1. A computer-implemented method for processing streams of information security data from one or more networked computer systems, the method comprising: receiving at least one ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network; processing, via a neuro-linguistic model, the at least one ordered stream of normalized vectors, the neuro-linguistic model including a plurality of letters, a dictionary of words, and a plurality of phrases; generating, via the neuro-linguistic model, an ordered sequence of letters based on the at least one ordered stream of normalized vectors, an ordered stream of words based on the ordered sequence of letters, and at least one phrase based on the ordered stream of words; dynamically updating the plurality of letters, the dictionary of words, and the plurality of phrases based on the generated ordered sequence of letters, the ordered stream of words, and the at least one phrase; evaluating at least one of the updated plurality of letters, dictionary of words, and plurality of phrases to determine an unusualness score; and publishing an alert based on the unusualness score, the alert indicating malicious activity associated with the information security data.
1. A computer-implemented method for processing streams of information security data from one or more networked computer systems, the method comprising: receiving at least one ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network; processing, via a neuro-linguistic model, the at least one ordered stream of normalized vectors, the neuro-linguistic model including a plurality of letters, a dictionary of words, and a plurality of phrases; generating, via the neuro-linguistic model, an ordered sequence of letters based on the at least one ordered stream of normalized vectors, an ordered stream of words based on the ordered sequence of letters, and at least one phrase based on the ordered stream of words; dynamically updating the plurality of letters, the dictionary of words, and the plurality of phrases based on the generated ordered sequence of letters, the ordered stream of words, and the at least one phrase; evaluating at least one of the updated plurality of letters, dictionary of words, and plurality of phrases to determine an unusualness score; and publishing an alert based on the unusualness score, the alert indicating malicious activity associated with the information security data. 4. The method of claim 1 , wherein the each value of the information security data associated with the at least one ordered stream of normalized vectors is normalized to a value within a range of 0 to 1, inclusive.