{"id":"https://openalex.org/W7224636757","doi":"https://doi.org/10.20944/preprints202610.2818.v1","title":"Kernel Borderlands: An eBPF-Based Behavioral Detection and Multi-Agent Containment Architecture for Linux Server Workloads","display_name":"Kernel Borderlands: An eBPF-Based Behavioral Detection and Multi-Agent Containment Architecture for Linux Server Workloads","publication_year":2026,"publication_date":"2026-10-28","ids":{"openalex":"https://openalex.org/W7224636757","doi":"https://doi.org/10.20944/preprints202610.2818.v1"},"language":"en","primary_location":{"id":"doi:10.20944/preprints202610.2818.v1","doi":"https://doi.org/10.20944/preprints202610.2818.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202610.2818.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"volume":null,"type":"preprint","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.20944/preprints202610.2818.v1","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5148209026","display_name":"Pardhu Varma","orcid":"https://orcid.org/0009-0005-3251-9944","observed_orcids":["https://orcid.org/0009-0005-3251-9944"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Pardhu Sri Rushi Varma Konduru","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0005-3251-9944","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160121089","display_name":"Tejaswini Kandukoori","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tejaswini Kandukoori","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160135516","display_name":"Karthik Kanne","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Karthik Kanne","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5160104701","display_name":"Rupa Yeshvitha Karedla","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rupa Yeshvitha Karedla","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5148209026"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9800000190734863,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9800000190734863,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.018200000748038292,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.0012000000569969416,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ebpf","display_name":"eBPF","score":0.9509999752044678},{"id":"https://openalex.org/keywords/linux-kernel-security","display_name":"Linux kernel security","score":0.44699999690055847},{"id":"https://openalex.org/keywords/behavioral-detection","display_name":"behavioral detection","score":0.5649999976158142},{"id":"https://openalex.org/keywords/containment-policy","display_name":"containment policy","score":0.48500001430511475},{"id":"https://openalex.org/keywords/proximal-policy-optimization","display_name":"proximal policy optimization","score":0.828000009059906},{"id":"https://openalex.org/keywords/watchdog","display_name":"watchdog","score":0.5080000162124634},{"id":"https://openalex.org/keywords/audit-logs","display_name":"audit logs","score":0.6970000267028809}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6858999729156494},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.6773999929428101},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.6218000054359436},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.5277000069618225},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5022000074386597},{"id":"https://openalex.org/C2777407602","wikidata":"https://www.wikidata.org/wiki/Q1888932","display_name":"Mandatory access control","level":4,"score":0.4862000048160553},{"id":"https://openalex.org/C2777019822","wikidata":"https://www.wikidata.org/wiki/Q390066","display_name":"Containment (computer programming)","level":2,"score":0.4499000012874603},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.4490000009536743},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.4453999996185303},{"id":"https://openalex.org/C204495577","wikidata":"https://www.wikidata.org/wiki/Q1205349","display_name":"Callback","level":2,"score":0.4108000099658966},{"id":"https://openalex.org/C72971556","wikidata":"https://www.wikidata.org/wiki/Q961356","display_name":"Throttle","level":2,"score":0.4092999994754791},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4083000123500824},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.3944999873638153},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.38519999384880066},{"id":"https://openalex.org/C95203288","wikidata":"https://www.wikidata.org/wiki/Q221682","display_name":"Semaphore","level":2,"score":0.3603000044822693},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3538999855518341},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.35339999198913574},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.3458999991416931},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.33959999680519104},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.32679998874664307},{"id":"https://openalex.org/C140745168","wikidata":"https://www.wikidata.org/wiki/Q1210082","display_name":"Tree traversal","level":2,"score":0.3027999997138977},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.296099990606308},{"id":"https://openalex.org/C203479927","wikidata":"https://www.wikidata.org/wiki/Q5165939","display_name":"Controller (irrigation)","level":2,"score":0.2939000129699707},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C2777127024","wikidata":"https://www.wikidata.org/wiki/Q726378","display_name":"Microkernel","level":2,"score":0.28630000352859497},{"id":"https://openalex.org/C147346212","wikidata":"https://www.wikidata.org/wiki/Q5492632","display_name":"Trusted computing base","level":4,"score":0.28540000319480896},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.2842999994754791},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C2781018962","wikidata":"https://www.wikidata.org/wiki/Q5164884","display_name":"Container (type theory)","level":2,"score":0.28209999203681946},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.2782999873161316},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.2736000120639801},{"id":"https://openalex.org/C155386361","wikidata":"https://www.wikidata.org/wiki/Q1649571","display_name":"Process control","level":3,"score":0.27300000190734863},{"id":"https://openalex.org/C176181172","wikidata":"https://www.wikidata.org/wiki/Q3490301","display_name":"Nondeterministic algorithm","level":2,"score":0.272599995136261},{"id":"https://openalex.org/C2775937380","wikidata":"https://www.wikidata.org/wiki/Q1232589","display_name":"Replica","level":2,"score":0.2718000113964081},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.2694000005722046},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.26669999957084656},{"id":"https://openalex.org/C180591934","wikidata":"https://www.wikidata.org/wiki/Q1253369","display_name":"Downtime","level":2,"score":0.262800008058548},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.26249998807907104},{"id":"https://openalex.org/C2780771206","wikidata":"https://www.wikidata.org/wiki/Q3271761","display_name":"Safeguard","level":2,"score":0.2612999975681305},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.258899986743927}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.20944/preprints202610.2818.v1","doi":"https://doi.org/10.20944/preprints202610.2818.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202610.2818.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.20944/preprints202610.2818.v1","doi":"https://doi.org/10.20944/preprints202610.2818.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202610.2818.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"sustainable_development_goals":[{"score":0.46149998903274536,"display_name":"Peace, justice, and strong institutions","id":"https://metadata.un.org/sdg/16"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7163881439","https://openalex.org/W7221498434","https://openalex.org/W7106670503","https://openalex.org/W7204937353","https://openalex.org/W7170692525","https://openalex.org/W3094827892","https://openalex.org/W7203737419","https://openalex.org/W2944857416","https://openalex.org/W4412623215","https://openalex.org/W7215043104"],"abstract_inverted_index":{"Linux":[0],"servers":[1],"are":[2],"usually":[3],"defended":[4],"by":[5,19,104],"tools":[6],"that":[7,22,38,68],"observe":[8],"kernel":[9],"activity":[10],"but":[11],"leave":[12],"the":[13,40,58,122,132,146,157],"response":[14],"to":[15,44,172],"a":[16,25,34,87,95,100,114,154,161,196,200],"human,":[17],"or":[18,78,199],"static":[20],"policies":[21],"cannot":[23],"recognise":[24],"hijacked":[26],"legitimate":[27],"binary.":[28],"We":[29],"present":[30],"Kernel":[31],"Borderlands":[32],"(KB),":[33],"kernel-level":[35],"runtime":[36],"defence":[37],"closes":[39],"loop":[41],"from":[42,71,130],"observation":[43],"enforcement.":[45],"An":[46],"eBPF":[47],"sensor":[48],"scores":[49],"process":[50,189],"behaviour":[51],"and":[52,92,108,113,120,145,185],"enforces":[53],"five":[54],"graded":[55],"containment":[56,101,133],"levels,":[57],"first":[59],"four":[60],"reversible,":[61],"through":[62],"BPF-LSM":[63],"hooks,":[64],"behind":[65],"authorisation":[66],"gates":[67,121],"prevent":[69],"it":[70],"acting":[72],"against":[73],"PID":[74],"1,":[75],"critical":[76],"daemons":[77],"its":[79],"own":[80],"components.":[81],"A":[82],"Go":[83],"control":[84,158],"plane":[85,159],"keeps":[86],"SHA-256":[88],"hash-chained":[89],"audit":[90],"log":[91],"detects":[93],"beaconing;":[94],"Ray-based":[96],"agent":[97],"swarm":[98],"implements":[99],"policy":[102,134,148],"trained":[103],"Proximal":[105],"Policy":[106],"Optimisation":[107],"quorum":[109],"confirmation":[110],"of":[111,167,169],"actions;":[112],"Rust":[115],"watchdog":[116],"verifies":[117],"BPF":[118],"bytecode":[119],"boot":[123],"sequence.":[124],"On":[125],"908":[126],"held-out":[127],"samples":[128],"derived":[129],"ADFA-LD,":[131],"reaches":[135],"97.1\u2013100%":[136],"accuracy":[137],"on":[138,195],"every":[139],"attack":[140],"class":[141],"with":[142,191],"no":[143,150,192],"under-containment,":[144],"Jury":[147],"has":[149],"false":[151],"negatives.":[152],"In":[153],"live":[155],"capture,":[156],"issued":[160],"throttle":[162],"within":[163],"about":[164],"1":[165],"ms":[166],"each":[168],"six":[170],"escalations":[171],"BORDERLANDS.":[173],"With":[174],"all":[175],"hooks":[176],"loaded,":[177],"KB":[178],"adds":[179],"38":[180],"ns":[181],"per":[182,188],"system":[183],"call":[184],"26":[186],"\u00b5s":[187],"creation,":[190],"measurable":[193],"overhead":[194],"parallel":[197],"compile":[198],"CPU-bound":[201],"workload.":[202]},"counts_by_year":[],"updated_date":"2026-10-31T12:09:11.096373","created_date":"2026-10-30T00:00:00"}