org-mars / bytedance-hids

ByteDance-HIDS is a Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture.

ByteDance-HIDS

English | 简体中文

ByteDance-HIDS is a Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture.

ByteDance-HIDS comprises three major components：

• ByteDance-HIDS Agent, co-worked with ByteDance-HIDS Driver, is the game-changer for the Data Collection market. It works at both Kernel and User Space of Linux System, providing rich data flow with much better performance.
• ByteDance-HIDS Server provides Service-Discovery for the production environment of up to millions of agents. The Server also supports primary data formatting along with rules distribution for the Agent.
• ByteDance-HIDS HUB provides high-performance, lightweight, and stateless alert generation with data manipulation to analyze the rich data flow.

Now we are more than happy to announce the open-source of ByteDance-HIDS Agent and ByteDance-HIDS Driver. We decided to strengthen the Defense Community with our game-changing technology. Due to the lack of rule engine and detection functions, ByteDance-HIDS Agent and Driver doesn't provide all HIDS capability on its own. However, it is a tremendous Host-Information-Collect-Agent that could be easily integrated with current HIDS/NIDS/XDR solutions on the market. ByteDance-HIDS Agent and ByteDance-HIDS Driver together advance solutions on the market in four major areas.

• Better performance Data/Information are collected in kernel space to avoid additional supplement actions such as traversal of '/proc' directory or collecting from other audition processes such as "auditd".
• Hard to be bypassed A specifically designed kernel driver powers data/Information collection, making it virtually impossible for malicious software, like rootkit, to evade detection or audition. The Driver could capture even evasion behavior itself.
• Kernel + User Space ByteDance-HIDS Agent provides User Space detection abilities, including file audition, in-house rule detection, and primary allowlists.
• Easy to be integrated ByteDance-HIDS could empower any User Space agents far beyond Host Intrusion usages with the detailed and reliable data flow. A wide user action audition could benefit both Behavior Analysis and Compliance requests. When integrated with NIDS, security analyzers could build a comprehensive Provenance Graph from the network connections, along with high traceable process trees and file auditions.

System Architecture

Currently, we are only open-sourcing ByteDance-HIDS Agent && Driver. Both components have been deployed and tested in production environments for months. We welcome any suggestions and cooperation.

• ByteDance-HIDS Driver

• ByteDance-HIDS Agent

To be Continued

• ByteDance-Server is under development. More Features are on the way.