1. A computer implemented method that detects intrusions using a computer by analysing network traffic: coupling a semi-supervised learning module to a network node that uses labeled an unlabeled data to train a semi-supervised machine learning sensor; recording events that comprise a feature set that include unauthorized intrusions and benign requests; identifying at least some of the benign behavior that occurs during the recording of the events while treating the remainder of the data as unlabeled; and training the semi-supervised learning module at the network node in-situ, such that the semi-supervised learning modules may identify malicious traffic without relying on specific rules, signatures, or an anomaly detection.