eBPF Interactive Playground — linux-hpc-security

Syscall

Verifier

Ring Buffer

TypeSafe AI

XDP Firewall

K8s AutoSOC

🎓

Quiz

🗺️ The Autonomous SIEM Pipeline — What You Are Building

Each lab corresponds to a real stage in our capstone. A reverse shell detected at Ring 0 becomes an autonomous cluster-wide quarantine in 400ms — zero human in the loop. Animate it below.

🔴

eBPF Hook

sys_enter_execve
Ring 0 · Kernel

→

🔵

Ring Buffer

BPF_PERF_OUTPUT
Zero-copy

→

🐍

Python Agent

Heuristic filter
Ring 3

→

🧠

TypeSafe AI

Noul · Choice
Deterministic

→

☸️

K8s Operator

NetworkPolicy
Quarantine

💡

Key Insight

PID 442644 executing nc -e /bin/bash was detected and the pod isolated in under 400ms. No human in the loop. No hallucination possible.

🔴 Lab 1 — Syscall Interceptor · Ring 0 eBPF

🔴 Lab 1 — Syscall Scenario Simulator Ring 0

Pick a scenario. The eBPF tracepoint fires on sys_enter_execve and extracts PID/PPID from task_struct. Can you identify the real reverse shell vs false positives — like a Tier-2 SOC analyst would?

sys_enter_execve task_struct BPF_PERF_OUTPUT

👆 Select a scenario → read the eBPF telemetry → make your call

💻Reverse Shellnc -e /bin/bash
PID: 442644

🖥️GNOME Terminalvte-urlencode-cwd
Harmless?

🔑SSH Loginsshd → bash
Lateral move?

🕸️Web Shellapache → bash → nc
Critical!

⚙️Cron Jobcron → /usr/bin/nc
Scheduled?

🧪Scannernmap → nc
Pen test?

🎯

Challenge

"GNOME Terminal" matches the 'nc' substring — our naive detector flagged it as a THREAT. This is the real false positive from Test 1. TypeSafe AI (Lab 4) fixes it by evaluating the full parent chain, not just the filename.

🛡️ Lab 2 — eBPF Verifier · Mathematical Safety

💣 Lab 2A — Inject a Bomb dangerous

Try to slip malicious code past the Verifier. It statically proves all execution paths before a single instruction runs. No sampling. No fuzzing. Mathematical certainty.

Clang JIT BPF Verifier

👆 Select injection type — watch the Verifier pipeline respond

Code Injection Type

🎯

Challenge

Select "bigloop" → Verifier rejects at 1M instruction limit. Same loop as a .ko module = kernel panic. This is why eBPF replaced kernel modules at Meta & Cloudflare.

⚔️ Lab 2B — .ko Module vs eBPF comparison

Same malicious code, two runtimes. See exactly why eBPF is safe and kernel modules are not.

👆 Select attack — see both outcomes side-by-side

Attack Scenario

💀 .ko Kernel Module

🛡️ eBPF Program

💡

The Math

eBPF Verifier models every execution path and proves termination. Deployed by Meta, Cloudflare, and Google in production kernels.

🔵 Lab 3 — BPF Ring Buffer · Zero-Copy Data Path

🔵 Lab 3 — Ring Buffer Live Visualizer zero-copy

Visualize BPF_PERF_OUTPUT streaming kernel events to user-space asynchronously. Overwhelm the buffer to watch events drop — exactly what happens during a DDoS if your detector polls too slowly.

BPF_PERF_OUTPUT perf_buffer.poll()

👆 Increase event rate to simulate a DDoS — watch drops turn red

Kernel event rate (ev/s): 20 Ring buffer capacity (slots): 32 Agent poll speed (ms): 50

🎯

Challenge

Set rate=100, buffer=8, poll=500ms → drops appear in red. This is why detector.py polls at 100ms. Set rate=5, buffer=64 → zero drops. This balance determines real-world fidelity.

🧠 Lab 4 — TypeSafe AI Decision Engine

🎰 Lab 4A — Slot Machine vs ChatGPT deterministic

TypeSafe Choice always returns one of three hard-coded enums. ChatGPT returns free text — which breaks autonomous pipelines. Feed telemetry and compare both outputs.

Noul primitive Choice primitive

👆 Change process + parent — watch typed vs free-text respond

Process Parent Process

🧠 TypeSafe (typed)

💬 Generic LLM (free text)

🎯

Challenge

nc + apache2 → KILL_PROCESS at 97%. vte-urlencode-cwd + gnome-terminal → IGNORE. Same binary, entirely different context. String matching cannot do this.

📊 Lab 4B — Noul Signal Composer live

TypeSafe Noul must return float 0.0–1.0. Toggle threat signals to build the composite probability. Cross the threshold — trigger the action automatically.

👆 Toggle signals → watch probability compose in real time

0.0 — IGNORE0.6 — ALERT0.8 — QUARANTINE1.0 — KILL

💡

Enterprise Insight

Multi-signal composition is exactly how SIEM correlation rules work — but TypeSafe makes the probability a typed, auditable float that code can act on directly, not a human's gut feeling.

🔥 Lab 5 — XDP Firewall · Hardware-Speed DDoS Defense

🔥 Lab 5 — XDP CPU Gauge Simulator hardware speed

Simulate a DDoS attack. Traditional iptables processes packets deep inside the kernel. XDP drops them at NIC level before sk_buff allocation. See the CPU delta — this is the Cloudflare model at Terabit scale.

XDP_DROP XDP_PASS iptables

👆 Ramp up attack — iptables CPU spikes, XDP stays flat

Attack Packets/sec: 0 Firewall Mode Attack Type

🎯

Challenge

5M PPS + iptables → CPU 94% → unresponsive. 5M PPS + XDP → CPU 3% → fully operational. This delta is why Cloudflare absorbs Terabit DDoS attacks without breaking a sweat.

☸️ Lab 6 — Kubernetes AutoSOC Operator

☸️ Lab 6 — AutoSOC Cluster Simulator self-healing

Simulate a live Kubernetes cluster of 12 pods. Inject a reverse shell. Watch the Go Operator detect the label security=compromised and isolate the pod with a NetworkPolicy — the immune system in action.

Reconciler Loop TypeSafe KILL NetworkPolicy

👆 Click a pod to compromise it manually, or use the action buttons

🔴

eBPF Detects

sys_enter_execve

→

🧠

TypeSafe KILL

Noul=0.95

→

🏷️

Label Pod

security=compromised

→

☸️

Reconciler

NetworkPolicy

→

🔒

Isolated

400ms total

💡

Self-Healing Infrastructure

The analyst reviews this on Monday morning. The cluster protected itself at 3am Friday. That's the difference between a $2M SIEM contract and a Go operator on a $50/month node.

🎓 SOC Engineer Quiz · Test Your Knowledge

🎓 SOC Quiz earn XP

8 questions modeled on real SOC Tier-2 analyst and SRE interview questions. Each correct answer = 25 XP.