What should be the parameters to generate a threat flag? Initial thoughts: * The rate of syscall invocation is rising significantly * System (CPU, memory) usage is rising significantly * Unusual call pattern Some material that can help in research: [UCLA Research Paper](https://lasr.cs.ucla.edu/lasr-members/songuku/lever/nam/publication/324_final.pdf) [Palo Alto Networks Blog](https://www.paloaltonetworks.com/blog/security-operations/a-deep-dive-into-malicious-direct-syscall-detection/) [Datadog Blog](https://www.datadoghq.com/blog/linux-security-threat-detection-datadog/)
What should be the parameters to generate a threat flag?
Initial thoughts:
Some material that can help in research:
UCLA Research Paper
Palo Alto Networks Blog
Datadog Blog