BES INWARD

A system that watches its own operator. Not “who are you?” — “are you behaving like yourself?” It learns the operator’s behavioural signature, then catches a hijacked or scripted run by how it behaves, with no credential changing hands. booting kernel…

Identity is insufficient; behaviour is authoritative. An impostor fails one of exactly two ways — it is overly regular (scripted automation, clockwork rhythm) or randomly uncorrelated with the operator (a hijack, a different mix of actions). One-class: it models the operator, never the attacker, so a hijack it has never seen still flags. (Behavioural Entropy Signatures, Gary W. Floyd.)

The operator’s baseline

windows learned0

rhythm (gap variability)—

op-mix

last window—

Present a run

press a button — a window of actions hits the watch.

Kernel-backed: this page imports src/bes · stream — the same modules witness-all.mjs (46/49 killed, clean) and attack-kit/redteam.mjs --check prove in CI. No credentials, no crypto — pure behavioural entropy, integer-only, deterministic. In the estate it watches Kar’s own nightly action ledger. Nothing calls home.
Source and the full finding: github.com/sjgant80-hub/bes-inward. The 4th security pillar, after break-it (authn) and perimeter-post (authz). BES: Gary W. Floyd, Lumiea Systems Research Division (ThunderStruck Service, LLC), “GEP-Based Security” (2025).