Deft-Intruder – Real-time malware detection daemon for Linux
I built an open-source malware detection daemon that monitors all running processes in real-time using ML + heuristics. No kernel modules or eBPF required. Key points: - Polls /proc for new processes (works on any Linux kernel 2.6+) - Random Forest model trained on EMBER 2018 dataset (2.3M samples) - Heuristic rules for crypto miners, ransomware, rootkits - ~20MB RAM, <1% CPU, sub-millisecond scan latency - Pure C, zero runtime dependencies - Model embedded directly in binary (50KB) Why I built this: Existing solutions either require modern kernels (eBPF) or are heavy/proprietary.…
What it does
In the maker’s words, at launch
I built an open-source malware detection daemon that monitors all running processes in real-time using ML + heuristics. No kernel modules or eBPF required. Key points: - Polls /proc for new processes (works on any Linux kernel 2.6+) - Random Forest model trained on EMBER 2018 dataset (2.3M samples) - Heuristic rules for crypto miners, ransomware, rootkits - ~20MB RAM, <1% CPU, sub-millisecond scan latency - Pure C, zero runtime dependencies - Model embedded directly in binary (50KB) Why I built this: Existing solutions either require modern kernels (eBPF) or are heavy/proprietary. I wanted something lightweight that works everywhere - servers, containers, old distros. Detection approach: Extract features from executables (entropy, imports, sections), run ML prediction, apply heuristic rules, combine scores. If above threshold, kill the process. Happy to discuss implementation details or Linux security in general.
Does the same job
all alternatives →- APA proactive way of securing your Linux server2020 · github.com · ▲143
- PAPicosnitch – a reliable and lightweight security/privacy tool for Linux2022 · elesiuta.github.io · ▲92
- LFLocal-first firmware analyzer using WebAssemblyMar 2026 · xray.boldwark.com · ▲8
Hi HN, I just wanted to share what I have been working on for the past few months: A firmware analyzer for embedded Linux systems that helps uncovering security issues running entirely in the browser. This is a very early Alpha. It is going to be rough around the edges. But I think it provides quite a lot of value already. So please go ahead and drop a firmware (only .tar rootfs archives for now) and try to break it :)
- ASA simple, highly commented, rootkit which attacks GCC and Python2014 · github.com · ▲94
- PIPixie, Instant Kubernetes-Native Application Observability Using EBPF2020 · pixielabs.ai · ▲108
- KOKairos – Open-Source eBPF Malware Analysis Framework2024 · github.com · ▲7
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, November 2025
the whole month →
- IB
Life & fun · Nov 2025 · bitsnpieces.dev
- BBoing▲782
Life & fun · Nov 2025 · boing.greg.technology