A method for monitoring network activity includes initiating a training phase by a machine learning (ML) server. Data associated with normal network traffic through the ML server during the training phase is collected. A classification model is generated based on the collected data. The ML server switches the training phase to an active phase. An outbound request is received during the active phase. Whether the outbound request is an anomalous request is determined based on the classification model.