Tracee is an eBPF-based runtime security and forensics tool that traces your system and applications at runtime. This guide covers integrating Tracee with Java applications for advanced security monitoring.
Understanding Tracee and eBPF
What is Tracee?
- Open-source runtime security and forensics tool
- Uses eBPF (Extended Berkeley Packet Filter) for low-overhead tracing
- Tracks system calls, network activity, and security events
- Provides real-time security monitoring
Key eBPF Concepts:
- eBPF Programs: Small programs that run in the kernel
- Maps: Key-value stores for sharing data between kernel and userspace
- Helpers: Kernel functions that eBPF programs can call
- Events: Triggers for eBPF program execution
Setup and Dependencies
1. System Requirements
# Install Tracee curl -Lo install-tracee.sh https://raw.githubusercontent.com/aquasecurity/tracee/main/install.sh sudo bash install-tracee.sh # Verify installation tracee --version # Check eBPF support ls /sys/kernel/btf/vmlinux
2. Maven Dependencies
<properties>
<bpfmap.version>1.0.0</bpfmap.version>
<jna.version>5.13.0</jna.version>
<jackson.version>2.15.2</jackson.version>
</properties>
<dependencies>
<!-- BPF Map Access -->
<dependency>
<groupId>com.yourapp</groupId>
<artifactId>bpf-map-access</artifactId>
<version>${bpfmap.version}</version>
</dependency>
<!-- JNA for native access -->
<dependency>
<groupId>net.java.dev.jna</groupId>
<artifactId>jna</artifactId>
<version>${jna.version}</version>
</dependency>
<!-- JSON Processing -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
</dependency>
<!-- Process Utilities -->
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-exec</artifactId>
<version>1.3</version>
</dependency>
</dependencies>
3. Native Library Setup
// BPF Native Interface
public class BpfNative {
static {
System.loadLibrary("bpf");
}
public native int bpf_map_get_fd_by_id(int map_id);
public native int bpf_map_lookup_elem(int map_fd, byte[] key, byte[] value);
public native int bpf_map_update_elem(int map_fd, byte[] key, byte[] value, long flags);
public native int bpf_map_delete_elem(int map_fd, byte[] key);
}
Tracee Integration
1. Tracee Event Consumer
package com.yourapp.tracee;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Service;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.ArrayList;
import java.util.List;
import java.util.concurrent.CompletableFuture;
import java.util.function.Consumer;
@Service
public class TraceeEventService {
private static final Logger logger = LoggerFactory.getLogger(TraceeEventService.class);
private final ObjectMapper objectMapper = new ObjectMapper();
private Process traceeProcess;
private volatile boolean running = false;
private List<Consumer<TraceeEvent>> eventListeners = new ArrayList<>();
public void startTracee(TraceeConfig config) throws IOException {
List<String> command = buildTraceeCommand(config);
logger.info("Starting Tracee with command: {}", String.join(" ", command));
ProcessBuilder processBuilder = new ProcessBuilder(command);
traceeProcess = processBuilder.start();
running = true;
// Start event processing
startEventProcessing();
}
public void stopTracee() {
running = false;
if (traceeProcess != null) {
traceeProcess.destroy();
}
}
public void addEventListener(Consumer<TraceeEvent> listener) {
eventListeners.add(listener);
}
private List<String> buildTraceeCommand(TraceeConfig config) {
List<String> command = new ArrayList<>();
command.add("tracee");
// Output format
command.add("--output");
command.add("json");
// Events to trace
if (config.getEvents() != null && !config.getEvents().isEmpty()) {
command.add("--events");
command.add(String.join(",", config.getEvents()));
}
// Filter by process
if (config.getPid() > 0) {
command.add("--pid");
command.add(String.valueOf(config.getPid()));
}
// Filter by process name
if (config.getProcessName() != null) {
command.add("--proc-name");
command.add(config.getProcessName());
}
// Container support
if (config.isContainerEnabled()) {
command.add("--containers");
}
// Security events only
if (config.isSecurityEventsOnly()) {
command.add("--security-only");
}
return command;
}
private void startEventProcessing() {
CompletableFuture.runAsync(() -> {
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(traceeProcess.getInputStream()))) {
String line;
while (running && (line = reader.readLine()) != null) {
processEventLine(line);
}
} catch (IOException e) {
if (running) {
logger.error("Error reading Tracee output", e);
}
}
});
}
private void processEventLine(String jsonLine) {
try {
TraceeEvent event = objectMapper.readValue(jsonLine, TraceeEvent.class);
notifyEventListeners(event);
} catch (Exception e) {
logger.warn("Failed to parse Tracee event: {}", jsonLine, e);
}
}
private void notifyEventListeners(TraceeEvent event) {
for (Consumer<TraceeEvent> listener : eventListeners) {
try {
listener.accept(event);
} catch (Exception e) {
logger.error("Error in event listener", e);
}
}
}
public CompletableFuture<List<TraceeEvent>> captureEvents(TraceeConfig config,
Duration duration) {
return CompletableFuture.supplyAsync(() -> {
List<TraceeEvent> events = new ArrayList<>();
Consumer<TraceeEvent> collector = events::add;
addEventListener(collector);
try {
startTracee(config);
Thread.sleep(duration.toMillis());
} catch (Exception e) {
logger.error("Error during event capture", e);
} finally {
stopTracee();
removeEventListener(collector);
}
return events;
});
}
private void removeEventListener(Consumer<TraceeEvent> listener) {
eventListeners.remove(listener);
}
}
@Data
public class TraceeEvent {
private long timestamp;
private String eventName;
private int processId;
private String processName;
private int threadId;
private String hostName;
private String containerId;
private String containerName;
private JsonNode eventData;
private String severity;
private String message;
public String getStringData(String field) {
return eventData != null && eventData.has(field) ?
