An enterprise-grade, kernel-level threat detection and mitigation system built with eBPF (tracepoint, kprobe), modern C++, libbpf, and a Python Streamlit SIEM dashboard.

Architecture

• Kernel Space (eBPF):

  • Process Monitoring: Hooks into sched/sched_process_exec tracepoint.
  • Network Telemetry: Hooks into tcp_v4_connect kprobe to track outbound IPv4 traffic.
  • Dynamic Threat Intel: Utilizes kernel BPF_MAP_TYPE_HASH map for instant IP blocklist lookups.
  • Container Tracking: Uses bpf_get_current_cgroup_id() to map security events to Docker/Kubernetes container workloads.
  • Fileless Execution Detection: Hooks into sys_enter_memfd_create to catch memory injection attempts.

• User Space (C++ Engine):

  • Injects dynamic threat intel feeds into kernel eBPF maps.
  • Evaluates network connection velocity heuristics.
  • Automated threat mitigation using kill(pid, SIGKILL).
  • Outputs structured JSON telemetry stream to security_alerts.json.

• Frontend UI (Streamlit SIEM):

  • Displays real-time metrics and isolated data tables for Terminated Threats vs. Network Telemetry.

---

Quickstart Guide

Prerequisites

• Kali Linux / Debian-based system (Kernel 5.8+)
• Dependencies: clang, libbpf-dev, g++, bpftool, python3-venv

1. Build and Run Backend

# Generate kernel header
bpftool btf dump file /sys/kernel/btf/vmlinux format c > src/vmlinux.h

# Compile project
make

# Run C++ eBPF sensor
sudo ./cryptodetect