1. A method comprising: receiving, by a security device and from a device, network traffic directed to one or more computing devices protected by the security device; responsive to receiving the network traffic, sending, by the security device and to the device, a request for a plurality of data points for the device, wherein the data points include characteristics associated with the device; receiving, by the security device and from the device, at least a portion of the requested plurality of data points; comparing, by the security device, the received portion of the requested plurality of data points to respective sets of data points associated with one or more known attacker devices; determining, based on the comparison, whether a first respective set of data points associated with a first known attacker device satisfies a similarity threshold; and selectively manage, based on the determination, additional network traffic directed to the one or more computing devices protected by the security device and received from the device.