eBPF-Syscall-Tracer.sh

#!/bin/bash
# eBPF Syscall Tracer
#
# This script uses eBPF to trace and analyze system calls made by suspicious processes.
# It helps identify potential malware behavior patterns by monitoring syscall frequency,
# arguments, and return values.
#
# Options:
# 1. Trace all syscalls for a specific PID
# 2. Monitor syscalls related to file operations
# 3. Monitor syscalls related to network operations
# 4. Monitor syscalls related to process creation
# 5. Monitor syscalls related to memory operations
# 6. Monitor syscalls related to permission changes
# 7. Monitor specific syscall by name
# 8. Monitor syscalls for newly created processes
# 9. Generate frequency report of syscalls
# 10. Filter syscalls by return value (errors)
# 11. Trace syscalls with arguments
# 12. Export traced syscalls to JSON format
# 13. Compare syscall patterns with known malware profiles
# 14. Detect anomalous syscall patterns
# 15. Generate visualization of syscall relationships
# 16. Exit

# Check for required tools
command -v bpftrace >/dev/null 2>&1 || { echo "Error: bpftrace is required but not installed. Install with: apt-get install bpftrace"; exit 1; }

# Function to display menu
show_menu() {
    clear
    echo "===== eBPF Syscall Tracer ====="
    echo "1. Trace all syscalls for a specific PID"
    echo "2. Monitor syscalls related to file operations"
    echo "3. Monitor syscalls related to network operations"
    echo "4. Monitor syscalls related to process creation"
    echo "5. Monitor syscalls related to memory operations"
    echo "6. Monitor syscalls related to permission changes"
    echo "7. Monitor specific syscall by name"
    echo "8. Monitor syscalls for newly created processes"
    echo "9. Generate frequency report of syscalls"
    echo "10. Filter syscalls by return value (errors)"
    echo "11. Trace syscalls with arguments"
    echo "12. Export traced syscalls to JSON format"
    echo "13. Compare syscall patterns with known malware profiles"
    echo "14. Detect anomalous syscall patterns"
    echo "15. Generate visualization of syscall relationships"
    echo "16. Exit"
    echo "================================"
    echo "Enter your choice [1-16]: "
}

# Function to trace all syscalls for a specific PID
trace_pid_syscalls() {
    read -p "Enter PID to trace: " pid
    echo "Tracing all syscalls for PID $pid. Press Ctrl+C to stop."
    sudo bpftrace -e "tracepoint:syscalls:sys_enter_* /pid == $pid/ { @[probe] = count(); }"
}

# Function to monitor file operation syscalls
monitor_file_syscalls() {
    echo "Monitoring file operation syscalls. Press Ctrl+C to stop."
    sudo bpftrace -e '
    tracepoint:syscalls:sys_enter_open,
    tracepoint:syscalls:sys_enter_openat,
    tracepoint:syscalls:sys_enter_read,
    tracepoint:syscalls:sys_enter_write,
    tracepoint:syscalls:sys_enter_close,
    tracepoint:syscalls:sys_enter_unlink,
    tracepoint:syscalls:sys_enter_rename,
    tracepoint:syscalls:sys_enter_mkdir,
    tracepoint:syscalls:sys_enter_rmdir
    {
        time("%H:%M:%S ");
        printf("PID: %-6d COMM: %-16s SYSCALL: %s\n", pid, comm, probe);
    }'
}

# Function to monitor network operation syscalls
monitor_network_syscalls() {
    echo "Monitoring network operation syscalls. Press Ctrl+C to stop."
    sudo bpftrace -e '
    tracepoint:syscalls:sys_enter_socket,
    tracepoint:syscalls:sys_enter_connect,
    tracepoint:syscalls:sys_enter_accept,
    tracepoint:syscalls:sys_enter_bind,
    tracepoint:syscalls:sys_enter_listen,
    tracepoint:syscalls:sys_enter_sendto,
    tracepoint:syscalls:sys_enter_recvfrom,
    tracepoint:syscalls:sys_enter_sendmsg,
    tracepoint:syscalls:sys_enter_recvmsg
    {
        time("%H:%M:%S ");
        printf("PID: %-6d COMM: %-16s SYSCALL: %s\n", pid, comm, probe);
    }'
}

