TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Process behaviour anomaly detection using eBPF and unsupervised learning

119 点作者 megahz将近 3 年前

5 条评论

egberts1将近 3 年前
Far much easier to suppress kernel&#x2F;driver log of kernel addresses and deny access to &#x2F;dev&#x2F;kmem, et. al.<p>Leaving eBPF access open demonstratively has made way for file-less persistent malware to linger on unwantedly.<p>A real cybersecurity specialist would only allow eBPF access on host OS if no network access can be made to the host OS (and its ok for guest VMs to have eBPF).<p>An Uber cybersecurity goon, however, would compile out the eBPF JIT access from the Linux kernel (or use BSD-variant, instead).
nibbleshifter将近 3 年前
Hmmm, there&#x27;s interesting possibilities here to build a kind of application-IDS.<p>Execute and monitor a program&#x2F;app while running its full test suite, to generate a model of all the stuff that program normally does.<p>Then monitor it in prod and if it starts behaving weirdly, kill it (and investigate).<p>I wonder how well the models will hold up against attacks that merely exercise normal application functions in unusual ways?
评论 #32478284 未加载
评论 #32478744 未加载
评论 #32477812 未加载
brodouevencode将近 3 年前
The github link if you just want to look at the code: <a href="https:&#x2F;&#x2F;github.com&#x2F;evilsocket&#x2F;ebpf-process-anomaly-detection" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;evilsocket&#x2F;ebpf-process-anomaly-detection</a>
belkarx将近 3 年前
Looking at rate of change is a quite efficient way to go about this. Kudos to the author.
jagger27将近 3 年前
This sounds little bit like Process Homeostasis[0].<p>0: <a href="https:&#x2F;&#x2F;people.scs.carleton.ca&#x2F;~mvvelzen&#x2F;pH&#x2F;pH.html" rel="nofollow">https:&#x2F;&#x2F;people.scs.carleton.ca&#x2F;~mvvelzen&#x2F;pH&#x2F;pH.html</a>