Dendroaspis: eBPF telemetry and a Mamba detector for agent-orchestrated attacks

What it is

Dendroaspis is the code accompanying my 2026 paper on host intrusion detection for developer workstations. The question it asks is whether a sequence model can tell an autonomous, LLM-driven attacker apart from the ordinary noise of a high-entropy machine, using only what the Linux kernel already sees. The name is the mamba snake genus, a nod to the Mamba architecture the detector is built on.

The repository is on GitHub at ryypow/dendroaspis. The dataset is separate, on Hugging Face as rypow/dendroaspis-tetragon-hids.

How it works

The pipeline runs in six stages.

1. Collection. Twelve kprobes across six Tetragon monitor policies record process, file, and network events from an LXC sandbox on Proxmox.
2. Parsing. Raw event logs become Parquet with roughly 70 columns.
3. Behaviour enrichment. A two-pass lineage walk derives 27 columns per row describing where each process came from.
4. Feature encoding. Tiered encoders reduce everything to 33 small-integer fields plus three identifiers.
5. Model. Per-field embeddings feed a two-layer selective state-space scan over 128-event windows. Three heads are trained: next-event likelihood, masked-event modelling as a negative control, and a field-aware masked-event head that is the headline detector.
6. Evaluation. Per-event and per-window AUROC with 95% bootstrap intervals, broken out across the 22 attack techniques.

Trigram, Isolation Forest, and XGBoost baselines consume the same features, and a rich-versus-flat feature flag supports the encoder-by-architecture ablation reported in the paper.

The data

The corpus holds about 19.3 million kernel events. An LLM-assisted agent executed 61 labelled attack intervals spanning 22 MITRE ATT&CK techniques inside the sandbox, at a median cadence of 5.6 seconds between trials. Every string column is anonymised with a basename allowlist and salted HMAC pseudonyms, with zero-PII assertions enforced at build time.

Status

Released as the v0.2 paper code in May 2026. Training was validated on a single 16 GB consumer GPU. Results are in Table 1 of the paper, which ships in the repository.