# Function to monitor process creation syscalls
monitor_process_syscalls() {
    echo "Monitoring process creation syscalls. Press Ctrl+C to stop."
    sudo bpftrace -e '
    tracepoint:syscalls:sys_enter_fork,
    tracepoint:syscalls:sys_enter_vfork,
    tracepoint:syscalls:sys_enter_clone,
    tracepoint:syscalls:sys_enter_execve,
    tracepoint:syscalls:sys_enter_execveat,
    tracepoint:syscalls:sys_exit_execve,
    tracepoint:syscalls:sys_exit_execveat
    {
        time("%H:%M:%S ");
        printf("PID: %-6d COMM: %-16s SYSCALL: %s\n", pid, comm, probe);
    }'
}

# Function to monitor memory operation syscalls
monitor_memory_syscalls() {
    echo "Monitoring memory operation syscalls. Press Ctrl+C to stop."
    sudo bpftrace -e '
    tracepoint:syscalls:sys_enter_mmap,
    tracepoint:syscalls:sys_enter_mprotect,
    tracepoint:syscalls:sys_enter_munmap,
    tracepoint:syscalls:sys_enter_brk,
    tracepoint:syscalls:sys_enter_mremap,
    tracepoint:syscalls:sys_enter_remap_file_pages,
    tracepoint:syscalls:sys_enter_madvise
    {
        time("%H:%M:%S ");
        printf("PID: %-6d COMM: %-16s SYSCALL: %s\n", pid, comm, probe);
    }'
}

# Function to monitor permission change syscalls
monitor_permission_syscalls() {
    echo "Monitoring permission change syscalls. Press Ctrl+C to stop."
    sudo bpftrace -e '
    tracepoint:syscalls:sys_enter_chmod,
    tracepoint:syscalls:sys_enter_fchmod,
    tracepoint:syscalls:sys_enter_fchmodat,
    tracepoint:syscalls:sys_enter_chown,
    tracepoint:syscalls:sys_enter_fchown,
    tracepoint:syscalls:sys_enter_fchownat,
    tracepoint:syscalls:sys_enter_setuid,
    tracepoint:syscalls:sys_enter_setgid,
    tracepoint:syscalls:sys_enter_setreuid,
    tracepoint:syscalls:sys_enter_setregid,
    tracepoint:syscalls:sys_enter_setresuid,
    tracepoint:syscalls:sys_enter_setresgid,
    tracepoint:syscalls:sys_enter_setfsuid,
    tracepoint:syscalls:sys_enter_setfsgid,
    tracepoint:syscalls:sys_enter_capset
    {
        time("%H:%M:%S ");
        printf("PID: %-6d COMM: %-16s SYSCALL: %s\n", pid, comm, probe);
    }'
}

# Function to monitor a specific syscall by name
monitor_specific_syscall() {
    read -p "Enter syscall name (without 'sys_' prefix): " syscall_name
    echo "Monitoring $syscall_name syscall. Press Ctrl+C to stop."
    sudo bpftrace -e "
    tracepoint:syscalls:sys_enter_$syscall_name
    {
        time(\"%H:%M:%S \");
        printf(\"PID: %-6d COMM: %-16s SYSCALL: %s\\n\", pid, comm, probe);
    }"
}

# Function to monitor syscalls for newly created processes
monitor_new_processes() {
    echo "Monitoring syscalls for newly created processes. Press Ctrl+C to stop."
    sudo bpftrace -e '
    tracepoint:syscalls:sys_exit_fork,
    tracepoint:syscalls:sys_exit_vfork,
    tracepoint:syscalls:sys_exit_clone
    /args->ret > 0/
    {
        printf("New process created: PID %d (parent: %d, command: %s)\n", args->ret, pid, comm);
        @new_pids[args->ret] = 1;
    }

    tracepoint:syscalls:sys_enter_*
    /@new_pids[pid]/
    {
        time("%H:%M:%S ");
        printf("New PID: %-6d COMM: %-16s SYSCALL: %s\n", pid, comm, probe);
    }'
}

# Function to generate frequency report of syscalls
generate_frequency_report() {
    read -p "Enter PID to analyze (0 for all processes): " pid
    read -p "Enter duration in seconds: " duration
    if [ "$pid" -eq 0 ]; then
        echo "Generating syscall frequency report for all processes for $duration seconds..."
        sudo timeout $duration bpftrace -e 'tracepoint:syscalls:sys_enter_* { @[probe] = count(); }' > syscall_frequency_report.txt
    else
        echo "Generating syscall frequency report for PID $pid for $duration seconds..."
        sudo timeout $duration bpftrace -e "tracepoint:syscalls:sys_enter_* /pid == $pid/ { @[probe] = count(); }" > syscall_frequency_report.txt
    fi
    echo "Report saved to syscall_frequency_report.txt"
    echo "Top 10 most frequent syscalls:"
    sort -nr -k2 syscall_frequency_report.txt | head -10
}

