Selected work
Runtime security
Seeing what the kernel sees
An eBPF-based runtime detection system for production Linux hosts, built for the questions logs can’t answer honestly.
AI Platform Security Engineer · ISS STOXX · details generalised; specifics stay internal
The problem
Application logs describe what software intended to do. Detecting privilege escalation, resource exhaustion, or sensitive file access needs visibility from the layer that actually enforces it.
The approach
- 01Instrumented the kernel with eBPF to capture privilege changes, OOM events, network activity, and access to sensitive files.
- 02Deployed it across production hosts as a continuous detection layer rather than a one-off investigation tool.
The outcome
Kernel-level visibility into privilege escalation and anomalous behaviour across production hosts.
Stack
eBPF · Linux · Syscall tracing · Runtime detection