A computing platform may receive event
processing requests. The computing platform may integrate, into the event
processing requests,
domain knowledge. The computing platform may reduce, using temporal sequence compression, the integrated event
processing requests into high-
signal segments. The computing platform may generate, using
capsule-based representation learning,
capsule structures representing the high-
signal segments. The computing platform may access at least one unauthorized
activity detection model. The computing platform may analyze, using the at least one unauthorized
activity detection model, the event processing requests, which may include selectively retrieving, for the at least one unauthorized
activity detection model and using contextual indexing, a subset of relevant
capsule structures from the capsule structures. The computing platform may output, using the at least one unauthorized activity detection model, a unauthorized activity output for the event processing requests. The computing platform may initiate, based on the unauthorized activity output, one or more security actions.