Can an Attacker Train Themselves Into Your Baseline?

If a system learns what normal looks like, can an attacker teach it that their activity is normal too? Here is the honest answer.

The smartest question in the room

It usually comes up halfway through an evaluation, from the person who has been quiet and paying attention.

A behavioral system learns what is normal and flags what is not. So what stops an attacker from moving slowly, a little at a time, until the system decides their activity is normal too? If the baseline can be taught, can it be taught the wrong thing?

That is a fair question. A system that learns can, in principle, be misled about what it learns. We would rather answer that plainly than wave it off with a slogan.

We have written elsewhere that private per-host baselines cannot be downloaded the way signature rules can. This post is the next question: if they cannot be downloaded, can they be taught?

Yes. The concern is real.

Start with the honest admission. Tools like Qato keep rolling, adaptive baselines. They have to. A host's normal in July is not its normal from three months ago. Software gets patched, teams change, workloads shift. A baseline that never updates would bury an analyst in false positives within a week.

A rolling baseline means a slow enough change can be absorbed. If an attacker could nudge a single metric a fraction at a time, slowly enough that each step looked like ordinary drift, the baseline would in theory move with them. Defenders call that baseline poisoning. It works the way moving a fence works: never shift it far enough for anyone to see it move, just take an inch a night until the line sits where you want it.

We are not going to pretend the math forbids it. In principle, it can happen.

What that attempt actually looks like

Picture a file server the attacker already reached with valid credentials. Nothing looks like malware. Their goal is quiet outbound traffic to infrastructure they control, staged over weeks so nobody sees a spike.

So they try the patient plan. Raise outbound connection volume a little each weekday. Keep the process tree boring. Stay inside tools the environment already allows. Wait for the rolling baseline to treat the new level as ordinary. Then use that "new normal" for the real work.

On paper that sounds clever. In practice four things go wrong for them. None of the four is a marketing claim. They come out of how a private baseline behaves when it watches many metrics and knows what hour it is.

Why the patient plan is hard

They are blind to the lines

The attacker cannot see the baseline. Every host's normal and every threshold is private to that host and that organization. There is no public model to download, no rule set to rehearse against in a lab, no answer key for "how much is too much today."

Signature databases let an attacker plan with confidence because the rules are public. A behavioral baseline gives them nothing comparable to pre-test. To move the fence, you need to know how far you can take it in a night before the neighbor walks the property line. That number is exactly what they do not have.

Move too fast and you trip an anomaly. Move too slow and you may spend months inside the network accomplishing almost nothing. Silence is not confirmation. It only means you have not been caught yet. There is no channel that tells them they are 0.1 under the line and free to push harder.

One metric is not the whole problem

Even when the goal looks like "just a little more egress," real activity rarely moves only one number. Quiet C2 still tends to shift process timing and where connections go. A change that looks gradual on outbound volume can look wrong on process creation, on listening ports, on the shape of authentication.

And the baseline is not one blurry average for the host. It is many metrics, each with its own normal. To poison without surfacing, the attacker has to stay inside the envelope on every metric they disturb, at once, for as long as the campaign runs. That is a different problem from sliding one dial.

What if they truly only need one behavior that already sits inside the host's learned pattern? Then they are not "training the baseline" so much as living inside what already looks ordinary. That is a hard case for any anomaly system, and it is why this layer sits next to EDR, NDR, and the rest of the stack rather than instead of them. Poisoning is the special claim: teaching the system a new normal. Fitting inside the old normal is a different, older problem.

The calendar does not cooperate

Separate profiles for business hours, off-hours, and weekends are not a nicety. A host that is quiet on Tuesday afternoon can be busy after midnight. Training during the workday does not automatically teach the night profile or the weekend profile.

Go back to the file server. The attacker spends three weeks gently raising weekday egress. Then they run the real job on a Saturday morning, or during a change window the host never used for that traffic. The weekday lesson does not transfer. That hour is judged against its own normal.

Lateral movement resets the homework

Suppose they somehow get away with it on host A. The moment they touch host B, they face a baseline that has been taught nothing about them. Host B has its own normal, its own time buckets, its own mix of metrics. The patient, blind balancing act starts over.

A slow-poisoning campaign that needs to spread tends to defeat itself by spreading. Every new host is a fresh exam, graded against a standard the attacker cannot read.

The asymmetry

Put the two sides next to each other.

The defender has breadth and privacy: many metrics, several time windows, many hosts, lines that are not published. The attacker has to be right across the dimensions they disturb, for as long as they stay, without knowing where the lines sit and without a trustworthy signal that the slow approach is working.

One misstep on any metric, on any host, and a system like Qato can flag it. The attacker has to win every quiet day. The defender has to notice once.

That is the whole argument. Not that networks become unbreakable. That the economics of staying hidden get worse when "normal" is private, per host, and split by time of day.

What we are not claiming

No detection system catches everything, and behavioral detection is no exception. A patient, well-resourced adversary who gets enough of the variables right could still slip a slow change past a baseline, the same way a careful enough intruder can defeat any single control.

Qato detects and surfaces. It does not prevent, and it is not a guarantee. What it does is raise the cost of staying hidden, and raise the odds that the attacker makes the one mistake that gives them away. That is why it belongs beside the firewall, the IDS, the EDR, and the SIEM you already run, not in place of any of them. Every extra layer is another set of odds against them. A private per-host baseline is the layer that does not hand them the answer key.

So can an attacker train themselves into your baseline? In theory, with enough patience and enough luck, on a narrow enough path they cannot see. In practice they have to do it across the metrics they touch, in the right hours, often on more than one host, forever blind, and be right every time. That is a bet most attackers lose.

Beyond signatures. Beyond rules. Detect the unknown.