Guardd：Isolation Forest Linux 異常偵測系統

🔑 增強重點摘要

• •Guardd leverages the libbpf-go library to interface with eBPF programs, allowing for low-overhead kernel-level event capture without requiring custom kernel modules.
• •The system utilizes a sliding window approach for feature engineering, specifically targeting high-cardinality categorical data by hashing process names and network ports into fixed-size feature vectors.
• •The project architecture separates the data collection agent from the inference engine, enabling the potential for centralized anomaly scoring across multiple Linux nodes.

🛠️ 技術深入

• •Model Architecture: Implements an Isolation Forest algorithm using the scikit-learn framework for offline training, with serialized model weights loaded into the Go-based inference engine.
• •eBPF Integration: Uses kprobes and tracepoints to hook into sys_execve and network socket syscalls, streaming data via perf buffers to user-space.
• •Feature Engineering: Converts raw event streams into 60-second temporal buckets, calculating entropy-based features for process execution frequency and network connection diversity.
• •Normalization: Employs Z-score normalization on numerical features (e.g., packet counts) to mitigate the impact of outliers during the training phase.

🔮 前景展望基於引用來源的 AI 分析

⏳ 時間線