A data processing method, performed by one or more processors of a computing device for creating and storing clusters of incident data records based on behavioral characteristic values in the incident data records and origin characteristic values in the incident data records, the method comprising: receiving a plurality of input incident data records comprising sets of computer network attribute values determined based upon a plurality of incidents that have occurred in one or more computer networks; wherein an incident data record of the plurality of input incident data records comprises at least one or more behavioral characteristic values, a severity level value, and a confidence score value; identifying two or more first incident data records in said input incident data records that have a particular behavioral characteristic value stored in all of the two or more first incident data records; using a malicious incident behavioral data table stored in a data storage device that maps sets of behavioral characteristic values to identifiers of malicious acts in the one or more computer networks, and a plurality of comparison operations using the malicious incident behavioral data table and the two or more first incident data records, determining (930, 940) whether any of the two or more first incident data records has been identified as malicious; and in response to determining that a first incident data record, from the two or more first incident data records, has been identified as malicious: creating (960, 970) and storing in a computer memory a similarity behavioral cluster record that includes the two or more first incident data records; modifying severity level values that are stored in each of the two or more first incident data records by increasing the severity level values by a first value; modifying confidence score values that are stored in each of the two or more first incident data records by increasing the confidence score values by a second value. receiving a plurality of input incident data records comprising sets of computer network attribute values determined based upon a plurality of incidents that have occurred in one or more computer networks; wherein an incident data record of the plurality of input incident data records comprises at least one or more behavioral characteristic values, a severity level value, and a confidence score value; identifying two or more first incident data records in said input incident data records that have a particular behavioral characteristic value stored in all of the two or more first incident data records; using a malicious incident behavioral data table stored in a data storage device that maps sets of behavioral characteristic values to identifiers of malicious acts in the one or more computer networks, and a plurality of comparison operations using the malicious incident behavioral data table and the two or more first incident data records, determining (930, 940) whether any of the two or more first incident data records has been identified as malicious; and in response to determining that a first incident data record, from the two or more first incident data records, has been identified as malicious: creating (960, 970) and storing in a computer memory a similarity behavioral cluster record that includes the two or more first incident data records; modifying severity level values that are stored in each of the two or more first incident data records by increasing the severity level values by a first value; modifying confidence score values that are stored in each of the two or more first incident data records by increasing the confidence score values by a second value. creating (960, 970) and storing in a computer memory a similarity behavioral cluster record that includes the two or more first incident data records; modifying severity level values that are stored in each of the two or more first incident data records by increasing the severity level values by a first value; modifying confidence score values that are stored in each of the two or more first incident data records by increasing the confidence score values by a second value.