A multi-level, ensemble network monitoring system for detection of suspicious network activity from one or more a plurality of user computing devices on an external network communicatively connected via a network server to a private communication network is disclosed. In malware detection, the ensemble network monitoring system comprises artificial intelligence (AI) with bidirectional long short-term memory (BDLSTM) recurrent neural networks (RNNs) and natural language processing (NLP) to predict possible security threats and then initiate remedial measures accordingly. Enabling a proactive approach to detection and prevention of potential malicious activity, the BDLSTM RNN may perform real-time monitoring and proactively forecast network security violations to block network communications associated with high-risk user computing devices from accessing a private communication network.