"The attacker is poking at the memory controller, the library door, to say, 'is it busy now?' "We were motivated to undertake this work as there was nothing available that could do this kind of automated detecting and killing on a user's machine in real-time." Existing products, known as endpoint detection and response (EDR), are used to protect end-user devices such as desktops, laptops, and mobile devices and are designed to quickly detect, analyse, block, and contain attacks that are in progress. The main problem with these products is that the collected data needs to be sent to administrators in order for a response to be implemented, by which time a piece of malware may already have caused damage. To test the new detection method, the team set up a virtual computing environment to represent a group of commonly used laptops, each running up to 35 applications at the same time to simulate normal behaviour. The AI-based detection method was then tested using thousands of samples of malware.