Turing machine agent for behavioral threat detection

Abstract

A computer-implemented method, according to one approach, includes: causing a multi-layer neural network to evaluate a user query received from an endpoint device by processing the user query with one or more initial layers of the neural network. In response to receiving an output from the initial layers at a supplemental threat detection layer of the neural network, the user query processed with the threat detection layer. Processing the user query with the threat detection layer includes using a classifier to compare the user query to activation data outlining known illegitimate queries. Moreover, combinational reasoning is used to determine whether the user query is legitimate based at least in part on: an output of the classifier, and behavioral information received from a threat intel pattern. The user query is further intentionally rejected in response to the threat detection layer determining the user query is not legitimate.