Abstract: Generally discussed herein are devices, systems, and methods for improving legacy cyber security solutions. A method can include receiving a sequence of traffic data, the sequence of traffic data representing operations performed by devices communicatively coupled in a network, generating, by cyber security event detection logic, actions corresponding to the sequence of traffic data, the actions corresponding to a cyber security event in the network, creating a training dataset based on the sequence of traffic data, the training dataset including the actions as labels, training a machine learning model based on the training dataset to generate a classification indicating a likelihood of the cyber security event, and distributing the trained machine learning model in place of the cyber security event detection logic.

Abstract: Generally discussed herein are devices, systems, and methods for improving computer resource security. A method can include receiving a computer activity log detailing activities of users in a computer network. The method can include identifying activities of the activities in the computer activity log that include a specified user identification (ID) value. The method can include mapping each of the identified activities to a predicate group of predicate groups and a subject group of subject groups. The method can include generating a behavior profile for a user associated with the user ID, the behavior profile including, for each activity the predicate group and the subject group to which the activity mapped in place of a description and action of the activity. The method can include based on the generated behavior profile, monitoring the computer network for malicious activity.

Abstract: Generally discussed herein are devices, systems, and methods for cloud traffic monitoring. A method can include receiving sampled network metadata of a packet transmitted via a computer network, providing the sampled network metadata to a neural network (NN) trained on labeled sampled network metadata, and providing, based on only the sampled network metadata, a classification for the sampled network metadata via the trained neural network.