So anyways I will be working on a new project soon.
β€βπ₯1
π£ πΜΆπ’ΜΆπ±ΜΆπ°ΜΆπ±ΜΆπΜΆπ ΜΆπ¨ΜΆ π£
Photo
The only stuff that made me relate is the cats and movie(which I only talked about once) for both damn
π£ πΜΆπ’ΜΆπ±ΜΆπ°ΜΆπ±ΜΆπΜΆπ ΜΆπ¨ΜΆ π£
I guess I am unique after all.
This media is not supported in your browser
VIEW IN TELEGRAM
π2πΏ1
I am building,
Real-Time Kernel Security Engine
The problem: Traditional security agents run in user space, consuming 5β10% of total CPU and introducing latency that modern cloud-native systems can't afford.
A zero-overhead kernel security observer using eBPF (Extended Berkeley Packet Filter) using C for eBPF bytecode and C++ for user-space control planes.
well the mechanism is injecting eBPF bytecode directly into the Linux kernel to trace kernel syscalls, memory allocation patterns, and network socket activity in real time.
Real-Time Kernel Security Engine
The problem: Traditional security agents run in user space, consuming 5β10% of total CPU and introducing latency that modern cloud-native systems can't afford.
A zero-overhead kernel security observer using eBPF (Extended Berkeley Packet Filter) using C for eBPF bytecode and C++ for user-space control planes.
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β USER SPACE (C++20 Daemon) β
β β
β ββββββββββββββββββββββββββ ββββββββββββββββββββββββ β
β β process_monitor.skel.h β ββββββΊ β RAII Engine Loop β β
β β (Auto-gen Skeleton) β β (ring_buffer__poll) β β
β ββββββββββββββββββββββββββ ββββββββββββ¬ββββββββββββ β
βββββββββββββββββββββββββββββ²ββββββββββββββββββββΌβββββββββββββββ
β β BPF Map Updates
RingBuf β β (Blacklist / Rules)
β βΌ
βββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββ
β β KERNEL SPACE (C / eBPF) β
β βββββββββββββββββββββββββ΄βββββββββββ β
β β BPF_MAP_TYPE_RINGBUF β β
β ββββββββββββββββββββ²ββββββββββββββββ β
β β bpf_ringbuf_submit β
β ββββββββββββββββββββ΄ββββββββββββββββ β
β β process_monitor.bpf.c β β
β β SEC("tp/sys_enter_execve") β β
β ββββββββββββββββββββ²ββββββββββββββββ β
β β β
β ββββββββββββββββββββ΄ββββββββββββββββ β
β β Linux Kernel / Syscall Tracepointβ β
β ββββββββββββββββββββββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
well the mechanism is injecting eBPF bytecode directly into the Linux kernel to trace kernel syscalls, memory allocation patterns, and network socket activity in real time.
β€βπ₯2π1π₯1
β‘3π₯1
I don't think I installed the mic driver
π₯1
SO for today's stuff on the K-Sentinel I was able to map it out more.
π£ πΜΆπ’ΜΆπ±ΜΆπ°ΜΆπ±ΜΆπΜΆπ ΜΆπ¨ΜΆ π£
diagram.txt
I would have used ptrace like my other project ZeroShadow and dSBOM but according to this source it's better to use the bpf functions,
from eBPF Docs. source
from eBPF Docs. source