# Function to filter syscalls by return value (errors)
filter_by_return_value() {
    echo "Monitoring syscalls that return errors. Press Ctrl+C to stop."
    sudo bpftrace -e '
    tracepoint:syscalls:sys_exit_*
    /args->ret < 0/
    {
        time("%H:%M:%S ");
        printf("PID: %-6d COMM: %-16s SYSCALL: %-30s RET: %d\n", pid, comm, probe, args->ret);
    }'
}

# Function to trace syscalls with arguments
trace_syscalls_with_args() {
    read -p "Enter PID to trace (0 for all processes): " pid
    if [ "$pid" -eq 0 ]; then
        echo "Tracing open syscalls with arguments for all processes. Press Ctrl+C to stop."
        sudo bpftrace -e '
        tracepoint:syscalls:sys_enter_open,
        tracepoint:syscalls:sys_enter_openat
        {
            time("%H:%M:%S ");
            printf("PID: %-6d COMM: %-16s SYSCALL: %s ", pid, comm, probe);

            if (probe == "tracepoint:syscalls:sys_enter_open") {
                printf("PATH: %s FLAGS: %d MODE: %d\n",
                    str(args->filename), args->flags, args->mode);
            } else {
                printf("FD: %d PATH: %s FLAGS: %d MODE: %d\n",
                    args->dfd, str(args->filename), args->flags, args->mode);
            }
        }'
    else
        echo "Tracing open syscalls with arguments for PID $pid. Press Ctrl+C to stop."
        sudo bpftrace -e "
        tracepoint:syscalls:sys_enter_open,
        tracepoint:syscalls:sys_enter_openat
        /pid == $pid/
        {
            time(\"%H:%M:%S \");
            printf(\"PID: %-6d COMM: %-16s SYSCALL: %s \", pid, comm, probe);

            if (probe == \"tracepoint:syscalls:sys_enter_open\") {
                printf(\"PATH: %s FLAGS: %d MODE: %d\\n\",
                    str(args->filename), args->flags, args->mode);
            } else {
                printf(\"FD: %d PATH: %s FLAGS: %d MODE: %d\\n\",
                    args->dfd, str(args->filename), args->flags, args->mode);
            }
        }"
    fi
}

# Function to export traced syscalls to JSON format
export_to_json() {
    read -p "Enter PID to trace (0 for all processes): " pid
    read -p "Enter duration in seconds: " duration
    output_file="syscall_trace_$(date +%Y%m%d_%H%M%S).json"

    echo "Tracing syscalls for $duration seconds and exporting to $output_file..."
    echo "{\"syscalls\": [" > $output_file

    if [ "$pid" -eq 0 ]; then
        sudo timeout $duration bpftrace -e '
        tracepoint:syscalls:sys_enter_*
        {
            printf("{\"timestamp\":\"%s\",\"pid\":%d,\"comm\":\"%s\",\"syscall\":\"%s\"},\n",
                strftime("%Y-%m-%d %H:%M:%S", nsecs), pid, comm, probe);
        }' >> $output_file
    else
        sudo timeout $duration bpftrace -e "
        tracepoint:syscalls:sys_enter_*
        /pid == $pid/
        {
            printf(\"{\\\"timestamp\\\":\\\"%s\\\",\\\"pid\\\":%d,\\\"comm\\\":\\\"%s\\\",\\\"syscall\\\":\\\"%s\\\"},\\n\",
                strftime(\"%Y-%m-%d %H:%M:%S\", nsecs), pid, comm, probe);
        }" >> $output_file
    fi

    # Fix JSON format (remove trailing comma and close array)
    sed -i '$ s/,$//' $output_file
    echo "]}" >> $output_file

    echo "JSON export completed. Saved to $output_file"
}

# Function to compare syscall patterns with known malware profiles
compare_with_known_profiles() {
    read -p "Enter PID to analyze: " pid
    echo "Analyzing syscall patterns for PID $pid and comparing with known malware profiles..."

