Relational Observability for Cloud-Native Security and Data Science
summary
SysFlow captures eBPF system calls, transforms them via libsysflow and a sysflow-collector into an object-relational format, and the stream processor builds behavioral graphlets and exports Avro for analysis. A 12-node Kubernetes test produces 3.8 GB of traces turned into 35,500 graphs; streaming rate modulation reduces ~4.1M raw events to ~44k forwarded records. Python APIs and a Jupyter demo show TTP tagging, graph-embedding clustering that isolates high-severity red‑team attacks, and provenance queries that reveal exploit chains and exfiltration.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:23Runtime observability
- 3:50Multi-level data abstraction
- 5:55SysFlow pipeline
- 8:28SysFlow format
- 11:38Analyzing SysFlow
- 16:14Behavioral graphlets
- 17:38Rate modulation
- 20:08Graph learning for Kubernetes
- 27:09Live demo
- 31:02Provenance tracking
- 36:56Supply chain attacks
- 45:05Q&A
related talks
45mConnecting the dots to go from tabular security incident data to behavioral graph understanding
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
45mTracing: A journey to tactical insights
54mLatency and Event Tracing with Spring Cloud Data Flow
14mCloudFlow: Identifying Security-sensitive Data Flows in Serverless
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
01h 02mAdding Observability to Distributed Systems
37mMonitoring Service Architecture and Health with BPF