Pull down to go back
Building a Linux Endpoint Detection System with Isolation Forest and eBPF Events

Building a Linux Endpoint Detection System with Isolation Forest and eBPF Events

用隔離森林和 eBPF 事件打造 Linux 端點檢測系統

A developer shares their machine learning project called guardd, a host-based anomaly detection system for Linux. The system uses Isolation Forest to detect suspicious behavior by collecting execution and network events through eBPF, grouping them into 60-second windows, and converting them into feature vectors for scoring. Current features include counts of exec and network events, unique processes, files, IPs, and ports. The creator is seeking feedback on the ML implementation and approach.