1. A network device for detecting an unauthorized activity by another network device, comprising: a transceiver that is configured to communicate over a network; a memory that is configured to store instructions; and a processor that is configured to execute instructions that enable actions, including: generating a plurality of detectors, wherein each detector includes a plurality of system calls; determining an initial matching value and an expectation value for each detector; comparing each detector to logged fragments of system calls that are associated with a computing process, and employing at least in part the comparison to determine a new matching value for each detector; when the new matching value for at least one detector is equal to or greater than the at least one detector's expectation value, evolving a child detector from the at least one parent detector; generating a value for the child detector that is based on a combination of common values from a plurality of detectors that are employed to evolve the child detector; associating a rate of mutation for each detector that corresponds to mutations in its evolved child detectors; and enabling a mutation in at least one child detector, wherein the mutation includes a change from a corresponding parent detector for at least one of a fragment length for each system call and a type of each system call.