System and methods for automated computer security policy generation and anomaly detection

A method comprising:

• receiving first network traffic data including a first plurality of data packets;
• storing a representation of each data packet from the first plurality of data packets in a first data store, to produce a set of training data;
• detecting a plurality of communication protocols associated with the set of training data;
• determining a set of rules based on the plurality of communication protocols, wherein the set of rules includes domain-specific information associated with each communication protocol detected;
• restructuring training data from the set of training data according to the set of rules, to produce processed data;
• storing the processed data, as non-malicious data, in a second data store;
• and
• performing anomaly detection based on the processed data.

A method, comprising:

• receiving first network traffic data including a plurality of data packets;
• storing a representation of each data packet from the plurality of data packets in a first data store, to produce a set of training data;
• detecting a plurality of communication protocols associated with the set of training data;
• determining a set of rules based on the plurality of communication protocols, wherein the set of rules includes domain-specific information associated with each communication protocol detected;
• restructuring training data from the set of training data according to the set of rules based on the detected plurality of communication protocols, to produce processed data;
• storing the processed data, as non-malicious data, in a second data store;
• and
• modifying the restructured data.