Systems and methods are provided for implementing pattern detection as a first step for security improvements of a computer network. The pattern detection may utilize a machine learning (ML) model for predicting network tuple parameters. The ML model can be trained on labelled data flow information and deployed by a central server for preventing network-wide cyber-security challenges (e.g., including DNS flux, etc.). Networking devices (e.g. switches, etc.) can monitor the data flow traffic that it receives from the networking devices and classify network tuple parameters based on the flow behavior. The system can compare the output of the ML model (e.g., a classification of the data flow traffic, etc.) to an implicit label (e.g., the network tuple parameter included with the data flow traffic, etc.). When the classification matches a particular network tuple parameter, the system can generate an alert and/or otherwise identify potential network intrusions and other abnormalities.