<story><title>Process behaviour anomaly detection using eBPF and unsupervised learning</title><url>https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/</url></story><parent_chain></parent_chain><comment><author>egberts1</author><text>Far much easier to suppress kernel&amp;#x2F;driver log of kernel addresses and deny access to &amp;#x2F;dev&amp;#x2F;kmem, et. al.&lt;p&gt;Leaving eBPF access open demonstratively has made way for file-less persistent malware to linger on unwantedly.&lt;p&gt;A real cybersecurity specialist would only allow eBPF access on host OS if no network access can be made to the host OS (and its ok for guest VMs to have eBPF).&lt;p&gt;An Uber cybersecurity goon, however, would compile out the eBPF JIT access from the Linux kernel (or use BSD-variant, instead).</text></comment>
<story><title>Process behaviour anomaly detection using eBPF and unsupervised learning</title><url>https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/</url></story><parent_chain></parent_chain><comment><author>brodouevencode</author><text>The github link if you just want to look at the code: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;evilsocket&amp;#x2F;ebpf-process-anomaly-detection&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;evilsocket&amp;#x2F;ebpf-process-anomaly-detection&lt;/a&gt;</text></comment>