🕵️ AI Intrusion Detection

🎯 The Problem With Rules

Your IDS ruleset is a list of things you already know about. It catches the attacks that were common enough, documented enough, and obvious enough for someone to write a signature for. It is, by definition, a catalog of the past.

The attacker who moves slowly, uses valid credentials, and mimics normal behavior does not trip those rules. Not because your rules are wrong — they are correct for what they describe. But because this attacker is not doing anything your rules recognize as an attack.

This is the gap AI-assisted intrusion detection is designed to close. Not by replacing your rules, but by adding a layer underneath them that watches for deviation rather than known signatures.

📈 What a Behavioral Baseline Is

A behavioral baseline is a statistical model of what normal looks like for a specific entity — a user, a host, a service, a network segment. It is built from historical data and answers questions like:

Once you have a baseline, you have a definition of normal. Anything that deviates significantly from that baseline is an anomaly — worth investigating, even if no rule fired.

⏳ Dwell Time: The Number That Should Worry You

Dwell time is the gap between when an attacker gains access and when they are detected. It is the single most important number in your security posture that most shops do not track.

Industry data consistently puts median dwell time in the range of weeks to months. The attackers responsible for the worst breaches — ransomware gangs, nation-state actors, sophisticated criminal groups — are not the ones who trigger your IDS the moment they get in. They are the ones who spend weeks or months moving quietly before anyone notices.

Each of those behavioral signals is invisible to a rule-based system unless someone specifically wrote a rule for it. A behavioral baseline catches them because they all represent deviation from what is normal for that entity.

🧭 Lateral Movement: The Hard Problem

Lateral movement is how attackers go from one compromised host to everything else you care about. It is also the detection problem that exposes the limits of perimeter-focused security.

Once an attacker is inside your network using valid credentials, the traffic looks legitimate. SSH from host A to host B using a real account is not an attack — it is something your sysadmins do every day. The difference is context:

None of those rule-based responses are wrong. The rules are working as designed. Behavioral analysis adds the question that rules cannot ask: is this normal for this entity?

🤖 How AI Implements Behavioral Detection

Under the hood, modern AI-assisted detection tools use several techniques. You do not need to implement these yourself — but understanding what the tool is doing helps you tune it, trust its output, and know when it is lying to you.

Statistical anomaly scoring

The simplest form. For each entity, the tool maintains statistical distributions of normal behavior — login times, connection counts, data volumes, command frequency. Events that fall outside expected ranges get an anomaly score. High scores trigger alerts.

Fast to build, fast to query, easy to explain to management. Also easy to evade if an attacker moves slowly enough to stay within statistical norms.

Peer group analysis

Instead of comparing a user only to their own history, compare them to a peer group — other accounts with similar roles, access levels, and usage patterns. If every other DBA connects from the corporate VPN and one suddenly connects from a residential IP in another country, that is an anomaly even if that user has no personal baseline to compare against.

Useful for new accounts and for detecting compromised credentials where the attacker matches the user's own behavioral history.

Sequence analysis

Individual events look legitimate. The sequence of events is the tell. Login → read passwd → read shadow → enumerate home directories → compress files → outbound connection. Each step alone is explainable. The sequence is a kill chain.

AI tools that do sequence analysis maintain short-term memory of event chains per entity and score sequences that match known attack patterns even when individual events are clean.

Graph-based lateral movement detection

Model your environment as a graph: hosts as nodes, connections as edges. Normal admin activity creates a predictable connection graph. An attacker moving laterally creates new edges that were not in the baseline graph. Graph anomaly detection catches this even when the credentials used are valid.

🧪 Hands-On: Behavioral Analysis With What You Have

You do not need a commercial SIEM to start doing behavioral analysis. Here are practical starting points using tools already on your systems, with AI assist for the pattern recognition layer.

Build a simple login baseline with awk

Start by understanding what normal looks like. Run this weekly and compare output:

# Who logs in, from where, at what hours — build your own baseline
grep "Accepted" /var/log/auth.log | \
  awk '{print $1, $2, $9, $11}' | \
  sort | uniq -c | sort -rn

# Output: count  month  day  user  source_ip
# Save this weekly. Diff against last week. New source IPs stand out.

# Login hours by user — what does normal look like?
grep "Accepted" /var/log/auth.log | \
  awk '{split($3,t,":"); print $9, t[1]}' | \
  sort | uniq -c

# Shows: count  username  hour — flag logins at unusual hours for that user

Spot new source IPs with diff

# Save today's source IPs
grep "Accepted" /var/log/auth.log | \
  awk '{print $11}' | sort -u > /var/tmp/auth-ips-today.txt

# Compare against your known-good baseline
diff /var/tmp/auth-ips-baseline.txt /var/tmp/auth-ips-today.txt

# Lines starting with > are new IPs not seen before
# Run this in cron, pipe new IPs to mail or your ticketing system

Hand the patterns to AI for interpretation

# Collect a week of login data and ask AI to describe the baseline
grep "Accepted" /var/log/auth.log | \
  awk '{print $1,$2,$3,$9,$11}' | \
  sgpt "Analyze these successful SSH logins. Describe the normal pattern:
  typical users, typical hours, typical source IPs. Flag anything that
  looks like an outlier against the dominant pattern."

# Or with curl if you don't have sgpt yet:
LOGIN_DATA=$(grep "Accepted" /var/log/auth.log | tail -500)
echo "$LOGIN_DATA" | ask_claude "Describe the normal login pattern here.
  List any logins that look like outliers — unusual hours, unusual source
  IPs, users accessing systems they rarely touch."

Detect new SSH keys added outside change windows

# Find authorized_keys files modified in the last 24 hours
find /home /root -name "authorized_keys" -newer /var/tmp/last-check \
  -exec ls -la {} \;

# Update the timestamp reference
touch /var/tmp/last-check

# Run from cron. Any output means a key was added — worth knowing about.
# Pipe results to sgpt for context if multiple files changed:
find /home /root -name "authorized_keys" -newer /var/tmp/last-check \
  -exec cat {} \; | \
  sgpt "These SSH authorized_keys files were modified in the last 24 hours.
  List each key, what type it is, and any comments. Flag anything unusual."

📋 Behavioral Signals Worth Watching

If you are building a checklist of what to monitor before deploying a full SIEM, these are the highest-value behavioral signals for a typical Linux environment:

⚠️ What Behavioral Analysis Does Not Solve

Behavioral detection is a significant improvement over rules alone. It is not a complete solution. Know its limits before you trust it:

➡️ Where to Go Next

You now have the conceptual framework: what behavioral baselines are, why dwell time matters, how lateral movement evades rules, and what AI is actually doing under the hood. Page 3 gets concrete about the tools you can deploy.