A real eBPF-based runtime monitor (e.g. Falco, Tetragon) attaches probes to kernel syscall entry points and scores each event against a learned baseline of "normal" process behavior — it never needs to know an attack signature in advance, only that the behavior is statistically rare.
surprise(s) = -log2( P_baseline(s) )
score_t = λ · score_(t-1) + (1-λ) · surprise(s_t) (EWMA, λ = 0.85)
alert fires when score_t > threshold
Every container samples syscalls (read, write, epoll_wait, futex, openat, close, mmap, connect, execve, ptrace, mount, setuid) from the same learned baseline distribution — common calls carry low "surprise" in bits, rare ones carry high surprise. A compromised pod is reweighted toward a different, attacker-shaped distribution (frequent outbound connect for a C2 beacon, ptrace/setuid for privilege escalation, mmap/execve churn for a crypto miner) while the detector keeps scoring every call against the *original* baseline — that mismatch is what makes the average surprise climb. Numerically the baseline's own entropy sits near 2.7 bits, while the three attack mixes cross-entropy against that same baseline at roughly 4.3–5.8 bits — which is why a 4.0-bit default threshold reliably catches privilege escalation and crypto-mining but only marginally catches a C2 beacon (a deliberately realistic trade-off, not a bug).
- Target container — click any pod tile on the canvas (or use the dropdown) to choose which of the 12 pods receives the compromise scenario; the other 11 keep emitting purely benign traffic as a visual control group.
- Compromise scenario — switches the target's sampling distribution; "Benign" returns it to the baseline.
- Detection threshold — the EWMA score (in bits) that triggers an alert, drawn as a dashed line on the strip chart below. Lower catches attacks faster but risks false positives from rare-but-legitimate calls like
ptrace during debugging.
- Alert Only vs Auto-Kill — Alert Only leaves the compromised pod running (flagged red) for triage; Auto-Kill terminates it the instant its score crosses the threshold, then respawns a clean replacement a few seconds later — if the scenario is still active, the fresh pod gets reinfected, showing why detection alone isn't containment.
This is exactly the mechanism behind eBPF/LSM-based container runtime security: unlike a signature scanner, it flags *behavior that deviates from a learned profile*, so it can catch novel payloads it has never seen before, at the cost of needing a clean baseline period and careful threshold tuning to avoid alert fatigue.