eventData.get(field).asText() : null;
}
public int getIntData(String field) {
return eventData != null && eventData.has(field) ?
eventData.get(field).asInt() : 0;
}
}
@Data
public class TraceeConfig {
private List<String> events = new ArrayList<>();
private int pid = 0;
private String processName;
private boolean containerEnabled = false;
private boolean securityEventsOnly = true;
private String outputFormat = "json";
public static TraceeConfig securityConfig() {
TraceeConfig config = new TraceeConfig();
config.setSecurityEventsOnly(true);
config.setEvents(List.of(
"sched_process_exec", "security_file_open", "security_socket_connect",
"security_socket_bind", "security_bprm_check", "ptrace"
));
return config;
}
public static TraceeConfig fullConfig() {
TraceeConfig config = new TraceeConfig();
config.setSecurityEventsOnly(false);
config.setContainerEnabled(true);
return config;
}
}
2. Security Event Analyzer
@Service
public class SecurityEventAnalyzer {
private static final Logger logger = LoggerFactory.getLogger(SecurityEventAnalyzer.class);
private final SecurityPolicy securityPolicy;
private final AlertService alertService;
private final Map<String, ProcessBehavior> processBehaviors = new ConcurrentHashMap<>();
public SecurityEventAnalyzer(SecurityPolicy securityPolicy, AlertService alertService) {
this.securityPolicy = securityPolicy;
this.alertService = alertService;
}
public void analyzeEvent(TraceeEvent event) {
switch (event.getEventName()) {
case "sched_process_exec":
analyzeProcessExec(event);
break;
case "security_file_open":
analyzeFileOpen(event);
break;
case "security_socket_connect":
analyzeSocketConnect(event);
break;
case "security_socket_bind":
analyzeSocketBind(event);
break;
case "ptrace":
analyzePtrace(event);
break;
default:
// Handle other events
}
}
private void analyzeProcessExec(TraceeEvent event) {
String processName = event.getStringData("pathname");
int pid = event.getProcessId();
ProcessBehavior behavior = processBehaviors.computeIfAbsent(
processName, k -> new ProcessBehavior(processName));
behavior.recordExecution();
// Check for suspicious process execution
if (securityPolicy.isSuspiciousProcess(processName)) {
SecurityAlert alert = createAlert(event,
"Suspicious process execution: " + processName,
SecuritySeverity.HIGH);
alertService.sendAlert(alert);
}
// Check execution frequency
if (behavior.getExecutionCount() > securityPolicy.getMaxExecutionsPerMinute()) {
SecurityAlert alert = createAlert(event,
"High frequency process execution: " + processName,
SecuritySeverity.MEDIUM);
alertService.sendAlert(alert);
}
}
private void analyzeFileOpen(TraceeEvent event) {
String filename = event.getStringData("pathname");
String processName = event.getProcessName();
int flags = event.getIntData("flags");
// Check for sensitive file access
if (securityPolicy.isSensitiveFile(filename)) {
SecurityAlert alert = createAlert(event,
"Sensitive file access: " + filename + " by " + processName,
SecuritySeverity.HIGH);
alertService.sendAlert(alert);
}
// Check for unusual file access patterns
if (isUnusualFileAccess(processName, filename)) {
SecurityAlert alert = createAlert(event,
"Unusual file access pattern: " + filename + " by " + processName,
SecuritySeverity.MEDIUM);
alertService.sendAlert(alert);
}
}
private void analyzeSocketConnect(TraceeEvent event) {
String destAddr = event.getStringData("dest_addr");
int destPort = event.getIntData("dest_port");
String processName = event.getProcessName();
// Check for suspicious network connections
if (securityPolicy.isSuspiciousDestination(destAddr, destPort)) {
SecurityAlert alert = createAlert(event,
"Suspicious network connection: " + destAddr + ":" + destPort + " by " + processName,
SecuritySeverity.HIGH);
alertService.sendAlert(alert);
}
// Check for data exfiltration patterns
if (isDataExfiltration(processName, destAddr, destPort)) {
SecurityAlert alert = createAlert(event,
"Potential data exfiltration: " + destAddr + ":" + destPort + " by " + processName,
SecuritySeverity.CRITICAL);
alertService.sendAlert(alert);
}
}
private void analyzeSocketBind(TraceeEvent event) {
int port = event.getIntData("port");
String processName = event.getProcessName();
// Check for unauthorized service binding
