9. A computer-implemented method for securing compromised network devices in a network, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: (a) identifying a Positive Unlabeled (PU) machine learning classifier; (b) selecting labeled positive samples and unlabeled positive and negative samples as a bootstrap subset of training data from a set of training data, the set of training data comprising fewer labeled positive samples than unlabeled positive and negative samples; (c) training the PU machine learning classifier with the bootstrap subset of training data; (d) repeating (a)-(c) one or more times to create a set of trained PU machine learning classifiers, with each iteration of (b) comprising selecting a different bootstrap subset of training data from the same set of training data; (e) predicting probabilities that a network device in a network has been compromised using each of the trained PU machine learning classifiers in the set of trained PU machine learning classifiers; (f) combining the probabilities predicted at (e) to generate a combined risk score for the network device; (g) repeating (e)-(f) one or more times to create a ranked list of combined risk scores; and (h) performing a security action on one or more of the network devices in the ranked list.
9. A computer-implemented method for securing compromised network devices in a network, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: (a) identifying a Positive Unlabeled (PU) machine learning classifier; (b) selecting labeled positive samples and unlabeled positive and negative samples as a bootstrap subset of training data from a set of training data, the set of training data comprising fewer labeled positive samples than unlabeled positive and negative samples; (c) training the PU machine learning classifier with the bootstrap subset of training data; (d) repeating (a)-(c) one or more times to create a set of trained PU machine learning classifiers, with each iteration of (b) comprising selecting a different bootstrap subset of training data from the same set of training data; (e) predicting probabilities that a network device in a network has been compromised using each of the trained PU machine learning classifiers in the set of trained PU machine learning classifiers; (f) combining the probabilities predicted at (e) to generate a combined risk score for the network device; (g) repeating (e)-(f) one or more times to create a ranked list of combined risk scores; and (h) performing a security action on one or more of the network devices in the ranked list. 14. The method of claim 9 , wherein (f) comprises combining the probabilities predicted at (e) by assigning each of the probabilities to a category and identifying the most frequent category as the combined risk score for the network device.