A system for protecting against amplification attacks, the system comprising: a data store; an appliance coupled to the data store, wherein the appliance is configured to: collect a plurality of samples of IPFIX data; use the IPFIX data to create a plurality of time-based, server samples on a per server basis such that each server sample corresponds to a server and a period of time over which IPFIX data in the sample corresponds; identify a first plurality of the server samples that are labeled positive for amplification attacks indicating that the first plurality of the server samples are associated with amplification attacks; identify a second plurality of server samples that are labeled negative for amplification attacks indicating that the second plurality of the server samples are not associated with amplification attacks; and automatically label at least some of the remaining server samples as positive or negative based on the previously identified labeled samples, by using the previously identified labeled samples to predict, with confidence above a predetermined threshold, that the at least some of the remaining server samples should be labeled as positive or negative; and a protection system configured to be trained using the automatically labeled samples and use the automatically labeled samples to identify and protect against amplification attacks. a data store; an appliance coupled to the data store, wherein the appliance is configured to: collect a plurality of samples of IPFIX data; use the IPFIX data to create a plurality of time-based, server samples on a per server basis such that each server sample corresponds to a server and a period of time over which IPFIX data in the sample corresponds; identify a first plurality of the server samples that are labeled positive for amplification attacks indicating that the first plurality of the server samples are associated with amplification attacks; identify a second plurality of server samples that are labeled negative for amplification attacks indicating that the second plurality of the server samples are not associated with amplification attacks; and automatically label at least some of the remaining server samples as positive or negative based on the previously identified labeled samples, by using the previously identified labeled samples to predict, with confidence above a predetermined threshold, that the at least some of the remaining server samples should be labeled as positive or negative; and collect a plurality of samples of IPFIX data; use the IPFIX data to create a plurality of time-based, server samples on a per server basis such that each server sample corresponds to a server and a period of time over which IPFIX data in the sample corresponds; identify a first plurality of the server samples that are labeled positive for amplification attacks indicating that the first plurality of the server samples are associated with amplification attacks; identify a second plurality of server samples that are labeled negative for amplification attacks indicating that the second plurality of the server samples are not associated with amplification attacks; and automatically label at least some of the remaining server samples as positive or negative based on the previously identified labeled samples, by using the previously identified labeled samples to predict, with confidence above a predetermined threshold, that the at least some of the remaining server samples should be labeled as positive or negative; and a protection system configured to be trained using the automatically labeled samples and use the automatically labeled samples to identify and protect against amplification attacks.