15. A system that detects intrusions using a computer by analysing network traffic, comprising: a network node; a semi-supervised learning module coupled to the network node that uses labeled and unlabeled data to train a semi-supervised machine learning sensor; a recorder that records events that comprise a feature set that include unauthorized intrusions and benign requests; and a computer readable medium programmed to: identify at least some of benign behavior that occurs during the recording of the events while treating the remainder of the data as unlabeled; and train the semi-supervised learning module at the network node in-situ, such that the system including the semi-supervised learning module is configured to identify malicious traffic without relying on specific rules, signatures, or anomaly detection; where the semi-supervised machine learning sensor comprises an extension of a plurality of pipelines and filters and the feature set is stored in at least one of the plurality of pipelines that the semi-supervised learning module is trained.
16. The system of claim 15 where the semi-supervised machine learning sensor is configured to transmit an alert when a threshold is exceeded.