eBPF Cloud Runtime Security Monitor
ECRSM is an educational eBPF-based Cloud Runtime Security Monitor. It provides a synthetic, read-only runtime visibility stack combining kernel eBPF, a Go agent, and a React dashboard.
01 / Overview
- 01eBPF (C)
- 02Go (Agent)
- 03React (Dashboard)
- 04Kubernetes (Helm)
Problem
Understanding runtime security at the kernel level is complex. ECRSM provides a safe, educational platform to learn eBPF-based monitoring.
Solution Overview
- Implemented eBPF hooks for safe syscall tracepoints
- Built a Go agent to collect and enrich metadata
- Created a real-time React dashboard for visualisation
- Designed safe synthetic attack simulations
02 / Evidence
Proof & Verification
- Detects reverse shells, process injection, suspicious execs
- Low-overhead perf buffer data transmission
- Container/K8s metadata enrichment
- Verifiable via synthetic attack scripts
03 / Methods
Build
Tech Stack
- eBPF (C)
- Go (Agent)
- React (Dashboard)
- Kubernetes (Helm)
- Kernel tracepoints (execve, connect, ptrace, mmap)
- Go agent for enrichment & rules
- Live WebSocket dashboard
- Kubernetes DaemonSet deployment
Secure
- Read-only introspection (no kernel writes)
- Metadata only (no payloads/secrets)
- Least privilege (BPF/SYS_ADMIN caps only)
- Safe synthetic simulations