A system comprising: a first computing device comprising instructions executable by a hardware processor, to: create, responsive to detecting a second computing device initially attempting to connect to a network, an unpopulated baseline profile for the second computing device; transmit a cryptographic nonce to the second computing device; define a window of time for the cryptographic nonce to be used by the second computing device; receive, from the second computing device, a log file of processes running on the second computing device and system calls made by the processes, wherein the log file is authenticated using the cryptographic nonce; populate the baseline profile with initial processes running on the second computing device and initial system calls made by the initial processes during an initial operation time period of the second computing device; monitor, during a subsequent operation time period of the second computing device, subsequent processes running on the second computing device and subsequent system calls made by the subsequent processes; detect an attack on the second computing device based on a comparison of the subsequent processes and the subsequent system calls to the populated baseline profile; and transmit a new cryptographic nonce to the second computing device after the window of time has expired. a first computing device comprising instructions executable by a hardware processor, to: create, responsive to detecting a second computing device initially attempting to connect to a network, an unpopulated baseline profile for the second computing device; transmit a cryptographic nonce to the second computing device; define a window of time for the cryptographic nonce to be used by the second computing device; receive, from the second computing device, a log file of processes running on the second computing device and system calls made by the processes, wherein the log file is authenticated using the cryptographic nonce; populate the baseline profile with initial processes running on the second computing device and initial system calls made by the initial processes during an initial operation time period of the second computing device; monitor, during a subsequent operation time period of the second computing device, subsequent processes running on the second computing device and subsequent system calls made by the subsequent processes; detect an attack on the second computing device based on a comparison of the subsequent processes and the subsequent system calls to the populated baseline profile; and transmit a new cryptographic nonce to the second computing device after the window of time has expired. create, responsive to detecting a second computing device initially attempting to connect to a network, an unpopulated baseline profile for the second computing device; transmit a cryptographic nonce to the second computing device; define a window of time for the cryptographic nonce to be used by the second computing device; receive, from the second computing device, a log file of processes running on the second computing device and system calls made by the processes, wherein the log file is authenticated using the cryptographic nonce; populate the baseline profile with initial processes running on the second computing device and initial system calls made by the initial processes during an initial operation time period of the second computing device; monitor, during a subsequent operation time period of the second computing device, subsequent processes running on the second computing device and subsequent system calls made by the subsequent processes; detect an attack on the second computing device based on a comparison of the subsequent processes and the subsequent system calls to the populated baseline profile; and transmit a new cryptographic nonce to the second computing device after the window of time has expired.