In the Shadowrun sr5 core rulebook, it is written that when a host spots you doing something "unauthorized, illegal, or just something it doesn’t like" its owner is informed. However, it doesn't specify how this spotting can happen, or refer to any other part of the book that explains it. As such, I would like to ask, what does it take for a host to spot someone doing something unauthorized, illegal, or something it doesn't like?
Option 1: You succeed on an Attack action or fail on a Sleaze action.
If you succeed on an Attack action, the target automatically knows it's under attack, although it doesn't automatically spot you. If you fail on a Sleaze action, the target receives a mark on you and thus automatically spots you ("Noticing Hackers", p. 236). In either case, the host identifies you as a hostile hacker and responds appropriately.
Option 2: Patrol IC identifies you as a threat.
The paragraph that you reference (p. 247) explains that while a host doesn't have hostile IC deployed most of the time, it does have Patrol IC running at all times. Patrol IC is described on p. 248:
Patrol IC acts more like an agent than other intrusion countermeasures. Its job is to patrol a host, scanning people's marks and looking for illegal activity using the Matrix Perception action on all targets in the host.
The Patrol IC will scan you with Matrix Perception somewhere between every combat turn and every minute, depending on the host rating (this could turn out to be many times over the course of a Matrix Search). Better hosts are more powerful, but also have more things to divide the IC's attention ("Patrol IC", Data Trails p. 86. Thanks to @Newbyte for the reference).
A successful Matrix Perception allows the Patrol IC to find out a number of pieces of information about your persona ("Matrix Perception", p. 235). Since you have a mark (you need one to enter the host in the first place), you're technically an authorized user. But any of the following could warrant a security response, whether that's launching hostile IC or just having a spider come check things out:
- You have an Attack and/or Sleaze Rating
- You just performed an illegal Matrix action
- You're running silent
If you're not running silent ("Running Silent", p. 235), every hit lets it find out one of these pieces of information. If you are running silent, a single hit on Matrix Perception will tell the Patrol IC that there's a silent icon in the host - but it needs to beat your Logic + Sleaze in order to actually spot you. It can't do much of anything until it does that, but once it does, the fact that you were running silent is just one more reason to trigger a response.