# defensive security

Published articles for defensive security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Process Behaviour Anomaly Detection Using eBPF and Unsupervised-Learning Autoencoders

DevFeed: [Process Behaviour Anomaly Detection Using eBPF and Unsupervised-Learning Autoencoders](<https://devfeed.tech/articles/process-behaviour-anomaly-detection-using-ebpf-and-unsupervised-learning-autoencoders-41266.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/>)

Author: Simone Margaritelli

Published: 2022-08-15T14:06:05Z

Content type: tutorial

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [eBPF](<https://devfeed.tech/topics/ebpf.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Linux Kernel](<https://devfeed.tech/topics/linux-kernel.md>), [Learning](<https://devfeed.tech/topics/learning.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [anomaly-detection](<https://devfeed.tech/tags/anomaly-detection.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [autoencoder](<https://devfeed.tech/tags/autoencoder.md>), [bcc](<https://devfeed.tech/tags/bcc.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [deep-learning](<https://devfeed.tech/tags/deep-learning.md>), [deep-neural-networks](<https://devfeed.tech/tags/deep-neural-networks.md>), [defensive-security](<https://devfeed.tech/tags/defensive-security.md>), [dnn](<https://devfeed.tech/tags/dnn.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [github](<https://devfeed.tech/tags/github.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [kprobe](<https://devfeed.tech/tags/kprobe.md>), [kretprobe](<https://devfeed.tech/tags/kretprobe.md>), [linux](<https://devfeed.tech/tags/linux.md>), [linux-security](<https://devfeed.tech/tags/linux-security.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [neural-networks](<https://devfeed.tech/tags/neural-networks.md>), [process-anomaly-detection](<https://devfeed.tech/tags/process-anomaly-detection.md>), [process-behaviour](<https://devfeed.tech/tags/process-behaviour.md>), [raw-syscalls](<https://devfeed.tech/tags/raw-syscalls.md>), [runtime-protection](<https://devfeed.tech/tags/runtime-protection.md>), [sys-enter](<https://devfeed.tech/tags/sys-enter.md>), [syscall-tracing](<https://devfeed.tech/tags/syscall-tracing.md>), [tensorflow](<https://devfeed.tech/tags/tensorflow.md>), [tracepoint](<https://devfeed.tech/tags/tracepoint.md>), [unsupervised-learning](<https://devfeed.tech/tags/unsupervised-learning.md>)

### AI overview

This tutorial describes using eBPF syscall tracing and an unsupervised autoencoder to detect process behavior anomalies at runtime. It explains an approach that models syscall frequency without requiring an explicit allowlist and discusses potential detection of exploitation, denial-of-service, and other attacks.

### Source excerpt

Hello everybody, I hope you've been enjoying this summer after two years of Covid and lockdowns :D In this post I'm going to describe how

## Hide Your Servers in Plain Sight, Presenting ShieldWall

DevFeed: [Hide Your Servers in Plain Sight, Presenting ShieldWall](<https://devfeed.tech/articles/hide-your-servers-in-plain-sight-presenting-shieldwall-41265.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2021/02/13/Hide-your-servers-in-plain-sight-presenting-ShieldWall/>)

Author: Simone Margaritelli

Published: 2021-02-13T14:34:28Z

Content type: release

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Server](<https://devfeed.tech/topics/server.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>), [Raspberry Pi](<https://devfeed.tech/topics/raspberry-pi.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [defensive-security](<https://devfeed.tech/tags/defensive-security.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [go](<https://devfeed.tech/tags/go.md>), [golang](<https://devfeed.tech/tags/golang.md>), [iptables](<https://devfeed.tech/tags/iptables.md>), [network-security](<https://devfeed.tech/tags/network-security.md>), [project-release](<https://devfeed.tech/tags/project-release.md>), [raspberry-pi](<https://devfeed.tech/tags/raspberry-pi.md>), [remote-firewall-instrumentation](<https://devfeed.tech/tags/remote-firewall-instrumentation.md>), [secret](<https://devfeed.tech/tags/secret.md>), [server](<https://devfeed.tech/tags/server.md>), [server-hardening](<https://devfeed.tech/tags/server-hardening.md>), [servers](<https://devfeed.tech/tags/servers.md>), [shieldwall](<https://devfeed.tech/tags/shieldwall.md>)

### AI overview

This article introduces ShieldWall, a project intended to keep personal or sensitive services accessible across changing device IP addresses while limiting access to authorized devices at the packet level. It discusses Arc as a use case and mentions encrypted data, public servers, and hidden infrastructure for red team operations.

### Source excerpt

Long time no see friends! Despite this break period ended up not being as long as I hoped