What it detects
An unsupervised ensemble autoencoder flagging anomalous IPs by reconstruction error vs. normal.
Why it fires
A signal of behavior far outside the learned baseline (novel botnet, zero-day).
Worst case
Novel · zero-day anomaly
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.