Skip to content

Research

The research behind the product.

Technical papers from the InnerWarden project. Every detection technique we ship is grounded in research. We publish our findings so the community can review, critique, and build on them.

The result

Kill-chain detection, validated on a production server: kernel 6.8, aarch64, real attack traffic.

8 patternsall validated

Generic attack chains, no CVE signatures.

0 false positivesclean

Across all eight patterns in production.

~10 ns~81 MB RAM

One bitwise AND per pattern, total resident memory.

execve() deniedblocked

In the bprm_check_security LSM hook, before the process image loads, on Linux.

From the shipped paper, below.

Published

The papers.

[1]Production-validated

Stateless Kill Chain Detection via Bitwise Syscall Correlation in eBPF

We present a novel technique for detecting multi-stage attack chains entirely within the Linux kernel, using eBPF programs and Linux Security Modules (LSM). Eight generic patterns are detected and blocked without CVE signatures, rule databases, or userspace processing. All eight patterns validated on a production server with zero false positives.

Maicon Ribeiro Esteves
March 2026
eBPFLSMkill chainsyscall correlationbehavioral detectionzero-day
Read paper

In the product

This research ships in the product.

The kill-chain engine ships in Pro and Enterprise, and the Linux kernel Execution Gate it feeds is demonstrated live on the proof page.

Install freeSee the kernel proof
Attack patterns
8, all validated
False positives
0
Per-pattern check
~10 ns, ~81 MB RAM
On match, on Linux
execve() denied