Abstract: A method includes obtaining session data related to a plurality of network sessions, analyzing the session data to identify one or more features of the network sessions, and utilizing the one or more features to aggregate the plurality of network sessions into a plurality of meta-sessions. A meta-session comprises a set of network sessions having similar features. The method also includes selecting a classifier for ranking the meta-sessions based on a scoring function that characterizes performance in ranking meta-sessions having a designated characteristic, ranking the meta-sessions utilizing the selected classifier, providing a designated number of the ranked meta-sessions for additional processing to determine potential maliciousness, and modifying access by client devices to an additional network session responsive to the additional network session comprising session data with features similar to those of one of the designated number of the ranked meta-sessions determined to be potentially malicious.