Keystroke log monitoring systems

An apparatus comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
• receive a plurality of keystroke logs;
• generating, for each of the plurality of keystroke logs, one or more respective tokens;
• provide, to a machine learning model, one or more tokens of a first keystroke log of the plurality of keystroke logs;
• receive, as output from the machine learning model, a value representing a likelihood that the first keystroke log comprises a first command to change a computing system, wherein the value is based the one or more tokens of the first keystroke log, and wherein the likelihood is lower than one hundred percent;
• and
• send, to a second computing device and based on the first command to change the computing system not matching one or more change orders that authorize changing of the computing system, an alert indicating the first keystroke log.

One or more non-transitory computer-readable media storing instructions that, when executed, cause performance of actions comprising:

• receiving a plurality of keystroke logs;
• generating, for each of the plurality of keystroke logs, one or more respective tokens;
• providing, to a machine learning model, one or more tokens of a first keystroke log of the plurality of keystroke logs;
• receiving, as output from the machine learning model, a value representing a likelihood that the first keystroke log comprises a first command to change a computing system, wherein the value is based the one or more tokens of the first keystroke log, and wherein the likelihood is lower than one hundred percent;
• and
• sending, to a computing device and based on the first command to change the computing system not matching one or more change orders that authorize changing of the computing system, an alert indicating the first keystroke log.