[Master Class #75] Programmatic Kernel Auditing: Using System Calls Telemetry to Detect Compromised Binary Execution in Real-Time
[Master Class #75] Programmatic Kernel Auditing: Using System Calls Telemetry to Detect Compromised Binary Execution in Real-Time MASTER CLASS #75 - 2026.09.06 - [Master Class #75] Programmatic Kernel Auditing: Using System Calls Telemetry to Detect Compromised Binary Execution in Real-Time BRAVOECONOMY: DECENTRALIZED SMALL BUSINESS AUTOMATION Abstract: This systems architecture whitepaper presents a high-performance, low-overhead framework for real-time detection of compromised binary execution on Linux platforms via programmatic kernel auditing. By leveraging the Linux Audit Subsystem ( kauditd ) and intercepting execve and execveat system calls, we construct a deterministic, low-latency telemetry pipeline capable of identifying anomalous execution paths, privilege escalations, and memory-space hijacking. We analyze the kernel-...