Foundational Concepts

Resident Tripwire

A per-host NG-RC monitor for novel compromise

Brian Guy (A.A.S.) and Aurora Guy, Solutions Prodigy.

One-page concept note.

Start Here: The Short Version

A tiny model lives on each computer. The model learns what normal looks like for that one machine. The model raises a flag the moment the machine starts to behave in a new way. The flag gives the owner an early warning and a clean record of the moment.

What it can do

• It learns the normal pattern of one host from a short record of normal data.
• It forecasts the next values in each stream.
• It flags a sharp change in the pattern at the moment the change starts.

Where people can use it

• Server teams place the monitor on each host in a small fleet.
• Small sites run the monitor on single machines with no central service.
• Test labs place the monitor on lab hosts during intrusion tests.

Problems it can help solve

• New attacks carry no known signature for a rule or a feed to match.
• Central monitors lose sight of a host after an intruder cuts the network link.
• Single metric thresholds miss attacks that move several signals at once.

Worked Example: A Web Server Tripwire

A blue team places one resident monitor on a production web server. A red team attacks the same server with an AI-driven intruder. The monitor reads six signals as one joint pattern: latency distribution, TCP retransmits, process fork rate, memory churn, TLS timing, and disk I/O wait. Normal traffic teaches the model the joint rhythm of the six signals. A probe, a webshell drop, or a quiet exfiltration bends several signals at once. The forecast error trips at the start of the bend, and the monitor escalates the moment with a snapshot. The new behavior matches no signature in any feed.

The strongest form runs the model below the operating system. A TPM chip seals the model weights and attests integrity. The compute runs on a DPU, a baseboard controller, or a CPU enclave. An attacker who owns the operating system falsifies its reported metrics, so the sensor reads platform counters directly.

End State

Goal. One resident monitor sits on each host of a small fleet. Each monitor trains on its own host and runs with no network link.

Proof target. Lab tests use replayed intrusions and live test intrusions. The tripwire flags the intrusion window with zero attack examples in training. False alerts stay under an owner-set daily budget.

Product at the end. Resident Tripwire, version 1, holds a host agent with a collector, an NG-RC model, a residual scorer, and a snapshot and escalation module. A fleet escalation API completes the product.