CoolFace
Apppublic

clydecoutinho/ebpf-security-demo

sourceHugging Faceapache-2.0updated 19d agoView on Hugging Face
0likes
App README

eBPF Autonomous Security Platform

A production-grade autonomous security system built on Tetragon + Cilium, running on ARM64 Oracle Cloud infrastructure.

What this demo shows

  • —21 active TracingPolicies — 13 enforcing via SIGKILL before syscall returns; 6 forensics/audit; 2 alert-only. Covers 22 MITRE ATT&CK technique classes across Privilege Escalation, Defense Evasion, Credential Access, C2, and Exfiltration
  • —Autonomous threat intel pipeline — 19 sources (CISA KEV, NVD, SANS ISC, GreyNoise, Unit 42, Securelist, URLhaus + more) harvested every 4 hours; 868+ items ingested, TracingPolicy YAML candidates auto-generated via Gemini 2.5 Flash with DSPy structured pipeline
  • —Cross-domain inference engine — maps eBPF detection problems to solved problems across 48 scientific domains (immunology, epidemiology, materials science, logistics, game theory)
  • —Splunk HEC integration — Tetragon events streamed as cisco:isovalent:processExec sourcetype (the official Cisco/Isovalent production sourcetype)
  • —IoT monitoring — three IoT pods (env sensor, camera, MQTT gateway) monitored at kernel level with zero agents on the devices

Demo pages

PageDescription
PortalLive threat intel stats, service health, active policy list, AR examples
WalkthroughInteractive 9-step tour through all system layers
Study GuideTechnical deep-dive: eBPF internals, TracingPolicy YAML, ARM64 gotchas, ATT&CK coverage

Architecture

CISA KEV + NVD + SANS ISC
        ↓  (every 4h)
    SQLite store
        ↓
  Gemini 2.5 Flash  →  ARM64-validated TracingPolicy YAML
        ↓
   kubectl apply   →  Tetragon kprobe loads in kernel
        ↓
  Kernel events    →  Splunk HEC (cisco:isovalent:processExec)
        ↓
  AR Engine        →  Cross-domain detection insights

Stack

  • —Kubernetes: k3s v1.35.4 on ARM64 (Oracle Cloud Ampere A1)
  • —Networking: Cilium v1.19.3 (eBPF-native CNI, replaces iptables)
  • —Tracing: Tetragon v1.7.0 (kernel-level enforcement)
  • —AI: Gemini 2.5 Flash (11-key free pool, policy generation + AR inference)
  • —SIEM: Splunk HEC (cisco:isovalent:processExec sourcetype)
  • —This proxy: FastAPI + httpx, read-only endpoints only

Security design

This HuggingFace Space is a read-only proxy. No write or deploy endpoints are exposed. The FastAPI proxy (app.py) only relays GET requests to a limited set of endpoints. CORS is restricted to *.hf.space origins. The OCI backend URL is stored as a HF Secret — never embedded in HTML.

If the backend is unreachable, all endpoints return realistic mock/demo data so the UI remains functional.

Built by

Clyde Coutinho · Apache 2.0