Zero-Day Guardian

Problem context

Traditional container security tools operate in userspace and miss fast breakouts, rootkit installations, and data exfiltration that happen below their visibility layer. Forensic evidence is lost when containers are killed, leaving incident response teams with nothing to analyze.

Implementation approach

Built an eBPF-based sensor layer in Rust that hooks into kernel syscalls (execve, open, connect) to detect anomalous behavior with nanosecond precision and near-zero overhead.

Implementation approach (2)

Created a Java/Spring Boot orchestration layer that aggregates events, correlates indicators with threat-intel feeds, and classifies threats using a graduated response model.

Outcome and delivery impact

The system detects container threats within 200ms of the initial anomalous event — 10x faster than comparable userspace solutions. Automated response eliminates the 15-30 minute window between detection and containment that manual processes require.

Outcome and delivery impact (2)

Forensic evidence capture runs before containment actions, ensuring no data is lost when containers are terminated. The eBPF sensor layer adds less than 2% CPU overhead during normal operation.

Reported metrics

• Detection Latency
  Reported value: < 200ms
• CPU Overhead
  Reported value: < 2%
• Less False-Positive Downtime
  Reported value: 85%
• Languages (Java, Go, Rust)
  Reported value: 3

Technologies involved

• Java
  Open the technology archive to view related project work.
• Spring Boot
  Open the technology archive to view related project work.
• Go
  Open the technology archive to view related project work.
• Kubebuilder
  Open the technology archive to view related project work.
• Rust
  Open the technology archive to view related project work.
• eBPF
  Open the technology archive to view related project work.
• Kubernetes
  Open the technology archive to view related project work.
• Docker
  Open the technology archive to view related project work.