Runtime Security at Scale With EBPF: Hybrid Detection and Root Cause…
summary
Claims a kernel-level eBPF pipeline (one agent per node) that captures syscall and network lifecycle signals to see ephemeral activity missed by user‑space tools — note: 72% of containers live <5 minutes. Raw events feed Apache pulser topics and a graph DB to build stable process lineage; 107 custom detectors map to 81 MITRE techniques. A temporal graph GNN with dual decoders flags point and contextual anomalies and a constrained RAG+LLM stage drafts auditable YAML policies and root‑cause summaries.
AI-written summary · about
chapters (13)
- 0:00Runtime security with eBPF intro
- 2:48Traditional tools in Kubernetes fail
- 5:15eBPF for kernel visibility
- 8:06System architecture overview
- 13:02Kernel hooks and event processing
- 15:34Live attack sequence detection
- 17:11Storing detection context
- 18:58Cluster-wide security monitoring
- 19:18AI-driven detection layers
- 23:55LLMs for threat analysis
- 24:57Automating threat hunting
- 27:05Closing analyst loop
- 28:52Q&A
related talks
36meBPF for Runtime Security
40mExploring Runtime Security and Forensic using eBPF
16meBPF for Creating Least Privileged Policies; What Do I Need to Know to Prepare for the Next CVEs?
14mWill eBPF Save Us From the Next Global Outage?
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
32mExploring the Power of eBPF for System Observability
39mFinding the Needles in a Haystack: Identifying Suspicious Behaviors...