if (securityPolicy.isRestrictedPort(port) &&
!securityPolicy.isAllowedProcess(processName)) {
SecurityAlert alert = createAlert(event,
"Unauthorized service binding on port: " + port + " by " + processName,
SecuritySeverity.HIGH);
alertService.sendAlert(alert);
}
}
private void analyzePtrace(TraceeEvent event) {
String processName = event.getProcessName();
String targetProcess = event.getStringData("target_process");
// Check for unauthorized process debugging
if (securityPolicy.isProtectedProcess(targetProcess) &&
!securityPolicy.isAllowedDebugger(processName)) {
SecurityAlert alert = createAlert(event,
"Unauthorized process debugging: " + targetProcess + " by " + processName,
SecuritySeverity.HIGH);
alertService.sendAlert(alert);
}
}
private boolean isUnusualFileAccess(String processName, String filename) {
// Implement pattern analysis for file access
ProcessBehavior behavior = processBehaviors.get(processName);
return behavior != null && behavior.isUnusualFileAccess(filename);
}
private boolean isDataExfiltration(String processName, String destAddr, int destPort) {
// Implement data exfiltration detection logic
ProcessBehavior behavior = processBehaviors.get(processName);
return behavior != null && behavior.isSuspiciousNetworkActivity(destAddr, destPort);
}
private SecurityAlert createAlert(TraceeEvent event, String message, SecuritySeverity severity) {
SecurityAlert alert = new SecurityAlert();
alert.setTimestamp(LocalDateTime.now());
alert.setEvent(event);
alert.setMessage(message);
alert.setSeverity(severity);
alert.setProcessName(event.getProcessName());
alert.setProcessId(event.getProcessId());
alert.setHostName(event.getHostName());
return alert;
}
}
@Data
public class ProcessBehavior {
private String processName;
private int executionCount = 0;
private long lastExecutionTime = 0;
private Map<String, Integer> fileAccessCount = new ConcurrentHashMap<>();
private Map<String, Integer> networkConnections = new ConcurrentHashMap<>();
private final long creationTime = System.currentTimeMillis();
public ProcessBehavior(String processName) {
this.processName = processName;
}
public void recordExecution() {
executionCount++;
lastExecutionTime = System.currentTimeMillis();
}
public void recordFileAccess(String filename) {
fileAccessCount.merge(filename, 1, Integer::sum);
}
public void recordNetworkConnection(String destAddr, int destPort) {
String key = destAddr + ":" + destPort;
networkConnections.merge(key, 1, Integer::sum);
}
public boolean isUnusualFileAccess(String filename) {
Integer count = fileAccessCount.get(filename);
return count != null && count > 10; // Threshold for unusual access
}
public boolean isSuspiciousNetworkActivity(String destAddr, int destPort) {
String key = destAddr + ":" + destPort;
Integer count = networkConnections.get(key);
return count != null && count > 50; // Threshold for data exfiltration
}
public int getExecutionsPerMinute() {
long elapsedMinutes = (System.currentTimeMillis() - creationTime) / (60 * 1000);
return elapsedMinutes > 0 ? (int)(executionCount / elapsedMinutes) : executionCount;
}
}
3. Security Policy Engine
@Service
public class SecurityPolicy {
private final Set<String> suspiciousProcesses = new HashSet<>();
private final Set<String> sensitiveFiles = new HashSet<>();
private final Set<String> protectedProcesses = new HashSet<>();
private final Set<String> allowedDebuggers = new HashSet<>();
private final Set<Integer> restrictedPorts = new HashSet<>();
private final Map<String, Set<Integer>> suspiciousDestinations = new HashMap<>();
private int maxExecutionsPerMinute = 100;
private int maxFileAccessPerMinute = 1000;
private int maxNetworkConnectionsPerMinute = 100;
public SecurityPolicy() {
initializeDefaultPolicies();
}
private void initializeDefaultPolicies() {
// Suspicious processes
suspiciousProcesses.addAll(List.of(
"nc", "netcat", "telnet", "nmap", "masscan",
"john", "hashcat", "hydra", "metasploit"
));
// Sensitive files
sensitiveFiles.addAll(List.of(
"/etc/passwd", "/etc/shadow", "/etc/sudoers",
"/root/.ssh/", "/home/*/.ssh/",
"/etc/kubernetes/admin.conf", "/var/lib/kubelet/kubeconfig"
));
// Protected processes
protectedProcesses.addAll(List.of(
"kube-apiserver", "kube-controller-manager", "kube-scheduler",
