ByteDance-HIDS – A Cloud-Native Host-Based Intrusion Detection Solution Project To Provide Next-Generation Threat Detection And Behavior Audition With Modern Architecture
ByteDance-HIDS is a Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture.
ByteDance-HIDS comprises three major components:
- ByteDance-HIDS Agent, co-worked with ByteDance-HIDS Driver, is the game-changer for the Data Collection market. It works at both Kernel and User Space of Linux System, providing rich data flow with much better performance.
- ByteDance-HIDS Server provides Service-Discovery for the production environment of up to millions of agents. The Server also supports primary data formatting along with rules distribution for the Agent.
- ByteDance-HIDS HUB provides high-performance, lightweight, and stateless alert generation with data manipulation to analyze the rich data flow.
- Better performance Data/Information are collected in kernel space to avoid additional supplement actions such as traversal of ‘/proc’ directory or collecting from other audition processes such as “auditd”.
- Hard to be bypassed A specifically designed kernel driver powers data/Information collection, making it virtually impossible for malicious software, like rootkit, to evade detection or audition. The Driver could capture even evasion behavior itself.
- Kernel + User Space ByteDance-HIDS Agent provides User Space detection abilities, including file audition, in-house rule detection, and primary allowlists.
- Easy to be integrated ByteDance-HIDS could empower any User Space agents far beyond Host Intrusion usages with the detailed and reliable data flow. A wide user action audition could benefit both Behavior Analysis and Compliance requests. When integrated with NIDS, security analyzers could build a comprehensive Provenance Graph from the network connections, along with high traceable process trees and file auditions.
System Architecture
Currently, we are only open-sourcing ByteDance-HIDS Agent && Driver. Both components have been deployed and tested in production environments for months. We welcome any suggestions and cooperation.
To be Continued
- ByteDance-Server is under development. More Features are on the way.