- decnet/profiler/: analyze attacker behavior timings, command sequences, service probing patterns - Enables detection of coordinated attacks vs random scanning - Feeds into attacker scoring and risk assessment