"etcd", "docker", "containerd"
));
// Allowed debuggers
allowedDebuggers.addAll(List.of(
"gdb", "strace", "ltrace"
));
// Restricted ports
restrictedPorts.addAll(List.of(22, 80, 443, 8080, 6443, 2379));
// Suspicious destinations
suspiciousDestinations.put("known-malicious-ips", Set.of(80, 443, 53));
}
public boolean isSuspiciousProcess(String processName) {
return suspiciousProcesses.contains(processName);
}
public boolean isSensitiveFile(String filename) {
return sensitiveFiles.stream().anyMatch(pattern ->
filename.matches(pattern.replace("*", ".*")));
}
public boolean isProtectedProcess(String processName) {
return protectedProcesses.contains(processName);
}
public boolean isAllowedDebugger(String processName) {
return allowedDebuggers.contains(processName);
}
public boolean isRestrictedPort(int port) {
return restrictedPorts.contains(port);
}
public boolean isSuspiciousDestination(String destAddr, int destPort) {
// Check against known malicious IP ranges
return suspiciousDestinations.entrySet().stream()
.anyMatch(entry -> entry.getValue().contains(destPort) &&
isIpInRange(destAddr, entry.getKey()));
}
public boolean isAllowedProcess(String processName) {
// Implement process whitelist logic
return true; // Override in implementation
}
private boolean isIpInRange(String ip, String range) {
// Implement IP range checking
return false; // Override in implementation
}
// Getters and setters
public int getMaxExecutionsPerMinute() { return maxExecutionsPerMinute; }
public void setMaxExecutionsPerMinute(int maxExecutionsPerMinute) {
this.maxExecutionsPerMinute = maxExecutionsPerMinute;
}
public int getMaxFileAccessPerMinute() { return maxFileAccessPerMinute; }
public void setMaxFileAccessPerMinute(int maxFileAccessPerMinute) {
this.maxFileAccessPerMinute = maxFileAccessPerMinute;
}
public int getMaxNetworkConnectionsPerMinute() { return maxNetworkConnectionsPerMinute; }
public void setMaxNetworkConnectionsPerMinute(int maxNetworkConnectionsPerMinute) {
this.maxNetworkConnectionsPerMinute = maxNetworkConnectionsPerMinute;
}
}
@Data
public class SecurityAlert {
private LocalDateTime timestamp;
private TraceeEvent event;
private String message;
private SecuritySeverity severity;
private String processName;
private int processId;
private String hostName;
private String containerId;
private boolean acknowledged = false;
private String acknowledgedBy;
private LocalDateTime acknowledgedAt;
}
public enum SecuritySeverity {
LOW, MEDIUM, HIGH, CRITICAL
}
eBPF Map Integration
1. BPF Map Reader
@Service
public class BpfMapService {
private static final Logger logger = LoggerFactory.getLogger(BpfMapService.class);
private final BpfNative bpfNative;
private final Map<Integer, Integer> mapFds = new ConcurrentHashMap<>();
public BpfMapService() {
this.bpfNative = new BpfNative();
}
public void openMap(String mapName) throws IOException {
int mapId = findMapIdByName(mapName);
if (mapId == -1) {
throw new IOException("BPF map not found: " + mapName);
}
int fd = bpfNative.bpf_map_get_fd_by_id(mapId);
if (fd < 0) {
throw new IOException("Failed to get BPF map FD for: " + mapName);
}
mapFds.put(mapId, fd);
logger.info("Opened BPF map: {} (id: {}, fd: {})", mapName, mapId, fd);
}
public byte[] readMapValue(int mapId, byte[] key) throws IOException {
Integer fd = mapFds.get(mapId);
if (fd == null) {
throw new IOException("BPF map not opened: " + mapId);
}
byte[] value = new byte[1024]; // Adjust size based on map value size
int result = bpfNative.bpf_map_lookup_elem(fd, key, value);
if (result != 0) {
throw new IOException("Failed to read BPF map value");
}
return value;
}
public void writeMapValue(int mapId, byte[] key, byte[] value) throws IOException {
Integer fd = mapFds.get(mapId);
if (fd == null) {
throw new IOException("BPF map not opened: " + mapId);
}
int result = bpfNative.bpf_map_update_elem(fd, key, value, 0);
if (result != 0) {
throw new IOException("Failed to write BPF map value");
}
}
private int findMapIdByName(String mapName) throws IOException {
try {
Process process = new ProcessBuilder("bpftool", "map", "list")
.redirectErrorStream(true)
.start();
String output = new String(process.getInputStream().readAllBytes());
int exitCode = process.waitFor();
