A system that detects malicious traffic flows in a network includes a computer system including a processor in communication with at least one memory device. The processor is programmed to store a plurality of context information about the network including a plurality of devices. The processor is also programmed to determine a network configuration of the network at a specific point in time. The processor is further programmed to generate one or more security policies for one or more devices of the plurality of devices in the network based on the network configuration and the plurality of context information. In addition, the processor is programmed to deploy the one or more security policies to the one or more devices in the network, wherein the one or more devices are configured to execute an algorithm to monitor communications on the network in view of a corresponding security policy of the one or more security policies.