Apparatuses, methods and storage medium associated with techniques to identify suspicious network connections. In embodiments, an apparatus may include an analysis function to be operated by the one or more processors to receive a collection of network data records, and apply a latent factor model to the network data records to identify a subset of the network data records as suspicious network connections. Other embodiments may be disclosed or claimed.