if (exitCode != 0) {
throw new IOException("bpftool failed with exit code: " + exitCode);
}
// Parse bpftool output to find map ID by name
return parseMapIdFromOutput(output, mapName);
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
throw new IOException("Interrupted while finding BPF map", e);
}
}
private int parseMapIdFromOutput(String output, String mapName) {
String[] lines = output.split("\n");
for (String line : lines) {
if (line.contains(mapName)) {
// Extract map ID from line
String[] parts = line.split("\\s+");
if (parts.length > 1) {
try {
return Integer.parseInt(parts[0]);
} catch (NumberFormatException e) {
logger.warn("Failed to parse map ID from line: {}", line);
}
}
}
}
return -1;
}
public Map<String, Object> readAllMapEntries(int mapId) throws IOException {
Map<String, Object> entries = new HashMap<>();
// Implementation depends on map type and structure
// This would need to iterate through all keys
return entries;
}
}
2. Custom eBPF Program Loader
@Service
public class BpfProgramLoader {
private static final Logger logger = LoggerFactory.getLogger(BpfProgramLoader.class);
public void loadBpfProgram(String programSource, String programName) throws IOException {
// Compile BPF program
File objectFile = compileBpfProgram(programSource, programName);
// Load BPF program
loadBpfObject(objectFile, programName);
logger.info("Loaded BPF program: {}", programName);
}
private File compileBpfProgram(String source, String programName) throws IOException {
File sourceFile = File.createTempFile(programName, ".bpf.c");
File objectFile = File.createTempFile(programName, ".o");
try {
// Write source to temporary file
Files.write(sourceFile.toPath(), source.getBytes());
// Compile using clang
Process process = new ProcessBuilder(
"clang", "-O2", "-target", "bpf", "-c", sourceFile.getAbsolutePath(),
"-o", objectFile.getAbsolutePath()
).start();
int exitCode = process.waitFor();
if (exitCode != 0) {
String error = new String(process.getErrorStream().readAllBytes());
throw new IOException("BPF compilation failed: " + error);
}
return objectFile;
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
throw new IOException("Interrupted during BPF compilation", e);
} finally {
sourceFile.delete();
}
}
private void loadBpfObject(File objectFile, String programName) throws IOException {
try {
Process process = new ProcessBuilder(
"bpftool", "prog", "load", objectFile.getAbsolutePath(), "/sys/fs/bpf/" + programName
).start();
int exitCode = process.waitFor();
if (exitCode != 0) {
String error = new String(process.getErrorStream().readAllBytes());
throw new IOException("BPF loading failed: " + error);
}
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
throw new IOException("Interrupted during BPF loading", e);
} finally {
objectFile.delete();
}
}
}
3. Example BPF Program for Java Monitoring
// java_monitor.bpf.c
#include <linux/bpf.h>
#include <linux/ptrace.h>
#include <linux/sched.h>
#include <uapi/linux/bpf.h>
#define MAX_EVENTS 1024
struct java_event {
__u32 pid;
__u32 tid;
char comm[16];
char class_name[64];
char method_name[64];
__u64 timestamp;
};
struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
__uint(key_size, sizeof(__u32));
__uint(value_size, sizeof(__u32));
} events SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 1024);
__type(key, __u32);
__type(value, __u64);
} method_count SEC(".maps");
SEC("uprobe/java_method_entry")
int java_method_entry(struct pt_regs *ctx) {
__u64 pid_tgid = bpf_get_current_pid_tgid();
__u32 pid = pid_tgid >> 32;
__u32 tid = (__u32)pid_tgid;
// Read method name from Java stack (simplified)
char method_name[64];
bpf_probe_read_user_str(method_name, sizeof(method_name),
(void *)PT_REGS_PARM1(ctx));
// Update method call count
__u64 *count = bpf_map_lookup_elem(&method_count, &tid);
if (count) {
(*count)++;
} else {
__u64 initial_count = 1;
bpf_map_update_elem(&method_count, &tid, &initial_count, BPF_ANY);
}
// Send event to userspace
struct java_event event = {};
event.pid = pid;
event.tid = tid;
event.timestamp = bpf_ktime_get_ns();
bpf_get_current_comm(&event.comm, sizeof(event.comm));
bpf_probe_read_user_str(&event.method_name, sizeof(event.method_name),
(void *)PT_REGS_PARM1(ctx));
bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU,
&event, sizeof(event));
return 0;
}
char _license[] SEC("license") = "GPL";
Java Application Integration
1. Spring Boot Configuration
@Configuration
@EnableScheduling
public class TraceeConfig {
@Bean
public TraceeEventService traceeEventService() {
return new TraceeEventService();
}
@Bean
public SecurityEventAnalyzer securityEventAnalyzer() {
return new SecurityEventAnalyzer(securityPolicy(), alertService());
}
@Bean
public SecurityPolicy securityPolicy() {
return new SecurityPolicy();
}
@Bean
public AlertService alertService() {
return new AlertService();
}
@Bean
public BpfMapService bpfMapService() {
return new BpfMapService();
}
}
@Component
public class TraceeInitializer {
private final TraceeEventService traceeEventService;
private final SecurityEventAnalyzer securityEventAnalyzer;
public TraceeInitializer(TraceeEventService traceeEventService,
SecurityEventAnalyzer securityEventAnalyzer) {
this.traceeEventService = traceeEventService;
this.securityEventAnalyzer = securityEventAnalyzer;
}
@PostConstruct
public void initialize() {
// Register security analyzer as event listener
traceeEventService.addEventListener(securityEventAnalyzer::analyzeEvent);
// Start Tracee with security configuration
try {
TraceeConfig config = TraceeConfig.securityConfig();
config.setPid(getCurrentPid()); // Monitor current Java process
traceeEventService.startTracee(config);
} catch (IOException e) {
throw new RuntimeException("Failed to start Tracee", e);
}
}
private int getCurrentPid() {
String processName = java.lang.management.ManagementFactory.getRuntimeMXBean().getName();
return Integer.parseInt(processName.split("@")[0]);
}
@PreDestroy
public void cleanup() {
traceeEventService.stopTracee();
}
}
2. REST API for Security Monitoring
@RestController
@RequestMapping("/api/security")
public class SecurityController {
private final TraceeEventService traceeEventService;
private final SecurityEventAnalyzer securityEventAnalyzer;
private final AlertService alertService;
@GetMapping("/events")
public ResponseEntity<List<TraceeEvent>> getRecentEvents(
@RequestParam(defaultValue = "100") int limit) {
// Capture recent events
TraceeConfig config = TraceeConfig.securityConfig();
config.setPid(getCurrentPid());
try {
List<TraceeEvent> events = traceeEventService.captureEvents(
config, Duration.ofSeconds(5)).get();
return ResponseEntity.ok(events.stream().limit(limit).collect(Collectors.toList()));
} catch (Exception e) {
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
}
}
@GetMapping("/alerts")
public ResponseEntity<List<SecurityAlert>> getSecurityAlerts(
@RequestParam(defaultValue = "false") boolean unacknowledgedOnly) {
List<SecurityAlert> alerts = alertService.getAlerts(unacknowledgedOnly);
return ResponseEntity.ok(alerts);
}
@PostMapping("/alerts/{alertId}/acknowledge")
public ResponseEntity<Void> acknowledgeAlert(
@PathVariable String alertId,
@RequestParam String acknowledgedBy) {
boolean success = alertService.acknowledgeAlert(alertId, acknowledgedBy);
return success ? ResponseEntity.ok().build() : ResponseEntity.notFound().build();
}
@GetMapping("/metrics")
public ResponseEntity<SecurityMetrics> getSecurityMetrics() {
SecurityMetrics metrics = securityEventAnalyzer.getMetrics();
return ResponseEntity.ok(metrics);
}
}
@Data
public class SecurityMetrics {
private long totalEventsProcessed;
private long securityAlertsGenerated;
private Map<String, Long> eventsByType = new HashMap<>();
private Map<SecuritySeverity, Long> alertsBySeverity = new HashMap<>();
private double eventsPerSecond;
private long uniqueProcessesMonitored;
}
3. Real-time WebSocket Events
@Configuration
@EnableWebSocket
public class WebSocketConfig implements WebSocketConfigurer {
@Override
public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
registry.addHandler(new SecurityEventHandler(), "/ws/security-events")
.setAllowedOrigins("*");
}
}
@Component
public class SecurityEventHandler extends TextWebSocketHandler {
private final Set<WebSocketSession> sessions = Collections.synchronizedSet(new HashSet<>());
private final TraceeEventService traceeEventService;
public SecurityEventHandler(TraceeEventService traceeEventService) {
