Differential diagnosis feature engineering for machine learning applications

A system comprising:

• a processor;
• and
• a memory storing instructions which, when executed by the processor, cause the processor to:
• receive an identifier of a computer system security event;
• sequentially process a plurality of inquiries, wherein subsequent inquiries in the plurality of inquiries are selected and processed based on responses to earlier inquiries in the plurality of inquiries;
• store indications of (i) the plurality of inquiries processed and (ii) responses received to the plurality of inquiries into a tensor;
• determine, with a machine learning model, that the tensor identifies a potential computer system security breach;
• and
• generate an intervention for the potential computer system security breach.

A non-transitory, computer-readable medium storing instructions which, when executed by a processor, cause the processor to:

• receive an identifier of a computer system security event;
• sequentially process a plurality of inquiries, wherein subsequent inquiries in the plurality of inquiries are selected and processed based on responses to earlier inquiries in the plurality of inquiries;
• store indications of (i) the plurality of inquiries processed and (ii) responses received to the plurality of inquiries into a tensor;
• determine, with a machine learning model, that the tensor identifies a potential computer system security breach;
• and
• generate an intervention for the potential computer system security breach.