[archived] 一款实验性质的主机入侵检测系统

Hades is a Host-Based Intrusion Detection System based on eBPF(mainly)

eBPF-based Security Observability and Runtime Enforcement

A Linux Host-based Intrusion Detection System based on eBPF.

Linux Kernel Runtime Guard

Kernel-Mode Rootkit Hunter

By Kprobe technology Open Source Host-based Intrusion Detection System(HIDS), from E_Bwill.

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practi…

A golang ebpf libary based on cilium/ebpf and datadog/ebpf.

Cloud Native Runtime Security

Linux Runtime Security and Forensics using eBPF

Library-Level eBPF Sandbox for Python (Linux & macOS): syscall-level control per module.

Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.

一个基于jvm-sandbox高度定制化rasp

Falco rule repository

Use kprobe capture common kernel event and can also use for hids agent（kernel module）

Hades is a Host-Based Intrusion Detection System based on both eBPF(kernel) and netlink/cn_proc(userspace).

Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)