04 — Security

Security Engine

WormSec includes a modular Endpoint Detection & Response (EDR) engine for Linux. It continuously monitors system activity through the /proc filesystem and generates structured alerts whenever suspicious behaviour is detected.

Overview

The security engine is composed of independent detectors running inside a central monitoring loop. Every 500 milliseconds, the engine collects a new snapshot of running processes from the Linux /proc filesystem. Each detector analyses this snapshot and produces alerts independently.

The architecture is fully modular. New detectors can be added without modifying the monitoring engine, making the system easy to extend and maintain.

Architecture

The monitoring engine follows a simple pipeline:

                Collector (/proc)
                        │
                        ▼
                Process Snapshot
                        │
                        ▼
                Detection Engine
                        │
                 ┌──────┼───────────────┐
                 │      │       │       │
                CPU   RAM   Zombie   Orphan
                 │      │       │       │
                 └──────┴───────┴───────┘
                        │
                        ▼
                 JSON Alerts

Each detector receives the same process snapshot and performs a specific analysis. Detectors are completely independent from one another.

Available Detectors

The current implementation includes several behavioural detectors:

                F4  High CPU usage
                F5  High memory usage
                F6  Orphan processes
                F7  Persistent zombie processes
                F8  Execve burst
                F9  Thread explosion
                F10 Fork abuse
                F11 Privilege changes
                F12 Ptrace abuse
                F13 Sensitive file access
                F14 Self deleting binaries
                F15 Chmod abuse
                F16 Dynamic executable detection

Each detector evaluates a different aspect of process behaviour and emits structured alerts containing the process identifier, executable name, severity level and detection reason.

Monitoring Cycle

The engine continuously repeats the following workflow:

                Read /proc
                      │
                      ▼
                Build process snapshot
                      │
                      ▼
                Run every detector
                      │
                      ▼
                Generate JSON alerts
                      │
                      ▼
                Wait 500 ms
                      │
                      └───────────────► Repeat

This lightweight polling approach allows WormSec to monitor Linux endpoints without requiring kernel modules or elevated privileges while remaining fully extensible through additional detectors.