title: ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ°Ñ CI/CD Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÐµÑ Ð½Ð¾Ð»Ð¾Ð³Ð¸Ð¸ eBPF
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Detection of malicious activity in CI/CD pipelines using eBPF
Creators: name: ÐÑÐ³Ð°ÐµÐ², ÐÑÑÐµÑÐ»Ð°Ð²
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2025
Subjects: ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÑ ci/cd
Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð°Ñ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ
Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹
ebpf
ÑÐ¸ÑÑÐµÐ¼Ð½ÑÐµ Ð²ÑÐ·Ð¾Ð²Ñ
devsecops
ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ½ÑÐµ ÑÐ¸ÑÑÐµÐ¼Ñ
ci/cd pipelines
malicious activity
anomaly detection
syscalls
container systems

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ°Ñ CI/CD Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð´Ð°Ð½Ð½ÑÑ, Ð¿Ð¾Ð»ÑÑÐ°ÐµÐ¼ÑÑ Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ ÑÐµÑÐ½Ð¾Ð»Ð¾Ð³Ð¸Ð¸ eBPF. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ Ðº Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð°ÑÐ°Ðº Ð¸ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹, Ð¿ÑÐ¾Ð¸ÑÑÐ¾Ð´ÑÑÐ¸Ñ Ð²Ð¾ Ð²ÑÐµÐ¼Ñ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ° CI/CD. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÐ¿ÑÐµÐ´ÐµÐ»Ð¸ÑÑ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÐ¸ Ð½Ð°ÑÑÑÐ¸ÑÐµÐ»Ñ Ð¸ Ð°ÐºÑÑÐ°Ð»ÑÐ½ÑÐµ ÑÐ³ÑÐ¾Ð·Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð´Ð»Ñ ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ¾Ð² CI/CD. 2. ÐÑÑÐ²Ð¸ÑÑ Ð¾Ð³ÑÐ°Ð½Ð¸ÑÐµÐ½Ð¸Ñ ÑÑÐµÐ´ÑÑÐ² Ð·Ð°ÑÐ¸ÑÑ ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ¾Ð² CI/CD Ð¸ Ð¿ÐµÑÑÐ¿ÐµÐºÑÐ¸Ð²Ð½ÑÐµ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ Ðº Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸. 3. ÐÑÐµÐ´Ð»Ð¾Ð¶Ð¸ÑÑ ÑÐ¿Ð¾ÑÐ¾Ð± Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ°Ñ CI/CD Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÐµÑÐ½Ð¾Ð»Ð¾Ð³Ð¸Ð¸ eBPF Ð¸ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. 4. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÐ¹ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ Ð¸ Ð¿ÑÐ¾Ð²ÐµÑÑÐ¸ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½ÑÑ Ð¿ÑÐ¾Ð²ÐµÑÐºÑ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½Ð¾Ð³Ð¾ ÑÐ¿Ð¾ÑÐ¾Ð±Ð°. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ñ ÑÐ±Ð¾ÑÐºÐ¸ ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ¾Ð² CI/CD, Ð¿Ð¾ÐºÐ°Ð·Ð°Ð½Ð° Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð·Ð°Ð¼ÐµÐ½ÑÐµÐ¼Ð¾ÑÑÑ ÑÐ¸ÑÑÐµÐ¼. ÐÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ñ ÑÐ¸Ð¿Ñ Ð½Ð°ÑÑÑÐ¸ÑÐµÐ»Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐµ CI/CD, ÑÐ¾ÑÑÐ°Ð²Ð»ÐµÐ½ ÑÐ¿Ð¸ÑÐ¾Ðº Ð°ÐºÑÑÐ°Ð»ÑÐ½ÑÑ ÑÐ³ÑÐ¾Ð·. ÐÐ¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ñ Ð¾Ð³ÑÐ°Ð½Ð¸ÑÐµÐ½Ð¸Ñ ÑÑÐµÐ´ÑÑÐ² Ð·Ð°ÑÐ¸ÑÑ ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ¾Ð². Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ñ Ð°ÑÐ°ÐºÐ¸ Ð½Ð° ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑ, ÑÐ¾Ð±ÑÐ°Ð½ Ð½Ð°Ð±Ð¾Ñ Ð´Ð°Ð½Ð½ÑÑ Ð´Ð»Ñ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½ ÐºÐ¾Ð¼Ð±Ð¸Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÐ¹ ÑÐ¿Ð¾ÑÐ¾Ð± Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¿Ð¾ÑÐµÐ½ÑÐ¸Ð°Ð»ÑÐ½Ð¾ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ°Ñ. Ð­ÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½Ð¾ Ð¿ÑÐ¾Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð° ÑÐ¾ÑÐ½Ð¾ÑÑÑ Ð¸ ÑÐ°Ð±Ð¾ÑÐ¾ÑÐ¿Ð¾ÑÐ¾Ð±Ð½Ð¾ÑÑÑ ÑÐ¿Ð¾ÑÐ¾Ð±Ð°. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð´Ð»Ñ Ð²Ð½ÐµÐ´ÑÐµÐ½Ð¸Ñ Ð² ÑÑÐµÐ´ÑÑÐ²Ð° Ð·Ð°ÑÐ¸ÑÑ ÑÐ±Ð¾ÑÑÐ¸ÐºÐ¾Ð² Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ð¹ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ ÐºÐ¾Ð½Ð²ÐµÐ¹ÐµÑÐ¾Ð².
description: The purpose of the study is to detect malicious activity in CI/CD pipelines using data collected through eBPF. The subject of the work is modern approaches to detecting attacks and anomalies that occur during the execution of a CI/CD pipeline. The research sets the following goals: 1. Identify the intruders capabilities and current security threats for CI/CD pipelines. 2. Identify limitations of CI/CD pipeline protection tools and explore approaches to detecting malicious activity. 3. Development of a way to detect malicious activity in CI/CD pipelines using eBPF technology and behavioral analysis. 4. Implement a software prototype and conduct experimental testing of the proposed method. During the work CI/CD systems were investigated and the interchangeability of these systems was demonstrated. Types of security threats in the CI/CD pipeline were proposed, and a list of current threats was compiled. The limitations of existing protection tools were identified. Attacks on the pipeline were simulated, and a set of data was collected for testing purposes kernel network stack implementation and architecture were studied. The work resulted in the development of combined way for detecting potentially malicious activity in pipelines was proposed. The accuracy and operability of the way have been experimentally demonstrated. These results can be used to implement protection tools for CI systems and contribute to research in CI/CD pipelines security.