Foundational Concepts
This method helps a small system learn patterns in a stream of numbers. The stream shows server load, a sensor signal, or a heart signal. The system trains only the last step in the process. Training stays fast and cheap.
First, numbers enter a fixed network of simple parts. The network holds a short memory of recent numbers. Next, a simple last step reads the state of the network. The answer takes the form of a forecast or a warning.
The method does not replace large AI models. It fills a different job. It watches one stream at a time and learns fast. Teams start small, test the result, and grow from there.
The rest of this brief gives the history, the method, the 2026 gap, and a first project plan.
A blue team defends a fleet of web servers. A red team attacks the same fleet with an AI agent. The Metric Tripwire Service runs one NG-RC model on each server. The model watches six host signals as one joint pattern. The model learns normal operation only and trains on no attack data.
NG-RC fits the job for three reasons. Training touches only the readout. The method uses few training points. The small model runs on constrained hardware at the host.
| Signal | Normal operation | During the novel attack |
|---|---|---|
| Request latency distribution | Follows the daily request cycle in a narrow band per request class | The tail stretches under crafted probe requests |
| TCP retransmit rate | Near zero, with brief rises at network faults | Rises during scans and bulk data transfers |
| Process fork rate | A steady rate from web worker recycling | Spikes at webshell start and tool launches |
| Memory allocation churn | A stable pattern for each workload | A new pattern from injected code and staging buffers |
| TLS handshake timing | Clusters inside a tight timing band | Shifts under automated attack tools |
| Disk I/O wait | Tracks the request load of the hour | Jumps during archive reads and data staging |
No single signal proves an attack. A busy hour moves latency and disk wait together in a learned shape. The model learns the joint shape of all six signals. A workload change moves the signals in a shape from the training record. A novel attack moves the signals in a shape outside the training record.
The red-team agent probes the application with crafted inputs. The agent drops a webshell on the server and starts custom tools. The agent reads archive files and stages data for removal. The probes stretch the latency tail and shift the handshake timing. The webshell spikes the fork rate and changes the memory churn pattern. The staging raises disk wait and the retransmit rate. The six signals leave the learned joint pattern at the same time. The forecast error of the model rises past the alert threshold. The service sends an alert in the first minutes of the attack.
A signature tool compares files and traffic against a list of known attack patterns. The novel attack matches no entry on the list. The tool finds no match and raises no alert. The tripwire compares the host against the same host in normal operation. The attack breaks the learned pattern, and the break alone triggers the alert. The tripwire names no attack and assigns no cause. Identification and response stay with the blue team and with human operators.
The design places the tripwire compute below the operating system of the watched host. An attacker in control of the operating system controls every monitor inside the system. The attacker rewrites, mutes, or blinds an in-system monitor in minutes. A monitor below the system sits outside the reach of the attacker.
The role of the TPM. The trusted platform module seals the model weights against changes. The module attests the integrity of the monitor at start. The TPM cannot execute the monitor or the forecast. Sealing and attestation protect the model, and separate hardware runs the model.
Where the compute runs. A data processing unit (DPU) on the network card runs an independent system. The unit sits on the network path and reads the TCP and TLS signals first. A baseboard management controller (BMC) runs its own firmware and its own memory on the board. An enclave on the host processor isolates the model from the operating system. Intel SGX and AMD SEV supply the enclave forms in current servers.
Signal integrity. Placement protects the signals as well as the model. A compromised operating system falsifies the metrics of the host. The strongest design reads raw counters from the platform layer. The network card, the management controller, and the firmware supply the counters. Only the trip signal leaves the protected boundary.
Goal. The desired end state is one tripwire service in daily use across a server fleet. One small model watches one metric stream per host. The service trains each model on the first days of normal data.
Proof target. The project proves one claim against a heavier baseline model. The tripwire detects known anomalies and test anomalies at near equal quality. The tripwire uses a small part of the training data and runs on CPU hardware only.
Product at the end. The product is the Metric Tripwire Service, version 1. The service contains a collector, a feature builder, per-host NG-RC models, a residual scorer, and an alert API. Operations teams deploy the service beside current monitoring tools.