1. A system, comprising: a processor configured to: identify a plurality of communication events between a dynamically assigned address and an external destination; determine that the dynamically assigned address maps to a statically assigned address associated with an internal device; generate a conversation between the internal device and the external destination based at least in part on the plurality of communication events; extract feature sets based at least in part on the conversation between the internal device and the external destination; and determine whether the conversation between the internal device and the external destination is anomalous based at least in part on the extracted feature sets; and a memory coupled to the processor and configured to store the extracted feature sets.