Systems and methods are provided for receiving a set of feature vectors. Each feature vector in the set may comprise feature values for a plurality of features associated with network communications. A first score for a first subset of the feature vectors that have at least one common feature value for a first feature of the plurality of features may be determined. A second score for a second subset of the feature vectors may be determined. The second subset may comprise the first subset and other feature vectors that have a different feature value for the first feature. Based on a change between the first score and the second score, whether to group the common feature value and the different feature value together may be determined.