Embodiments secure data on a cloud based network that comprises one or more machine learning (“ML”) notebooks. Embodiments monitor activity on each of the ML notebooks, the activity including one or more commands. Embodiments classify each of the commands, the classifying including generating input parameters. Based on the input parameters, embodiments determine a risk score for each of the ML notebooks. When the risk score exceeds a predetermined threshold, embodiments generate an alert.