Ahmad ZushanAI · Systems · Platform

Home/Work/№ 14

14 · Security & Systems

eBPF Data-Flow Agent & Nucleus Platform

A layered outbound-traffic visibility platform: a lightweight eBPF agent captures at the application boundary, a nucleus relays and enriches, and a backend classifies endpoints, vendors, and payload sensitivity.

Period2025StatusCase studyAreaSecurity & Systems

eBPF Data-Flow Agent & Nucleus Platform visual

Highlights

  1. No TLS decryption: plaintext is captured at the application boundary via runtime interception (Java ByteBuddy/ASM around the SSL encrypt/wrap pipeline; Node, Python and .NET hooks).
  2. eBPF kprobes/uprobes with per-CPU ring buffers and maps; events offloaded to Redis Streams / Kafka for backpressure.
  3. Hybrid containerised agent with dynamic kernel-aware compilation: ship once, adapt to the host kernel at runtime.
  4. Kubernetes privileged DaemonSet (hostPID + hostPath) for node-wide coverage; bitmasked nucleus for O(1) classification.