Detecting attacks on computing devices

A method comprising:

• detecting, by a network device, a computing device connecting to a network for a first time;
• loading an agent on the computing device, wherein the agent logs processes of the computing device and system calls made by the processes;
• sending a cryptographic nonce to the agent, wherein the cryptographic nonce is utilized by the agent to generate a hash chain for a plurality of files comprising the log of processes of the computing device and system calls made by the processes;
• sending the plurality of files to the network device;
• authenticating the plurality of files comprising the log of processes of the computing device and system calls made by the processes received from the agent;
• detecting anomalies identifying attacks based on a comparison between (1) the plurality of files comprising the log of the processes and the system calls received from the agent and (2) a baseline profile of initial processes of the computing device and initial system calls made by the initial processes collected when the computing device connected to the network for the first time;
• defining a window of time for the agent to generate the hash chain;
• defining an interval during the window of time for the agent to generate a new chain in the hash chain;
• and
• sending a new cryptographic nonce to the agent after the window of time has expired.