Catching ransomware with eBPF: what execve/openat tracing taught me about false positives

TL;DR talus-process-monitor is an eBPF-based ransomware detector for Linux: it traces execve/openat from the kernel, streams events over per-CPU perf buffers, and flags behavioural patterns — mass file rewrites plus extension churn — in real time. The hard part is not the tracing; it's scoring patterns without crying wolf on every cargo build. Why behaviour, not signatures Signature detection on Linux ransomware is nearly useless — most samples are short-lived, often scrip