Next-Gen K8s Threat Hunting: GenAI & eBPF
summary
Claim: a working pipeline uses eBPF hooked to exec syscall to stream kernel events into a Python + OpenAI parsing pipeline that detects anomalous behavior (nmap scans, unexpected UID/args, capability drops) and flags exposures like access to /etc/passwd. The demo deploys eBPF via an operator in Kubernetes, maps events to MITRE ATT&CK techniques, sends proactive alerts to an observability dashboard, and runs in CI to reduce false positives and catch attacks before deployment.
AI-written summary · about
chapters (7)
- 0:00Introduction and Speaker Introductions
- 1:01Agenda Overview
- 1:19Motivation for Proactive Threat Hunting
- 6:04Understanding eBPF
- 9:04Traditional vs. Proactive Threat Hunting
- 14:53Live Demo: Proactive Threat Detection
- 21:17Conclusion and Final Thoughts
related talks
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
37mProactive Kubernetes Security: Anomaly Detection and Runtime Alertin...
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
36meBPF for Runtime Security
25mProtecting Modern Workloads with eBPF superpowers
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
12mKeynote: K8s Security Safari: Hunting Threats in the Wild Wild Cloud
25mSecuring AI Pipelines: Real-World Attacks on Kubernetes-Based AI Infrastructure