Abstract: Command line inputs to a system by a user or automated script can comprise a number of legitimate commands but, as a series, reveal a reconnaissance attack, such as to gain knowledge of a system without a legitimate reason to do so. A trained artificial intelligence monitors the command line inputs to the system, as a series, and determines therefrom whether a match exists to a reconnaissance attack. The match may be a non-exact match, such as a match determined by a long short-term memory (LSTM) machine learning model. A reconnaissance attack response may then be initiated upon determining a match is present.