HostSentry is a host based intrusion detection tool that
performs Login Anomaly Detection (LAD).
This tool allows administrators to spot strange login
behavior and quickly respond to compromised accounts and
unusual behavior. HostSentry incorporates a dynamic database
and actually "learns" the user login behavior. This behavior
is then utilized by modular signatures to detect unusual
events.