Raspberry Pi C++ eBPF App Development
Budget: $30 – $250 USD
Wite a C++ ebpf application for raspberry pi.
The c++ application should read and display on a console :
1. System Call Monitoring
Execve / fork / clone → Detect suspicious process launches.
Open / read / write syscalls → Track file access and modification attempts.
Socket syscalls → Monitor creation of network connections.
2. Process & File Activity
Process creation/termination events → Spot anomalous behavior (e.g., hidden processes).
File access hooks → Identify unauthorized reads/writes in sensitive directories.
Privilege escalation attempts → Trace setuid or capabilities changes.
3. Network Security
XDP (eXpress Data Path) → Inspect packets at the NIC driver level for DoS or intrusion attempts.
Traffic filtering → Block or log suspicious IPs/ports.
AF_XDP sockets → High-performance packet capture for anomaly detection.
4. Kernel Integrity & Security Hooks
LSM (Linux Security Module) hooks → Enforce policies (e.g., deny execution from /tmp).
Kprobes / uprobes → Trace kernel and user-space functions for tampering.
BPF maps → Store and correlate events for real-time analysis.
5. Resource Usage & Anomaly Detection
Memory usage tracking → Detect leaks or malicious consumption.
CPU scheduling hooks → Spot abnormal workloads.
I/O latency profiling → Identify compromised or overloaded subsystems.
With Beyla on a Raspberry 5
The c++ application should read and display on a console :
1. System Call Monitoring
Execve / fork / clone → Detect suspicious process launches.
Open / read / write syscalls → Track file access and modification attempts.
Socket syscalls → Monitor creation of network connections.
2. Process & File Activity
Process creation/termination events → Spot anomalous behavior (e.g., hidden processes).
File access hooks → Identify unauthorized reads/writes in sensitive directories.
Privilege escalation attempts → Trace setuid or capabilities changes.
3. Network Security
XDP (eXpress Data Path) → Inspect packets at the NIC driver level for DoS or intrusion attempts.
Traffic filtering → Block or log suspicious IPs/ports.
AF_XDP sockets → High-performance packet capture for anomaly detection.
4. Kernel Integrity & Security Hooks
LSM (Linux Security Module) hooks → Enforce policies (e.g., deny execution from /tmp).
Kprobes / uprobes → Trace kernel and user-space functions for tampering.
BPF maps → Store and correlate events for real-time analysis.
5. Resource Usage & Anomaly Detection
Memory usage tracking → Detect leaks or malicious consumption.
CPU scheduling hooks → Spot abnormal workloads.
I/O latency profiling → Identify compromised or overloaded subsystems.
With Beyla on a Raspberry 5