Hey everyone! I've been working on a project called SysTrace, a Linux behavioral monitoring tool built mainly to learn more about Linux internals, system calls, and cybersecurity.

It uses ptrace to trace a process and monitor different types of activity, including:

File operations

Process execution

Network-related syscalls

Memory operations

I also added a simple rule-based detection system and experimented with using collected behavioral data for ML classification.

What would you improve next? I'm especially interested in opinions about the architecture and whether moving from ptrace toward eBPF would be a good next step.

Thanks !

github