a computer implemented method detects intrusions using a computer by analysing network traffic . the method includes a semi - supervised learning module connected to a network node . the learning module uses labeled and unlabeled data to train a semi - supervised machine learning sensor . the method records events that include a feature set made up of unauthorized intrusions and benign computer requests . the method identifies at least some of the benign computer requests that occur during the recording of the events while treating the remainder of the data as unlabeled . the method trains the semi - supervised learning module at the network node in - situ , such that the semi - supervised learning modules may identify malicious traffic without relying on specific rules , signatures , or anomaly detection .