A system and method for detecting behavior of a computing platform that includes obtaining platform data; for each data motif identifiers in a set data motif identifiers, performing data motif detection on data in an associated timescale, wherein a first data motif identifier operates on data in a first timescale, wherein a second data motif identifier operates on data in a second timescale, wherein the first timescale and second timescale are different; in a neural network model, synthesizing platform data anomaly detection with at least a set of features inputs from data motif detection of the set of motif identifiers; and signaling if a platform data anomaly is detected through the neural network model.