往下拉回到首頁
用 AI 異常偵測 + Linux 核心監控,自己打造企業級資安防線

用 AI 異常偵測 + Linux 核心監控,自己打造企業級資安防線

Isolation Forest + eBPF events to create a Linux based endpoint detection system [P]

Hey everyone. I’ve been working on a machine learning project called guardd and wanted to get some feedback on the ML side of it. It’s basically a host-based anomaly detection system for Linux using Isolation Forest. I’m collecting exec and network events, grouping them into 60 second windows, then turning that into feature vectors that get scored by the model. Right now the features are things like counts of exec and network events, how many unique processes, files, IPs and ports show up in a