1. A computer-implemented data processing method providing an improvement in computer security and comprising: using programmed computer instructions, executing, in computer memory, a recurrent neural network (RNN) comprising a plurality of nodes each implemented as a Long Short-Term Memory (LSTM) cell and comprising a plurality of links between nodes that represent outputs of LSTM cells and inputs to LSTM cells, wherein each LSTM cell implements an input layer, hidden layer and output layer of the RNN; receiving, from a networked computer, network traffic data associated with one or more networked computers; extracting feature data representing a plurality of features of the network traffic data and providing the feature data to the RNN; classifying one or more individual Uniform Resource Locators (URLs) as malicious or legitimate using a plurality of first LSTM cells of the input layer, wherein inputs to the first LSTM cells are individual characters of the one or more URLs, and wherein the first LSTM cells generate a feature representation, wherein the feature representation is classified with a classifier; using the RNN and a plurality of second LSTM cells that are different from the first LSTM cells, receiving the feature representation as input, wherein the feature representation is associated with a particular user connection of a particular computer user, host or machine; classifying the feature representation as malicious or legitimate using the RNN, the plurality of second LSTM cells, and the classifier; creating and storing a connection data item that specifies whether the particular user connection is malicious or legitimate based upon the preceding classifying; based on the connection data item, generating signals to a firewall device specifying either admitting or denying the particular user connection.