A method for monitoring an autonomously operated computer system running at least one software

Abstract

The present invention relates to a method implemented by a monitoring module (42) programmed in the RUST programming language and collected via an eBPF module (44) installed in the kernel space (28) of a GNU / Linux operating system (26) to collect activity data, the monitoring module (42) being configured to perform the following steps: - In a secure operational observation environment, observing the behavior of at least one software (24) based on the activity data collected via the eBPF module (44) and storing reference behavior in a reference behavior model (52), then - In an autonomous operational monitored environment, monitoring at least one behavior of at least one software (24) based on the activity data collected via the eBPF module (44), - If a deviation is detected between the monitored behavior and the expected reference behavior (56), keeping at least one software (24) running and generating and sending an event message (58). The method implemented by a monitoring module (42) programmed in RUST programming language and collecting activity data via an eBPF module (44) installed in the kernel space (28) of a GNU / Linux operating system (26), the monitoring module (42) being configured to perform the steps of: - in a safe operational observing environment, observe behaviors of the at least one software (24) based on activity data collected via the eBPF module (44) and store reference behaviors into a reference behavioral model (52), then - in an autonomous operational monitored environment, monitor at least one behavior of the at least one software (24) based on activity data collected via the eBPF module (44), - if a deviation is detected between the monitored behavior and the expected reference behavior (56), keep the at least one software (24) running and generate and send an event message (58).

Images