A method for automated computer security policy generation and anomaly detection includes receiving first network traffic data via an input port. The first network traffic data includes multiple data packets. A representation of each of the data packets is stored in a first data store, to produce a set of training data. A set of communication protocols associated with the set of training data is detected, and the training data from the set of training data is restructured based on the set of communication protocols, to produce processed data. The processed data is stored as non-malicious data in a second data store. The first network traffic data is transmitted, in unmodified form, via an output port. Second network traffic data including multiple data packets is subsequently received, via the input port, and compared to the non-malicious data to detect an anomaly in the second network traffic data.