3 ms·
Somewhat related: https://github.com/draios/falco https://github.com/draios/falco "Sysdig Falco is a behavioral activity monitor designed to detect anomalous a
by avtar 10y ago
Somewhat related: https://github.com/draios/falco https://github.com/draios/falco
"Sysdig Falco is a behavioral activity monitor designed to detect anomalous activity in your applications. Powered by sysdig’s system call capture infrastructure, falco lets you continuously monitor and detect container, application, host, and network activity... all in one place, from one source of data, with one set of rules."
- synctext 10y agoThe code underlying the OP research: https://github.com/vivami/grey_fox https://github.com/vivami/grey_fox "The grey fox is a kernel extension for Mac OS X that logs performed system calls by any process running on the system. Research for my master thesis required a dataset of all system calls performed by benign as well as malicious processes (malware). After analysis of the gathered datasets, several system call patterns that identified malware were extracted. " (disclaimer: I was one of the three professors on the msc thesis committee for this work)