Skip to main content

🛰️ Talus

🧪 View animated test results — 9/9 →

eBPF endpoint security agent for Linux — detect ransomware behaviour, respond at the kernel edge.

Talus traces execve, openat, connect, accept, sendto and recvfrom syscalls at the kernel level using eBPF tracepoints, streams events into userspace through per-CPU perf buffers, and surfaces them in a live terminal FrankenTUI — while continuously scoring per-process file-open rates against a sliding window to flag ransomware-style mass file access, and automatically SIGKILL-ing offending processes.

Project status: production-quality Rust + eBPF engineering showcase.

🎯 What it does​

CapabilityDescription
Kernel-level tracingexecve and openat tracepoints attached on every online CPU
Verifier-safe kernel codeUserspace pointers read exclusively via bpf_probe_read_user — never dereferenced
Zero-copy event pipelineFixed-size ProcessEvent records streamed through per-CPU PerfEventArray buffers
Live FrankenTUI7-panel cyberpunk interface: events, processes, network, files, extensions, alerts, heatmap
Sliding-window heuristic1-second rolling window per PID; alerts when a process exceeds the configured open rate
Multiple output modesHuman TUI, newline-delimited JSON, plain text log, and a built-in self-diagnostic
Lost-event accountingPerf-buffer overruns are counted and reported, never silently dropped
Single static binaryFull LTO, panic = "abort", symbol-stripped release profile

⚙️ Architecture​

Kernel-side eBPF programs capture every execve/openat into a compact ProcessEvent record pushed into a PerfEventArray. A dedicated userspace reader thread opens one perf buffer per CPU, decodes events, and forwards them over an MPSC channel to the monitor core, which feeds a 1-second sliding window per PID and emits alerts when the threshold is crossed.

execve/openat ─► eBPF tracepoints ─► EVENTS (PerfEventArray)
                                        │  per-CPU perf buffers
                    reader thread ◄─────┘
                        │  MPSC channel
                   monitor core (sliding window + alerting)
                        │
              TUI / JSON / plain / diagnose

See the full architecture for the complete design.

🚀 Quick start​

# Distro-aware installer (apt, dnf, pacman, zypper, apk, xbps)
./install.sh                       # user-local install to ~/.local
./install.sh --system              # system-wide install to /usr/local

# Or build manually
./build.sh
sudo target/release/process-monitor

🖥️ Usage​

sudo process-monitor                    # TUI (default when stdout is a terminal)
sudo process-monitor --alert-threshold 100   # raise alert threshold (opens/s)
sudo process-monitor --json | jq .      # machine-readable NDJSON
sudo process-monitor --plain            # plain text log
sudo process-monitor --diagnose         # 5-second end-to-end self-diagnostic

TUI keys: q / Esc / Ctrl+C quit · p pause/resume · c clear log · ↑/↓/j/k scroll · PgUp/PgDn faster · Home/End jump.

🛡️ The ransomware heuristic​

For every PID, keep a 1-second sliding window of openat calls. If the window contains ≥ N opens (default 50), emit an alert.

  • Sliding window, not a rate counter — bursts are caught as reliably as steady streams
  • Per-process isolation — no cross-process false positives
  • --alert-threshold 0 disables the heuristic entirely

📦 Project layout​

talus-process-monitor/
├── process-monitor/          # Userspace: monitor core + TUI + web + FFI
│   └── src/
│       ├── main.rs           # CLI, mode selection, signal handling
│       ├── monitor.rs        # eBPF loading, perf reader, sliding-window tracker
│       └── tui.rs            # 7-panel frankentui (ftui) cyberpunk interface
├── process-monitor-ebpf/     # Kernel side (#![no_std], aya-ebpf)
│   └── src/main.rs           # tracepoint hooks → PerfEventArray
├── build.sh                  # Build script (nightly for eBPF, stable for TUI)
├── install.sh                # Distro-aware installer / uninstaller
└── ARCHITECTURE.md           # Full design document

🔧 Requirements​

  • Linux kernel 5.8+ (eBPF + tracepoint support)
  • root (CAP_BPF / CAP_SYS_ADMIN) to load and attach eBPF programs
  • Rust nightly + rust-src for the eBPF crate; stable for userspace
  • bpf-linker, clang, C compiler; BTF (/sys/kernel/btf/vmlinux) recommended
Last updated on