HostSentry is a host based intrusion detection tool that performs Login Anomaly Detection (LAD). This toolallows administrators to spot strange login behavior and quickly respond to compromised accounts and unusual behavior. HostSentry incorporates a dynamicdatabase and actually "learns" the user login behavior. This behavior is then utilized by modular signatures to detect unusual events. This is part of the Abacus Project