They might and some definitely do, but at large enough scale maintaining a good anomaly detection signal to noise ratio becomes very difficult. A single ubuntu

They might and some definitely do, but at large enough scale maintaining a good anomaly detection signal to noise ratio becomes very difficult. A single ubuntu terminal spawn will generate something like 20 system calls. Now multiply that with however many actions you take during 8 hours of using a computer with your generic corp of over 10k hosts.