Enhancing Linux Security with eBPF: Next-Gen Threat Detection and Prevention
Session Description
Abstract:
Traditional security tools struggle to keep up with modern threats without adding performance overhead. Enter eBPF—a revolutionary technology that enables real-time monitoring and enforcement directly in the Linux kernel without modifying its code.
This talk will explore how eBPF is transforming Linux security, from intrusion detection to runtime threat prevention. We’ll dive into practical use cases like detecting suspicious system calls, monitoring network activity, enforcing security policies, and stopping attacks in real time. Attendees will see live demos of eBPF-based tools like Falco showing how to secure cloud-native workloads without compromising performance.
Key Takeaways:
(1) What is eBPF and why it's a game-changer for Linux security
(2) How eBPF can detect and block threats in real time
(3) Live demo using Falco followed by Q&A for the audiences