Abstract: Execution of a software program that is programmed in an interpreter-based language is monitored. Programs for recording entry and exit points of functions and invocations of system calls are attached to the software program. At least one program is implemented using eBPF. A monitoring agent receives indications of entries and exits to the functions. Based on the indications of entries and exits, the monitoring agent monitors a stack trace of the software program. Based on the indications of system call invocations and based on the stack trace of the software program, the monitoring agent identifies system call invocations by a software library. The monitoring agent performs a responsive action in response to a determination that a system call invocation deviates from a pre-defined policy of authorized functionalities.

Abstract: Execution of a software program that is programmed in an interpreter-based language is monitored. Programs for recording entry and exit points of functions and invocations of system calls are attached to the software program. At least one program is implemented using eBPF. A monitoring agent receives indications of entries and exits to the functions. Based on the indications of entries and exits, the monitoring agent monitors a stack trace of the software program. Based on the indications of system call invocations and based on the stack trace of the software program, the monitoring agent identifies system call invocations by a software library. The monitoring agent performs a responsive action in response to a determination that a system call invocation deviates from a pre-defined policy of authorized functionalities.