Zero-Configuration Runtime Software Component Detection
summary
Implements a zero‑configuration runtime detector that uses eBPF kretprobe on read to capture Java process reads, reconstructs zip structures (EOCDR, CDR, local file headers) in-kernel maps, delivers compressed Manifest MF chunks to userspace for inflation and parsing, and extracts component title/version. A prototype verifies Log4j and Spring Core at runtime and is used to scan 2,500 Docker Hub images (May 2022), finding multiple vulnerable Log4j and Spring Core versions and exposing gaps in Hub scans and misuse of the latest tag.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:23Software Configuration Analysis
- 3:22Runtime Software Component Detection Using Ebpf
- 5:58Types of Data in the C5 Format
- 10:33Summary of the 12 Valentines Software Compound Detection Method
related talks
33mThe Runtime Rodeo; Where Open Source Image Behavior Is Tamed
41mIdentifying and Mitigating Cloud and Container Threats
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
48mA Novel Runtime Technique For Identifying Malicious Applications
26mContainers: Your Ally in Improving Security
52mSecuring Your Java Containers by Breaking In
49mOpen-source vulnerability management? Use the source, Luke!
46mThe Next Log4jshell?! Preparing for CVEs with eBPF!