A method for reducing storage space used in tracking behavior of a plurality of network endpoints (112, 114) by modeling the behavior with a behavior model, the method comprising: receiving a plurality of records, each respective record of the plurality of records corresponding to a respective network endpoint (112, 114) of the plurality of network endpoints; determining the respective network endpoint, of the plurality of network endpoints, to which each respective record of the plurality of records corresponds; assigning a respective dedicated queue (142, 144) for each respective network endpoint (112, 114); transmitting, to each respective dedicated queue (142, 144), each record of the plurality of records that corresponds to the respective network endpoint to which the respective dedicated queue is assigned; generating, for each respective network endpoint (112, 114), using records of the respective dedicated queue corresponding to the respective network endpoint, a respective vector representing a respective behavior model, wherein the generating the respective vector further comprises: encoding each respective record of the records within the respective dedicated queue as a respective string, wherein the encoding each respective record comprises extracting data from a subset of fields of the respective record, and concatenating the data into the respective string; forming a document with each string encoded from the respective record of the records in the respective dedicated queue; feeding the document into a Document to Vector (doc2vec) algorithm; analyzing, using the doc2vec algorithm, the document; and outputting, based on the analyzing, the respective vector; storing each respective vector to a memory; and determining an anomalous behavior state for a network endpoint (112, 114) in the plurality of network endpoints by comparing the respective vector of the network endpoint to a normalcy threshold in a multidimensional space. receiving a plurality of records, each respective record of the plurality of records corresponding to a respective network endpoint (112, 114) of the plurality of network endpoints; determining the respective network endpoint, of the plurality of network endpoints, to which each respective record of the plurality of records corresponds; assigning a respective dedicated queue (142, 144) for each respective network endpoint (112, 114); transmitting, to each respective dedicated queue (142, 144), each record of the plurality of records that corresponds to the respective network endpoint to which the respective dedicated queue is assigned; generating, for each respective network endpoint (112, 114), using records of the respective dedicated queue corresponding to the respective network endpoint, a respective vector representing a respective behavior model, wherein the generating the respective vector further comprises: encoding each respective record of the records within the respective dedicated queue as a respective string, wherein the encoding each respective record comprises extracting data from a subset of fields of the respective record, and concatenating the data into the respective string; forming a document with each string encoded from the respective record of the records in the respective dedicated queue; feeding the document into a Document to Vector (doc2vec) algorithm; analyzing, using the doc2vec algorithm, the document; and outputting, based on the analyzing, the respective vector; encoding each respective record of the records within the respective dedicated queue as a respective string, wherein the encoding each respective record comprises extracting data from a subset of fields of the respective record, and concatenating the data into the respective string; forming a document with each string encoded from the respective record of the records in the respective dedicated queue; feeding the document into a Document to Vector (doc2vec) algorithm; analyzing, using the doc2vec algorithm, the document; and outputting, based on the analyzing, the respective vector; storing each respective vector to a memory; and determining an anomalous behavior state for a network endpoint (112, 114) in the plurality of network endpoints by comparing the respective vector of the network endpoint to a normalcy threshold in a multidimensional space.