Behaviour-based detection
What is normal on this server
Every other part of NODE64 checks against a standard that applies everywhere. Timbre knows only one standard: this server, yesterday.
Timbre is what distinguishes two instruments playing the same note. Same pitch, same volume — you still hear immediately whether it is a violin or a clarinet.
Servers work the same way. Two machines with the same software, the same operating system, the same packages behave differently — because one runs a shop and the other is a backup target. Five hundred changed files are everyday life on a build server and an incident on a mail server.
So there is no universal normality one could build in. There is only the history of this one system — and Timbre keeps it. Every number sits next to the value that is usual here, and the number of measurements it comes from. Recomputable, and therefore refutable.
What the agent reads
Five areas, the same as in the dashboard. On the left what is read; on the right what it is measured against.
Files
What is read
How many files changed in the data directories and in which folders. For recently changed files: the information content per byte, the extension, and a handful of fixed patterns — code executing network input, obfuscation, mailer scripts. Plus the checksums of important system files and, where present, of files nobody has touched for over ninety days.
Measured against
Against its own median over recent runs. Against the file extensions that have appeared on THIS system before — not a fixed list, because ransomware picks its extension freely for exactly that reason. And against statistical properties that rewriting does not help with.
Network
What is read
Which ports listen. Which process talks to which destination network on which port — as a relationship, not as an individual connection.
Measured against
Against the observation start: is this counterpart new, or has it been here before? And against whether the process itself listens — something offering a service belongs in the open internet less often than a tool does. The destination network is reported, not the address.
Accounts and access
What is read
Which accounts can log in, which may use sudo, which SSH keys are installed. And successful logins as a pair of account and origin network.
Measured against
Against whether this account has logged in from this origin before. The origin is smoothed to the network operator number — a home connection changes its address regularly but rarely its provider.
Processes
What is read
Which processes are running. And, when switched on, the kernel reports every start, fork and exit — which makes programs visible that live only milliseconds.
Measured against
Against four rules that need no history: a shell under the web server is always wrong, no matter how often it happened. Plus the number of program launches and distinct parent-child chains against its own median.
System
What is read
Running services, containers and their deviation from their own image — whatever was added at runtime sits in a separate layer and can be queried.
Measured against
Against the observation start and against runtime rules: a program appearing in a binary directory, a package manager that ran, something executable in a scratch directory.
What a finding looks like
Four numbers that say nothing on their own — and together describe an installation. That is what Timbre is built for: not the one big spike, but several small ones at the same time.
Four features deviating at once
- running services 44 instead of the usual 40
- listening ports 11 instead of the usual 8
- accounts that can log in 5 instead of the usual 3
- SSH keys 4 instead of the usual 2
Each number alone is worth a shrug. All four in the same hour are somebody settling in.
Not claimed, counted
What the network has learned so far
Every installation learns for itself what is normal on its server. What comes out of that is condensed into patterns — and those are listed here exactly as they stand today. What travels are traits, not contents: figures and identifiers, never file contents, never command lines, never names.
5
patterns in the knowledge base
355
observations within them
2
independent installations (largest pattern)
257
positions in the vector store
49
trait axes per position
| Pattern | Activity | State | Observations | Installations |
|---|---|---|---|---|
| P-0e38163e | Processes · prozessstarts | correlated | 71 | 2 |
| P-75504913 | Files · datenverzeichnisse | correlated | 71 | 2 |
| P-77ca4e62 | System · systemzustand | correlated | 71 | 2 |
| P-c14c86df | Accounts and access · anmeldungen | correlated | 71 | 2 |
| P-ebd93d6b | Network · ausgehende_verbindungen | correlated | 71 | 2 |
A pattern grows in three stages. Observed means: seen, nothing more. Correlated means: at least 20 observations, but still too few independent sources. Confirmed means: 20 observations across 5 independent installations — and no single source contributes more than 25 % of them. That last condition matters most: twenty out of five sounds solid; if eighteen come from one, it is not.
This table contains no pseudonym, no device, no account and no timestamp. What remains is the kind of activity and how often it was seen — exactly the dataset that stays analysable once every raw observation has been deleted.
What Timbre does not do
- No signature database in the agent. It carries no list of known malware and downloads none. What it detects, it detects from behaviour.
- No neural network, no black box. Median, spread, percentile — methods you can recompute. Every finding names the numbers it came from.
- No countermeasures. Timbre deletes nothing, kills no process and blocks no connection. It detects and explains. If you need intervention within seconds, you also need a tool that is allowed to intervene.
- No file contents, no command lines. Both stay on your server — passwords regularly appear in command lines, and the agent cannot tell when. What is transmitted is checksums, counts and relationships.
- No overall score. There is no number from 0 to 100. We had one and dropped it, because nobody could say what 73 meant.
- No verdict without grounds. Where the history is not yet enough for a comparison, it says so — instead of a zero that looks like an all-clear.