A system for detecting a non-targeted attack by a first machine on a second machine, wherein the second machine is implemented in a server computer of a service provider, the system comprising: a processor; a memory; and an application stored in the memory and including instructions, which are executable by the processor and that are configured to: extracting network data corresponding to traffic flow between the first machine and the second machine, wherein the second machine is implemented in a cloud-based network, determining a first suspect external Internet protocol address based on the network data, calculating a plurality of features for the first suspect external Internet protocol address, wherein the plurality of features include exploration type features and exploitation type features, classifying the first suspect external Internet protocol address based on a model and at least some of the plurality of features, wherein the model is based on predetermined examples, and wherein each of the predetermined examples has a respective set of features, and performing a countermeasure if classification of the suspect Internet protocol address indicates that the suspect Internet protocol address is associated with a malicious attack on the second machine, wherein the instructions are further configured to: train a classifier based on the predetermined examples and the plurality of features to generate and update the model; and subsequent to training the classifier, classifying the first suspect external Internet protocol address based on the model and at least some of the plurality of features. a processor; a memory; and an application stored in the memory and including instructions, which are executable by the processor and that are configured to: extracting network data corresponding to traffic flow between the first machine and the second machine, wherein the second machine is implemented in a cloud-based network, determining a first suspect external Internet protocol address based on the network data, calculating a plurality of features for the first suspect external Internet protocol address, wherein the plurality of features include exploration type features and exploitation type features, classifying the first suspect external Internet protocol address based on a model and at least some of the plurality of features, wherein the model is based on predetermined examples, and wherein each of the predetermined examples has a respective set of features, and extracting network data corresponding to traffic flow between the first machine and the second machine, wherein the second machine is implemented in a cloud-based network, determining a first suspect external Internet protocol address based on the network data, calculating a plurality of features for the first suspect external Internet protocol address, wherein the plurality of features include exploration type features and exploitation type features, classifying the first suspect external Internet protocol address based on a model and at least some of the plurality of features, wherein the model is based on predetermined examples, and wherein each of the predetermined examples has a respective set of features, and performing a countermeasure if classification of the suspect Internet protocol address indicates that the suspect Internet protocol address is associated with a malicious attack on the second machine, wherein the instructions are further configured to: train a classifier based on the predetermined examples and the plurality of features to generate and update the model; and subsequent to training the classifier, classifying the first suspect external Internet protocol address based on the model and at least some of the plurality of features. train a classifier based on the predetermined examples and the plurality of features to generate and update the model; and subsequent to training the classifier, classifying the first suspect external Internet protocol address based on the model and at least some of the plurality of features.