Elkeid - Bytedance Cloud Workload Protection Platform

English | 简体中文

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.

With the business development of enterprises, the situation of multi-cloud, cloud-native, and coexistence of multiple workloads has become more and more prominent. We hope that there can be a set of solutions that can meet the security requirements under different workloads, so Elkeid was born.

Introduction

Elkeid has the following key capabilities:

• Elkeid not only has the traditional HIDS (Host Intrusion Detection System) ability for host layer intrusion detection and malicious file identification, but also can well identify malicious behaviors in containers. The host can meet the anti-intrusion security requirements of the host and the container on it, and the powerful kernel-level data collection capability at the bottom of Elkeid can satisfy the desire of most security analyst for host-level data.

• For the running business Elkeid has the RASP capability and can be injected into the business process for anti-intrusion protection, not only the operation and maintenance personnel do not need to install another Agent, but also the business does not need to restart.

• For K8s itself, Elkeid supports collection to K8s Audit Log to perform intrusion detection and risk identification on the K8s system.

• Elkeid's rule engine Elkeid HUB can also be well linked with external multiple systems.

Elkeid integrates these capabilities into one platform to meet the complex security requirements of different workloads, while also achieving multi-component capability association. What is even more rare is that each component undergoes massive byte-beating. Data and years of combat testing.

Elkeid Community Edition Description

It should be noted that there are differences between the Elkeid open source version and the full version. The current open source capabilities mainly include:

• All on-device capabilities, that is, on-device data/asset/partial collection capabilities, kernel-state data collection capabilities, RASP probe parts, etc., and are consistent with the internal version of ByteDance;
• All backend capabilities, namely Agent Center, service discovery, etc., are consistent with the internal version of ByteDance;
• Provide a community edition rule engine, namely Elkeid HUB, and use it as an example with a small number of strategies;
• Provides community version of Elkeid Console and some supporting capabilities.

Therefore, it is necessary to have complete anti-intrusion and risk perception capabilities, and it is also necessary to construct policies based on Elkeid HUB and perform secondary processing of the data collected by Elkeid.

Elkeid Architecture

Elkeid Host Ability

• Elkeid Agent Linux userspace agent，responsible for managing various plugin, communication with Elkeid Server.
• Elkeid Driver Driver can collect data on Linux Kernel, support container runtime , communication with Elkeid Driver Plugin.
• Elkeid RASP Support CPython、Golang、JVM、NodeJS、PHP runtime probe, supports dynamic injection into the runtime.
• Elkeid Agent Plugin List
  • Driver Plugin: Responsible for managing Elkeid Driver, and process the driver data.
  • Collector Plugin: Responsible for the collection of assets/log information on the Linux System, such as user list, crontab, package information, etc.
  • Journal Watcher: Responsible for monitoring systemd logs, currently supports ssh related log collection and reporting.
  • Scanner Plugin: Responsible for static detection of malicious files on the host, currently supports yara.
  • RASP Plugin: Responsible for managing RASP components and processing data collected from RASP.
  • Baseline Plugin: Responsible for detecting baseline risks based on baseline check policies.
• Elkeid Data Format
• Elkeid Data Usage Tutorial

Elkeid Backend Ability

• Elkeid AgentCenter Responsible for communicating with the Agent, collecting Agent data and simply processing it and then summing it into the MQ, is also responsible for the management of the Agent, including Agent upgrade, configuration modification, task distribution, etc.
• Elkeid ServiceDiscovery Each component in the background needs to register and synchronize service information with the component regularly, so as to ensure that the instances in each service module are visible to each other and facilitate direct communication.
• Elkeid Manager Responsible for the management of the entire backend, and provide related query and management API.
• Elkeid Console Elkeid Front-end
• Elkeid HUB Elkeid HIDS RuleEngine

Elkeid Function List