Skip to content
Research

Security research

Technical papers from the InnerWarden project. Every detection technique we ship is grounded in research. We publish our findings so the community can review, critique, and build on them.

Maicon Ribeiro EstevesMarch 2026Production-validated

Stateless Kill Chain Detection via Bitwise Syscall Correlation in eBPF

We present a novel technique for detecting multi-stage attack chains entirely within the Linux kernel, using eBPF programs and Linux Security Modules (LSM). Eight generic patterns are detected and blocked without CVE signatures, rule databases, or userspace processing. All eight patterns validated on a production server with zero false positives.

eBPFLSMkill chainsyscall correlationbehavioral detectionzero-day
Read paper

This research ships in the product: the kill-chain engine runs in the free tier, and the kernel Execution Gate it feeds is demonstrated live on the proof page.

See the kernel proofInstall free