A security system that monitors and analyzes the internals of a computing system, including system calls, file modifications, and application logs, to detect suspicious activity.