15. One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform a method comprising: (a) identifying a Positive Unlabeled (PU) machine learning classifier; (b) selecting labeled positive samples and unlabeled positive and negative samples as a bootstrap subset of training data from a set of training data; (c) training the PU machine learning classifier with the bootstrap subset of training data; (d) repeating (a)-(c) one or more times to create a set of trained PU machine learning classifiers; (e) predicting probabilities that a network device in a network has been compromised using each of the trained PU machine learning classifiers in the set of trained PU machine learning classifiers; (f) combining the probabilities predicted at (e) to generate a combined risk score for the network device; (g) repeating (e)-(f) one or more times to create a ranked list of combined risk scores; and (h) performing a security action on one or more of the network devices in the ranked list.
15. One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform a method comprising: (a) identifying a Positive Unlabeled (PU) machine learning classifier; (b) selecting labeled positive samples and unlabeled positive and negative samples as a bootstrap subset of training data from a set of training data; (c) training the PU machine learning classifier with the bootstrap subset of training data; (d) repeating (a)-(c) one or more times to create a set of trained PU machine learning classifiers; (e) predicting probabilities that a network device in a network has been compromised using each of the trained PU machine learning classifiers in the set of trained PU machine learning classifiers; (f) combining the probabilities predicted at (e) to generate a combined risk score for the network device; (g) repeating (e)-(f) one or more times to create a ranked list of combined risk scores; and (h) performing a security action on one or more of the network devices in the ranked list. 17. The one or more non-transitory computer-readable media of claim 15 , wherein (f) further comprises calibrating the combined risk score into a scale for display to a user.