1. A computer-implemented method for performing network intrusion detection in a computer network having multiple computing devices, the method comprising: receiving logon session data related to activities performed related to an authorized account during a logon session on a computing device in the computer network, the logon session data including data representing security events triggered during the logon session in response to the authorized account accessing a computing device in the computer network; deriving multiple probabilities of intrusion related to the logon session based on a comparison of the logon session data with distinct combinations of security event variables and a historical occurrence value of the individual distinct combinations of the security event variables, the individual probabilities of intrusion indicating whether one or more security events related to the logon session are indicative of a compromised behavior; and indicating at least one of the authorized account or the computing device of the computer network corresponding to the logon session as comprised based on a combination of the derived multiple probabilities of intrusion related to the logon session.