) address, and wherein the extracted common attribute comprises a Classless Inter-Domain Routing (CIDR) range or an autonomous system number (ASN).

14. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

accessing weights to first collective characteristics of a group of risk sources;

classifying a first risk source, from the group of risk sources, according to a first risk level based on (i) comparing first attributes of the first risk source against the first collective characteristics of the group of risk sources and (ii) the weights of the first collective characteristics;

adding a second risk source to the group of risk sources;

adjusting the first collective characteristics of the group of risk sources based on an addition of the second risk source in the group;

in response to adjusting the first collective characteristics of the group of risk sources, reclassifying the first risk source according to a second risk level based on a comparison of the first attributes of the first risk source against the adjusted collective characteristics of the group of risk sources; and

denying an electronic request corresponding to the first risk source based on the reclassifying of the first risk source according to the second risk level.

15. The non-transitory machine-readable medium of claim 14 , wherein the operations further comprise:

generating, from the group of risk sources, first clusters of risk sources using a clustering algorithm; and

deriving the first collective characteristics of the group of the risk sources based on the first clusters of risk sources.

16. The non-transitory machine-readable medium of claim 15 , wherein the operations further comprise:

subsequent to adding the second risk source to the group of risk sources, generating, from the group of risk sources comprising the second risk source, second clusters of risk sources using the clustering algorithm; and

deriving the adjusted first characteristics of the group of risk sources based on the second clusters of risk sources.

17. The non-transitory machine-readable medium of claim 15 , wherein the deriving the first collective characteristics comprises:

performing a clustering algorithm on attributes of each risk source in the group of risk sources; and

determining a plurality of centroids within a clustering space based on the performing the clustering algorithm, wherein the plurality of centroids comprises a first centroid corresponding to the first risk level and a second centroid corresponding to the second risk level, wherein the adjusting the first collective characteristics comprises moving the second centroid within the clustering space.

18. The non-transitory machine-readable medium of claim 14 , wherein the operations further comprise:

identifying, from the group of risk sources, a first sub-group of risk sources classified according to the second risk level;

extracting a common attribute among the risk sources in the first sub-group of risk sources; and

in response to receiving a second electronic request from a third risk source, assessing a risk level of the second electronic request by comparing an attribute of the third risk source against the extracted common attribute.

19. The non-transitory machine-readable medium of claim 18 , wherein the first attributes are associated with a first set of attribute types, and wherein the extracted common attribute is associated with a second attribute type not included in the first set of attribute types.

20. The non-transitory machine-readable medium of claim 14 , wherein the operations further comprise in response to adjusting the first collective characteristics of the group of risk sources, reclassifying a third risk source from the second risk level to the first risk level by comparing second attributes of the third risk source against the adjusted collective characteristics of the group of risk sources.