theProtector: Real-time Linux Security Monitoring with eBPF and Honeypots
Summary
theProtector is a powerful Linux Bash script designed for real-time host-based security monitoring. It leverages advanced techniques like eBPF kernel monitoring, YARA pattern matching, and network honeypots to detect and respond to threats. This tool provides multi-layer security for paranoid admins on a budget, ensuring continuous protection with minimal overhead.
Repository Info
Tags
Click on any tag to explore related repositories
Introduction
theProtector is a comprehensive Linux Bash script designed for real-time host-based security monitoring. It offers a multi-layered approach to detect suspicious activities, malware, and evasion attempts on Linux systems. Leveraging advanced technologies like eBPF kernel monitoring, YARA pattern matching, and network honeypots, theProtector provides robust protection with minimal system overhead.
Installation
Getting started with theProtector is straightforward.
System Requirements
- Linux kernel 4.9+ (for eBPF functionality)
- Bash 4.0+
Quick Start
To quickly set up and test theProtector:
git clone https://github.com/IHATEGIVINGAUSERNAME/theProtector.git
cd theProtector/
chmod +x theprotector.sh
sudo ./theprotector.sh test
sudo ./theprotector.sh
Automated Installation
For continuous monitoring, you can install theProtector as a scheduled cron job or a systemd service:
# Install scheduled monitoring (hourly cron job)
sudo ./theprotector.sh install
# Install systemd service (recommended for servers)
sudo ./theprotector.sh systemd
Examples
theProtector offers various commands for different monitoring needs.
Basic Scans
Run a standard security scan or enable enhanced monitoring:
sudo ./theprotector.sh # Standard security scan
sudo ./theprotector.sh enhanced # Enhanced monitoring with all features
sudo ./theprotector.sh status # Check system status
Advanced Features
Start the web dashboard or run specific monitoring modules:
sudo ./theprotector.sh dashboard # Start web dashboard, access at http://127.0.0.1:8080
sudo ./theprotector.sh yara # YARA scanning only
sudo ./theprotector.sh honeypot # Network honeypots only
Why Use It?
theProtector stands out as an essential tool for several reasons:
- Real-time Threat Detection: Utilizes eBPF for kernel-level monitoring and immediate threat response.
- Multi-layer Security: Combines YARA malware detection, network honeypots, and anti-evasion techniques for comprehensive coverage.
- Low Overhead: Designed to operate continuously with minimal impact on system performance.
- Rich Features: Includes a REST API, web dashboard, forensic capabilities, and container support.
- Budget-Friendly: An open-source solution providing enterprise-grade security features without the cost.