Feature: Agent behavior baseline learning for anomaly detection

[cdzzy]

Problem

Security policies are rule-based: they catch known-bad patterns but miss novel attacks. An agent behaving abnormally (e.g., suddenly accessing files it never touched before) may indicate a novel attack.

Solution: Behavioral Baseline

const shield = new TraceShield({
  behaviorBaseline: {
    enabled: true,
    learningPeriod: "7d",  // Learn normal behavior for 7 days
    anomalyThreshold: 2.5, // Standard deviations
    onAnomaly: (event) => {
      alertSOC(event)  // Unusual tool call pattern detected
    }
  }
})
// After learning: researcher agent never used delete_file
// Day 8: researcher calls delete_file -> ANOMALY alert

Continuous learning adapts to agent behavior evolution.

[Whatsonyourmind]

For the behavioral anomaly detection, @oraclaw/anomaly implements Z-score detection with configurable thresholds — your 2.5 standard deviation target maps directly as a parameter.

Feed it aggregated tool-call frequency vectors from the baseline window and it returns anomaly flags with deviation scores for each observation. Stateless and sub-5ms, so it fits well in a continuous monitoring loop.

npm install @oraclaw/anomaly

Disclosure: I maintain OraClaw.