# sys\_enter

Published articles for sys\_enter.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Process Behaviour Anomaly Detection Using eBPF and Unsupervised-Learning Autoencoders

DevFeed: [Process Behaviour Anomaly Detection Using eBPF and Unsupervised-Learning Autoencoders](<https://devfeed.tech/articles/process-behaviour-anomaly-detection-using-ebpf-and-unsupervised-learning-autoencoders-41266.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/>)

Author: Simone Margaritelli

Published: 2022-08-15T14:06:05Z

Content type: tutorial

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [eBPF](<https://devfeed.tech/topics/ebpf.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Linux Kernel](<https://devfeed.tech/topics/linux-kernel.md>), [Learning](<https://devfeed.tech/topics/learning.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [anomaly-detection](<https://devfeed.tech/tags/anomaly-detection.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [autoencoder](<https://devfeed.tech/tags/autoencoder.md>), [bcc](<https://devfeed.tech/tags/bcc.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [deep-learning](<https://devfeed.tech/tags/deep-learning.md>), [deep-neural-networks](<https://devfeed.tech/tags/deep-neural-networks.md>), [defensive-security](<https://devfeed.tech/tags/defensive-security.md>), [dnn](<https://devfeed.tech/tags/dnn.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [github](<https://devfeed.tech/tags/github.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [kprobe](<https://devfeed.tech/tags/kprobe.md>), [kretprobe](<https://devfeed.tech/tags/kretprobe.md>), [linux](<https://devfeed.tech/tags/linux.md>), [linux-security](<https://devfeed.tech/tags/linux-security.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [neural-networks](<https://devfeed.tech/tags/neural-networks.md>), [process-anomaly-detection](<https://devfeed.tech/tags/process-anomaly-detection.md>), [process-behaviour](<https://devfeed.tech/tags/process-behaviour.md>), [raw-syscalls](<https://devfeed.tech/tags/raw-syscalls.md>), [runtime-protection](<https://devfeed.tech/tags/runtime-protection.md>), [sys-enter](<https://devfeed.tech/tags/sys-enter.md>), [syscall-tracing](<https://devfeed.tech/tags/syscall-tracing.md>), [tensorflow](<https://devfeed.tech/tags/tensorflow.md>), [tracepoint](<https://devfeed.tech/tags/tracepoint.md>), [unsupervised-learning](<https://devfeed.tech/tags/unsupervised-learning.md>)

### AI overview

This tutorial describes using eBPF syscall tracing and an unsupervised autoencoder to detect process behavior anomalies at runtime. It explains an approach that models syscall frequency without requiring an explicit allowlist and discusses potential detection of exploitation, denial-of-service, and other attacks.

### Source excerpt

Hello everybody, I hope you've been enjoying this summer after two years of Covid and lockdowns :D In this post I'm going to describe how