S.T.A.R — System Threat & Anomaly Radar

Problem context

Endpoint security tools that run in userspace are blind to kernel-level rootkits that patch system call tables, hide processes via DKOM (Direct Kernel Object Manipulation), and intercept I/O requests. Security analysts need kernel-level visibility without the instability of traditional kernel modifications.

Implementation approach

Developed a Windows WDM kernel driver that monitors SSDT hooks, callback registrations, inline code patches, and IAT anomalies in real time.

Implementation approach (2)

Built a companion Linux kernel module that detects /proc tampering, hidden processes, and suspicious module loads.

Outcome and delivery impact

S.T.A.R provides kernel-level visibility with less than 2% CPU overhead during idle monitoring and peaks at 6% during full memory scans. Event latency from kernel to dashboard averages 8ms.

Outcome and delivery impact (2)

The WebGL visualization handles real-time rendering of threat graphs with thousands of nodes by batching geometry updates. Analysts reported 40% faster threat triage compared to log-based tools.

Reported metrics

• Event Latency
  Reported value: 8ms
• Idle CPU Overhead
  Reported value: < 2%
• Faster Triage
  Reported value: 40%
• Platforms (Win + Linux)
  Reported value: 2

Technologies involved

• C
  Open the technology archive to view related project work.
• WDM
  Open the technology archive to view related project work.
• Linux Kernel
  Open the technology archive to view related project work.
• Electron
  Open the technology archive to view related project work.
• WebGL
  Open the technology archive to view related project work.
• Three.js
  Open the technology archive to view related project work.