    # Create temporary files
    temp_file=$(mktemp)

    # Collect syscall pattern for 10 seconds
    echo "Collecting syscall pattern for 10 seconds..."
    sudo timeout 10 bpftrace -e "
    tracepoint:syscalls:sys_enter_*
    /pid == $pid/
    {
        @[probe] = count();
    }" > $temp_file

    # Define known malware patterns (simplified for demonstration)
    echo "Comparing with known malware patterns..."
    echo "
    Cryptominer pattern: High frequency of CPU-intensive syscalls (nanosleep, clock_gettime)
    Rootkit pattern: Unusual combinations of module-related syscalls, hidden processes
    Backdoor pattern: Persistent network connections, unusual file access patterns
    Data exfiltration: High frequency of read/write operations followed by network activity
    "

    # Check for cryptominer pattern
    if grep -q "nanosleep\|clock_gettime" $temp_file && grep -q "count: [0-9]\{3,\}" $temp_file; then
        echo "WARNING: Process shows patterns consistent with cryptomining malware!"
    fi

    # Check for rootkit pattern
    if grep -q "init_module\|finit_module\|delete_module" $temp_file; then
        echo "WARNING: Process shows patterns consistent with rootkit activity!"
    fi

    # Check for backdoor pattern
    network_count=$(grep -c "connect\|sendto\|recvfrom" $temp_file)
    if [ "$network_count" -gt 10 ]; then
        echo "WARNING: Process shows patterns consistent with backdoor activity!"
    fi

    # Clean up
    rm $temp_file
    echo "Analysis complete."
}

# Function to detect anomalous syscall patterns
detect_anomalous_patterns() {
    read -p "Enter monitoring duration in seconds: " duration
    echo "Monitoring system for anomalous syscall patterns for $duration seconds..."

    # Create temporary files
    baseline_file=$(mktemp)

    echo "Establishing baseline syscall frequency..."
    sudo timeout 5 bpftrace -e '
    tracepoint:syscalls:sys_enter_*
    {
        @[comm, probe] = count();
    }' > $baseline_file

    echo "Monitoring for anomalies..."
    sudo timeout $duration bpftrace -e '
    tracepoint:syscalls:sys_enter_*
    {
        @syscalls[comm, probe] = count();
    }

    interval:s:1
    {
        print(@syscalls);
        print("Analyzing for anomalous patterns...");
        clear(@syscalls);
    }'

    # Clean up
    rm $baseline_file
    echo "Anomaly detection complete."
}

# Function to generate visualization of syscall relationships
generate_visualization() {
    read -p "Enter PID to visualize: " pid
    read -p "Enter duration in seconds: " duration
    output_file="syscall_graph_$(date +%Y%m%d_%H%M%S).dot"

    echo "Generating syscall relationship graph for PID $pid for $duration seconds..."

    # Create DOT file header
    echo "digraph syscall_graph {" > $output_file
    echo "  node [shape=box];" >> $output_file

    # Collect syscall sequence
    echo "Collecting syscall sequence..."
    sudo timeout $duration bpftrace -e "
    tracepoint:syscalls:sys_enter_*
    /pid == $pid/
    {
        printf(\"%s -> \", probe);
    }" | sed 's/tracepoint:syscalls:sys_enter_//g' | tr -d '\n' > syscall_sequence.txt

    # Process sequence to create graph edges
    echo "Processing syscall sequence to create graph..."
    prev_syscall=""
    for syscall in $(cat syscall_sequence.txt | tr ' -> ' '\n' | grep -v "^$"); do
        if [ ! -z "$prev_syscall" ]; then
            echo "  \"$prev_syscall\" -> \"$syscall\";" >> $output_file
        fi
        prev_syscall=$syscall
    done

    # Close DOT file
    echo "}" >> $output_file

    echo "Visualization data saved to $output_file"
    echo "To create a graph image, install graphviz and run: dot -Tpng $output_file -o syscall_graph.png"

    # Clean up
    rm syscall_sequence.txt
}

# Main function
main() {
    while true; do
        show_menu
        read choice

        case $choice in
            1) trace_pid_syscalls ;;
            2) monitor_file_syscalls ;;
            3) monitor_network_syscalls ;;
            4) monitor_process_syscalls ;;
            5) monitor_memory_syscalls ;;
            6) monitor_permission_syscalls ;;
            7) monitor_specific_syscall ;;
            8) monitor_new_processes ;;
            9) generate_frequency_report ;;
            10) filter_by_return_value ;;
            11) trace_syscalls_with_args ;;
            12) export_to_json ;;
            13) compare_with_known_profiles ;;
            14) detect_anomalous_patterns ;;
            15) generate_visualization ;;
            16) echo "Exiting..."; exit 0 ;;
            *) echo "Invalid option. Press Enter to continue..."; read ;;
        esac

        echo
        echo "Operation completed. Press Enter to continue..."
        read
    done
}

# Start the script
main