1. A computer implemented method that detects intrusions using a computer by analysing network traffic comprising: coupling a semi-supervised learning module to a network node that uses labeled and unlabeled data to train a semi-supervised machine learning sensor; recording events that comprise a feature set that include unauthorized intrusions and benign requests; identifying at least some of the benign behavior that occurs during the recording of the events while treating the remainder of the data as unlabeled; and training the semi-supervised learning module at the network node in-situ, such that the computer implemented method including the semi-supervised learning module is configured to identify the malicious traffic without relying on specific rules, signatures, or an anomaly detection; where the semi-supervised machine learning sensor comprises an extension of a plurality of pipelines and filters and the feature set is stored in one of the plurality of pipelines that the semi-supervised learning module is trained.