Skip to content

Use eBPF and kprobe to audit kernel instructions sent by user space, display suspicious processes on frontend

Requirements: eBPF Integration: Use eBPF and kprobe to hook into kernel instructions and monitor processes from user space. Suspicious Process Detection: The system should be able to identify any suspicious processes based on defined patterns or heuristics. Frontend Display: When a suspicious process is detected, the details should be displayed in a table format on the frontend, including: Process name Process ID Instruction details Timestamp of detection Alerting/Flagging: The suspicious processes should be flagged or highlighted in some way for easy identification.