Deft-Intruder
Real-time malware detection daemon for Linux
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
I built an open-source malware detection daemon that monitors all running processes in real-time using ML + heuristics. No kernel modules or eBPF required.Key points:- Polls /proc for new processes (works on any Linux kernel 2.6+)- Random Forest model trained on EMBER 2018 dataset (2.3M samples)- Heuristic rules for crypto miners, ransomware, rootkits- ~20MB RAM, <1% CPU, sub-millisecond scan latency- Pure C, zero runtime dependencies- Model embedded directly in binary (50KB)Why I built this: Existing solutions either require modern kernels (eBPF) or are heavy/proprietary. I wanted something lightweight that works everywhere - servers, containers, old distros.Detection approach: Extract features from executables (entropy, imports, sections), run ML prediction, apply heuristic rules, combine scores. If above threshold, kill the process.Happy to discuss implementation details or Linux security in general.
HN · launched Nov 25, 2025 · 6 upvotes (top 73%) · 0 views
Niche: application and system security scanners · 260 launches, 34 in the last 7 days ▼ -6% · Explore this niche →
Category and tags
- Security
- Observability & eval
- B2B
- Not AI
- Hobby / open-source project
Visit website ↗ Source listing ↗
More like this: all 260 launches in application and system security scanners →
Could you build this?
Partial Creating a basic daemon that inspects /proc and queries a pre-trained scikit-learn model is straightforward, but building an efficient, evasion-resistant security daemon without missing short-lived processes requires systems security depth.
What it would actually take: The system requires a background daemon written in Rust, Go, or C that captures process lifecycles via `/proc` or Netlink process connectors, extracts static/dynamic binary attributes, and evaluates them with a compiled random forest model (such as Treelite or ONNX Runtime). The difficult parts are avoiding time-of-check to time-of-use (TOCTOU) race conditions on transient malicious processes and minimizing CPU overhead without kernel modules. Requires expertise in Linux systems programming, binary analysis, and security engineering.
Discussion
No comments on this launch.
Competitors
Other products that read as similar to this one : 404 launches clear the similarity bar, closest 8 shown.
Attention rank: #313 of 405 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 16 days after the earliest competitor.
- kernwatch · github · 2026-09-11 · 29 upvotes · similarity 0.52
- linux-security-hardening · github · 2026-10-01 · 8 upvotes · similarity 0.50
- netprobe-ir · github · 2026-09-12 · 7 upvotes · similarity 0.48
- preventon-security-suite · github · 2026-11-10 · 102 upvotes · similarity 0.48
- Local-first firmware analyzer using WebAssembly · hn · 2026-03-10 · 8 upvotes · similarity 0.47
- malware-defender · github · 2026-11-10 · 103 upvotes · similarity 0.47
- MalwareAnalyzer: Static scanning, real detonation, an interactive live VM, and a threat graph you can pivot through · yc · 2026-08-31 · 2 upvotes · similarity 0.46
- expoCiber-tools · github · 2026-09-25 · 9 upvotes · similarity 0.46
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.