this.traceeEventService = traceeEventService;
registerEventForwarding();
}
@Override
public void afterConnectionEstablished(WebSocketSession session) throws Exception {
sessions.add(session);
}
@Override
public void afterConnectionClosed(WebSocketSession session, CloseStatus status) throws Exception {
sessions.remove(session);
}
private void registerEventForwarding() {
traceeEventService.addEventListener(event -> {
if (event.getSeverity() != null &&
(event.getSeverity().equals("HIGH") || event.getSeverity().equals("CRITICAL"))) {
broadcastEvent(event);
}
});
}
private void broadcastEvent(TraceeEvent event) {
String jsonEvent = convertToJson(event);
synchronized (sessions) {
for (WebSocketSession session : sessions) {
if (session.isOpen()) {
try {
session.sendMessage(new TextMessage(jsonEvent));
} catch (IOException e) {
// Remove closed session
sessions.remove(session);
}
}
}
}
}
private String convertToJson(TraceeEvent event) {
// Convert event to JSON string
return "{\"type\":\"security_event\",\"data\":" + event.toString() + "}";
}
}
Advanced Features
1. Container Runtime Security
@Service
public class ContainerSecurityService {
private final TraceeEventService traceeEventService;
private final DockerClient dockerClient;
public ContainerSecurityService(TraceeEventService traceeEventService) {
this.traceeEventService = traceeEventService;
this.dockerClient = DockerClientBuilder.getInstance().build();
}
public void monitorContainer(String containerId) {
TraceeConfig config = TraceeConfig.securityConfig();
config.setContainerEnabled(true);
// Tracee automatically filters events by container when container-enabled
traceeEventService.addEventListener(event -> {
if (containerId.equals(event.getContainerId())) {
analyzeContainerEvent(event, containerId);
}
});
}
private void analyzeContainerEvent(TraceeEvent event, String containerId) {
// Container-specific security analysis
if (event.getEventName().equals("security_file_open") &&
event.getStringData("pathname").startsWith("/etc/")) {
// Alert on sensitive file access in container
SecurityAlert alert = new SecurityAlert();
alert.setMessage("Sensitive file access in container: " +
event.getStringData("pathname"));
alert.setSeverity(SecuritySeverity.MEDIUM);
alert.setContainerId(containerId);
// ... send alert
}
}
public Map<String, ContainerSecurityStatus> getContainerSecurityStatus() {
Map<String, ContainerSecurityStatus> statusMap = new HashMap<>();
try {
List<Container> containers = dockerClient.listContainersCmd().exec();
for (Container container : containers) {
ContainerSecurityStatus status = analyzeContainerSecurity(container);
statusMap.put(container.getId(), status);
}
} catch (Exception e) {
logger.error("Failed to analyze container security", e);
}
return statusMap;
}
private ContainerSecurityStatus analyzeContainerSecurity(Container container) {
ContainerSecurityStatus status = new ContainerSecurityStatus();
status.setContainerId(container.getId());
status.setContainerName(Arrays.toString(container.getNames()));
status.setImage(container.getImage());
status.setRunning("running".equals(container.getState()));
// Analyze security configuration
status.setPrivileged(isPrivileged(container));
status.setHostNetwork(hasHostNetwork(container));
status.setSecurityOptions(getSecurityOptions(container));
return status;
}
}
@Data
public class ContainerSecurityStatus {
private String containerId;
private String containerName;
private String image;
private boolean running;
private boolean privileged;
private boolean hostNetwork;
private List<String> securityOptions;
private SecuritySeverity securityLevel;
}
2. Performance Monitoring
@Service
public class PerformanceMonitor {
private final TraceeEventService traceeEventService;
private final Map<String, PerformanceMetrics> processMetrics = new ConcurrentHashMap<>();
public PerformanceMonitor(TraceeEventService traceeEventService) {
this.traceeEventService = traceeEventService;
startPerformanceMonitoring();
}
private void startPerformanceMonitoring() {
traceeEventService.addEventListener(event -> {
String processName = event.getProcessName();
PerformanceMetrics metrics = processMetrics.computeIfAbsent(
processName, k -> new PerformanceMetrics(processName));
