I built an open-source process anomaly detection engine using deterministic CUSUM & process-tree graphs (Zero-eBPF required for local testing)

[u/EducationalBrush7282]

Hey everyone,

Most process anomaly detection systems either trigger overwhelming alert fatigue or rely on black-box AI models that don't explain why an alert fired.

To study process-behavior detection from first principles, I built KERNEL SENTINEL — a Python-first research and detection platform.

Core Architecture & Engineering Highlights:

Since native eBPF requires a Linux kernel, I designed this environment-agnostic Python MVP to validate detection mathematics, streaming telemetry, and process correlation cleanly on Windows/Cross-platform first, while maintaining a strict interface for future native Linux sensor integration.