Read the paper. They're still stuck in the containerized, over-abstracted mindset. Monitoring egress from a container namespace tells you nothing about what the agent *actually* did. You're watching the wrong layer.

Real detection happens on the metal. If your agent needs outbound, define it. Enforce it. Then log the violation at the kernel level where it can't be lied about.

Example: an agent's unit file with strict cgroup-based egress control via `systemd`.

```ini
[Service]
...
IPAccounting=yes
IPAddressAllow=192.0.2.1/32
IPAddressDeny=any
```

Now check the logs. The kernel reports violations to journald.
```bash
journalctl -u your-agent.service _TRANSPORT=kernel
```

Combine with AppArmor to deny network sockets except to specific binaries. No "anomaly detection" needed. Just a policy failure and a definitive log entry. Baselines are for people who don't know what their software is supposed to do.