eBPF is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.
It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.
Monitor Network Traffic Per Executable, Beautifully Visualized
Dump unix domain socket traffic with bpf
Performance visualisation tools
The first open-source eBPF sandbox for Python (macOS/Linux): Secure libraries, block RCE, and enforce precise syscall control. Dive into module & package-level security now.
Demos for Pixie: github.com/pixie-io/pixie
Monitor DNS queries by host processes using eBPF!
Real-time monitoring of KVM/Qemu VMs
🐝 Ransomware Detection using Machine Learning with eBPF for Linux.
[Deplicated] Now we have more sophisticated (and compact) implementation in ipftrace2 repository. Please check it as well.
ebpH (Extended BPF Process Homeostasis) monitors process behavior on your system to establish normal behavioral patterns. ebpH reports anomalous behavior and prevents attacks by denying anoamlous access requests.
eBPF-Based NFS Telemetry Exporter for Kubernetes