The Beholder system is a software client / server system that detects intrusion by monitoring the real-world execution time of critical kernel-level operations. Beholder was designed for use with critical infrastructure systems, especially in the power grid.