A method comprising: determining, for each process of a plurality of processes executing on a computing device, one or more privileges for accessing one or more host interfaces; determining, by executing a cryptographic hash function for each process of the plurality of processes, whether each process is secured; based on a determination that a first process and a second process of the plurality of processes are attempting to access a host interface of the one or more host interfaces, determining, by an intrusion detection agent having a more privileged level of access to an operating system of the computing device than an administrative user and based on the one or more privileges, whether the first process and the second process are privileged to access the host interface; based on a determination that the first process is not privileged to access a host interface the first process is attempting to access or that the first process is not secured, causing termination of the first process; based on a determination that the second process is privileged to access a host interface the second process is attempting to access, determining whether the second process has been validated within a preset amount of time; based on a determination that a time at which the second process was last validated exceeds the preset amount of time, determining a validity or invalidity of the second process; based on a determination that a process is an unauthorized process based on not having the privilege to access the host interface or not being valid, recording that the unauthorized process made an unauthorized attempt to access the host interface or was not valid; and sending, to a remote computing device, a log identifying each unauthorized attempt to access one of the one or more host interfaces and identifying processes associated with each unauthorized attempt. determining, for each process of a plurality of processes executing on a computing device, one or more privileges for accessing one or more host interfaces; determining, by executing a cryptographic hash function for each process of the plurality of processes, whether each process is secured; based on a determination that a first process and a second process of the plurality of processes are attempting to access a host interface of the one or more host interfaces, determining, by an intrusion detection agent having a more privileged level of access to an operating system of the computing device than an administrative user and based on the one or more privileges, whether the first process and the second process are privileged to access the host interface; based on a determination that the first process is not privileged to access a host interface the first process is attempting to access or that the first process is not secured, causing termination of the first process; based on a determination that the second process is privileged to access a host interface the second process is attempting to access, determining whether the second process has been validated within a preset amount of time; based on a determination that a time at which the second process was last validated exceeds the preset amount of time, determining a validity or invalidity of the second process; based on a determination that a process is an unauthorized process based on not having the privilege to access the host interface or not being valid, recording that the unauthorized process made an unauthorized attempt to access the host interface or was not valid; and sending, to a remote computing device, a log identifying each unauthorized attempt to access one of the one or more host interfaces and identifying processes associated with each unauthorized attempt.