<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>egberts1</author><text>Far much easier to suppress kernel&amp;#x2F;driver log of kernel addresses and deny access to &amp;#x2F;dev&amp;#x2F;kmem, et. al.&lt;p&gt;Leaving eBPF access open demonstratively has made way for file-less persistent malware to linger on unwantedly.&lt;p&gt;A real cybersecurity specialist would only allow eBPF access on host OS if no network access can be made to the host OS (and its ok for guest VMs to have eBPF).&lt;p&gt;An Uber cybersecurity goon, however, would compile out the eBPF JIT access from the Linux kernel (or use BSD-variant, instead).</text><parent_chain></parent_chain></comment><story><title>Process behaviour anomaly detection using eBPF and unsupervised learning</title><url>https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>brodouevencode</author><text>The github link if you just want to look at the code: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;evilsocket&amp;#x2F;ebpf-process-anomaly-detection&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;evilsocket&amp;#x2F;ebpf-process-anomaly-detection&lt;/a&gt;</text><parent_chain></parent_chain></comment><story><title>Process behaviour anomaly detection using eBPF and unsupervised learning</title><url>https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/</url></story>