1. A computer implemented method that detects intrusions using a computer by analysing network traffic comprising: coupling a semi-supervised learning module to a network node that uses labeled and unlabeled data to train a semi-supervised machine learning sensor; recording events that comprise a feature set that include unauthorized intrusions and benign requests; identifying at least some of the benign behavior that occurs during the recording of the events while treating the remainder of the data as unlabeled; and training the semi-supervised learning module at the network node in-situ, such that the computer implemented method including the semi-supervised learning module is configured to identify the malicious traffic without relying on specific rules, signatures, or an anomaly detection; where the semi-supervised machine learning sensor comprises an extension of a plurality of pipelines and filters and the feature set is stored in one of the plurality of pipelines that the semi-supervised learning module is trained.
1. A computer implemented method that detects intrusions using a computer by analysing network traffic comprising: coupling a semi-supervised learning module to a network node that uses labeled and unlabeled data to train a semi-supervised machine learning sensor; recording events that comprise a feature set that include unauthorized intrusions and benign requests; identifying at least some of the benign behavior that occurs during the recording of the events while treating the remainder of the data as unlabeled; and training the semi-supervised learning module at the network node in-situ, such that the computer implemented method including the semi-supervised learning module is configured to identify the malicious traffic without relying on specific rules, signatures, or an anomaly detection; where the semi-supervised machine learning sensor comprises an extension of a plurality of pipelines and filters and the feature set is stored in one of the plurality of pipelines that the semi-supervised learning module is trained. 4. The computer method of claim 1 where the feature set comprises data that identifies the time the data was received, the source and destination IP addresses, and the source and destination ports of the data seeking unauthorized intrusions.