Guardd: Isolation Forest Linux Anomaly Detection

🔑 Enhanced Key Takeaways

• •Guardd leverages the libbpf-go library to interface with eBPF programs, allowing for low-overhead kernel-level event capture without requiring custom kernel modules.
• •The system utilizes a sliding window approach for feature engineering, specifically targeting high-cardinality categorical data by hashing process names and network ports into fixed-size feature vectors.
• •The project architecture separates the data collection agent from the inference engine, enabling the potential for centralized anomaly scoring across multiple Linux nodes.

🛠️ Technical Deep Dive

• •Model Architecture: Implements an Isolation Forest algorithm using the scikit-learn framework for offline training, with serialized model weights loaded into the Go-based inference engine.
• •eBPF Integration: Uses kprobes and tracepoints to hook into sys_execve and network socket syscalls, streaming data via perf buffers to user-space.
• •Feature Engineering: Converts raw event streams into 60-second temporal buckets, calculating entropy-based features for process execution frequency and network connection diversity.
• •Normalization: Employs Z-score normalization on numerical features (e.g., packet counts) to mitigate the impact of outliers during the training phase.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline