eBPF Syscall Anomaly Detection 2D: Container Runtime Defense

Twelve containerized pods sit on a 2D cluster floor, each streaming its syscalls upward past a translucent eBPF probe line as colored packets — green for common calls, amber for uncommon ones, red for rare calls like ptrace or mount. Click a target pod (or pick one from the dropdown) and a compromise scenario (C2 beaconing, privilege escalation, or a crypto miner) and watch its behavior sample from an attacker-shaped syscall distribution while a real exponentially-weighted "surprise" score — computed against the same learned baseline every pod is checked against — climbs a live scrolling strip chart toward a tunable detection threshold. Cross it in Alert Only mode and the pod flags red for triage; cross it in Auto-Kill mode and the runtime terminates the pod on the spot, respawning a clean replacement a few seconds later, with live readouts for syscall throughput, time-to-detection, and pods alive versus killed.