7. A non-transitory computer-readable storage medium storing computer-executable instructions, which, when executed on a processor, performs an operation for processing streams of data of one or more networked computer systems, the computer-executable instruction comprising instructions to: receive at least one ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network; process, via a neuro-linguistic model, the at least one ordered stream of normalized vectors, the neuro-linguistic model including a plurality of letters, a dictionary of words, and a plurality of phrases; generate, via the neuro-linguistic model, an ordered sequence of letters based on the at least one ordered stream of normalized vectors, an ordered stream of words based on the ordered sequence of letters, and at least one phrase based on the ordered stream of words; dynamically update the plurality of letters, the dictionary of words, and the plurality of phrases based on the generated ordered sequence of letters, the ordered stream of words, and the at least one phrase; evaluate at least one of the updated plurality of letters, dictionary of words, and plurality of phrases to determine an unusualness score; and publish an alert based on the unusualness score, the alert indicative of malicious activity.
7. A non-transitory computer-readable storage medium storing computer-executable instructions, which, when executed on a processor, performs an operation for processing streams of data of one or more networked computer systems, the computer-executable instruction comprising instructions to: receive at least one ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network; process, via a neuro-linguistic model, the at least one ordered stream of normalized vectors, the neuro-linguistic model including a plurality of letters, a dictionary of words, and a plurality of phrases; generate, via the neuro-linguistic model, an ordered sequence of letters based on the at least one ordered stream of normalized vectors, an ordered stream of words based on the ordered sequence of letters, and at least one phrase based on the ordered stream of words; dynamically update the plurality of letters, the dictionary of words, and the plurality of phrases based on the generated ordered sequence of letters, the ordered stream of words, and the at least one phrase; evaluate at least one of the updated plurality of letters, dictionary of words, and plurality of phrases to determine an unusualness score; and publish an alert based on the unusualness score, the alert indicative of malicious activity. 11. The non-transitory computer-readable storage medium of claim 7 , wherein the information security data comprises network packet traffic information, disk mount event information, or security log data.