updateMetrics(metrics, event);
});
}
private void updateMetrics(PerformanceMetrics metrics, TraceeEvent event) {
switch (event.getEventName()) {
case "sched_process_exec":
metrics.recordProcessStart();
break;
case "sched_process_exit":
metrics.recordProcessExit();
break;
case "sys_enter_read":
case "sys_enter_write":
metrics.recordIoOperation();
break;
case "sys_enter_connect":
case "sys_enter_accept":
metrics.recordNetworkOperation();
break;
}
}
public PerformanceReport generatePerformanceReport() {
PerformanceReport report = new PerformanceReport();
report.setGeneratedAt(LocalDateTime.now());
report.setMetrics(new ArrayList<>(processMetrics.values()));
// Calculate overall statistics
report.setTotalProcesses(processMetrics.size());
report.setAverageCpuUsage(calculateAverageCpuUsage());
report.setAverageMemoryUsage(calculateAverageMemoryUsage());
return report;
}
}
@Data
public class PerformanceMetrics {
private String processName;
private long processStarts = 0;
private long processExits = 0;
private long ioOperations = 0;
private long networkOperations = 0;
private long totalCpuTime = 0;
private long peakMemoryUsage = 0;
private final long startTime = System.currentTimeMillis();
public PerformanceMetrics(String processName) {
this.processName = processName;
}
public void recordProcessStart() { processStarts++; }
public void recordProcessExit() { processExits++; }
public void recordIoOperation() { ioOperations++; }
public void recordNetworkOperation() { networkOperations++; }
public double getOperationsPerSecond() {
long elapsedSeconds = (System.currentTimeMillis() - startTime) / 1000;
return elapsedSeconds > 0 ? (double)(ioOperations + networkOperations) / elapsedSeconds : 0;
}
}
@Data
public class PerformanceReport {
private LocalDateTime generatedAt;
private List<PerformanceMetrics> metrics;
private int totalProcesses;
private double averageCpuUsage;
private double averageMemoryUsage;
}
Best Practices
1. Security Monitoring Checklist
public class TraceeSecurityChecklist {
public static final List<String> SECURITY_MONITORING_CHECKS = Arrays.asList(
"1. Enable system call monitoring for critical processes",
"2. Monitor file access to sensitive directories",
"3. Track network connections and data exfiltration attempts",
"4. Implement process behavior analysis",
"5. Set up real-time alerting for security events",
"6. Monitor container runtime activities",
"7. Track privilege escalation attempts",
"8. Implement performance baseline monitoring",
"9. Set up centralized logging and correlation",
"10. Regularly review and update security policies"
);
public static TraceeConfig comprehensiveMonitoringConfig() {
TraceeConfig config = new TraceeConfig();
config.setSecurityEventsOnly(false);
config.setContainerEnabled(true);
config.setEvents(List.of(
"sched_process_exec", "sched_process_exit",
"security_file_open", "security_file_permission",
"security_socket_connect", "security_socket_bind",
"security_bprm_check", "ptrace",
"sys_enter_open", "sys_enter_openat",
"sys_enter_connect", "sys_enter_bind"
));
return config;
}
}
2. Performance Optimization
@Service
public class TraceePerformanceOptimizer {
public void optimizeTraceePerformance() {
// Limit event rate to prevent overhead
setEventRateLimit(1000); // events per second
// Use efficient output format
setOutputFormat("json");
// Filter events by process if needed
setProcessFilter(getCriticalProcesses());
// Enable ring buffer for high-performance scenarios
enableRingBuffer();
}
private List<String> getCriticalProcesses() {
return List.of(
"java", "docker", "containerd", "kubelet",
"etcd", "kube-apiserver", "kube-controller-manager"
);
}
}
Conclusion
Tracee with eBPF provides:
- Low-overhead runtime security monitoring for Java applications
- Real-time system call tracing and analysis
- Container-aware security monitoring
- Custom eBPF program integration for specialized monitoring
- Performance impact monitoring and optimization
- Comprehensive security policy enforcement
By implementing the patterns and configurations shown above, you can establish a robust runtime security monitoring practice that leverages eBPF's capabilities while integrating seamlessly with your Java applications and container environments.