Cloud-Native IDS — eBPF CO-RE + Rust Stream Core. Brain-Eye decoupled architecture with 4-layer AI detection and active learning feedback loop.
Evidence Ledger
Metrics, implementation details, integrations, and validation frames are surfaced before the pitch so security teams and AI search systems can cite concrete proof points.
Ingest Path (rules disabled) · internal measurement, public benchmark suite on roadmap
~600k EPS ingest/channel throughput (rules disabled, internal audit measurement); ~1k EPS full-AI inline — event sampling recommended in production
Kubernetes / Docker / Prometheus / Sigma Rules
Brain-Eye decoupled architecture: kernel-native eBPF telemetry + 4-layer AI detection with active learning
Citation snippets
Short, source-backed product facts for analyst notes and buyer diligence. Each links to the canonical product page.
https://innora.ai/products/nora-visionPositioning
Nora Vision is an Innora.ai product: Cloud-Native IDS — eBPF CO-RE + Rust Stream Core. Brain-Eye decoupled architecture with 4-layer AI detection and active learning feedback loop.
https://innora.ai/products/nora-vision
Primary proof
Nora Vision reports Ingest Path (rules disabled) of ~600k EPS (internal audit), and Full-AI Inline of ~1k EPS, per its published technical specifications.
https://innora.ai/products/nora-vision
Integration context
How Nora Vision differs from the typical baseline: Brain-Eye decoupled architecture: kernel-native eBPF telemetry + 4-layer AI detection with active learning
https://innora.ai/products/nora-vision
Architecture Proof
A buyer-readable map from kernel telemetry to AI detection, backed by the published Nora Vision metrics and technical specifications.
Rust/Aya probes hook exec and network events close to the kernel without relying on heavyweight userspace polling.
The Brain/Eye path uses ring-buffer transfer and a Rust Stream Core to process production event volume.
Rules, anomaly detection, HMM sequence analysis, and active learning are described as one layered detection brain.
The rule plane is sandboxed for safe updates and benchmarked separately from the stream core.
Containers and microservices create ephemeral, encrypted environments that legacy IDS cannot monitor. Signature-only detection misses zero-days and multi-step attack chains, while heavyweight userspace agents impose significant CPU overhead on production workloads. Rootkits leverage DKOM and LKM hiding to evade userspace tools entirely.
Brain-Eye decoupled architecture: Rust/Aya eBPF CO-RE probes (Eye) stream kernel events over zero-copy ring buffers to the Rust Stream Core (Brain), which sustains ~600k EPS ingest/channel throughput with rules disabled (internal audit) — well above its 250k evt/s design target. With all four AI layers inline, throughput falls to ~1k EPS (CPU-bound), so production deployments sample events at ingest. The 4-layer engine — Sigma rules, Isolation Forest anomaly detection, HMM kill-chain analysis, and active learning — covers 7 threat categories across 17 detection modules.
Built for high-performance security operations and enterprise-scale protection.
Layer 1: Sigma-compatible Rule Engine with inverted index. Layer 2: Isolation Forest anomaly detection (100 estimators, 1% contamination). Layer 3: HMM sequence analysis for multi-step kill-chains (curl→chmod→exec). Layer 4: Active Learning with RandomForest trained on analyst TP/FP feedback to reduce false positives over time.
Rust/Aya eBPF probes hooking sys_enter_execve and tcp_connect with CO-RE (Compile Once Run Everywhere). Lock-free SPSC channels via flume for zero-copy event transfer. Python BCC fallback collector for legacy kernels. Linux 5.8+ with BTF.
Tokio async pipeline with adaptive dynamic batching (16-256 events). WASM rule engine compiled via wasm-bindgen for sandboxed hot-reload with zero downtime. P99 latency tracking, ~600k EPS ingest throughput (rules disabled, internal audit). Configurable worker pool with lock-free parking_lot::RwLock.
17 specialized modules: rootkit detector (DKOM, syscall hooks, LKM hiding with encrypted SQLCipher DB), privilege escalation (SUID abuse, kernel exploit patterns), container security (Docker/K8s escapes, 20+ risky capabilities), cryptominer detection (Stratum protocol, pool DNS), SSH brute-force analyzer, network anomaly (ARP spoofing, beaconing, geo-risk IPs), file integrity monitoring, kernel module inspection, log analysis, behavior monitoring, library inspection, advanced threat detection, process-graph correlation (NetworkX), scheduled tasks, system resources, user-account anomalies, and streaming detection.
22 detection rules (DETECTION_MATRIX, repo-verifiable) across 7 threat categories mapped to MITRE ATT&CK techniques: Container Escape (T1611), Fileless Attack (T1620/T1059), Lateral Movement & Credential Access (T1572/T1003/T1046), Privilege Escalation (T1548/T1068/T1574), Cryptominer (T1496), Supply Chain (T1195), APT/C2 (T1071/T1074/T1070).
Manager-Agent topology via Protobuf gRPC: heartbeat with config hash diffing for zero-downtime rule distribution, batch alert upload with MITRE technique IDs, and pull-based rule synchronization. Kubernetes DaemonSet deployment with hostPID/hostNetwork for full kernel visibility.
Local CSV + remote AbuseIPDB API feeds with 1000-entry LRU cache. Built-in MITRE ATT&CK v14 technique mapper. Multi-channel alerting: Webhook (SIEM integration), Email (SMTP), Flask-SocketIO real-time dashboard. Alert deduplication via SHA-256 fingerprinting with configurable dedup window (default 5 min) and rate limiting (default 10 alerts/min).
Detailed specifications and infrastructure requirements.
Rust/Aya kernel tracepoints (sys_enter_execve, tcp_connect), zero-copy ring buffers
Tokio async pipeline, ~600k EPS ingest throughput (rules disabled, internal audit), adaptive batching 16-256
Sigma rules → Isolation Forest → HMM kill-chain → Active Learning
gRPC Manager-Agent, Webhook/SIEM, real-time dashboard
How Nora Vision compares to the OSS runtime-security baseline (Falco/auditd class).
| Feature | Nora Vision | Typical Baseline |
|---|---|---|
| Architecture | Brain-Eye Decoupled (Rust + eBPF CO-RE) | Single-agent monolithic design (Falco/auditd class) |
| Detection | 4-Layer AI (Rules + Anomaly + Sequence + Active Learning) | Rules engine only — no ML anomaly / kill-chain sequence layers |
| Performance | ~600k EPS Ingest Path (rules disabled) + Zero-Copy Pipeline | Userspace agents with notable CPU overhead |
| Kill-Chain | HMM Temporal Attack Sequence Detection | Individual event alerts |
| Threat Mapping | 7 MITRE ATT&CK Categories / 17 Modules | Community rule feeds |
| Rule Engine | WASM Sandboxed Hot-Reload | Hot reload without WASM sandbox isolation |
Answers to common buyer questions, backed by product specifications and differentiation data.
eBPF CO-RE IDS: ~600k EPS ingest (rules disabled, internal audit). 4-layer AI detects rootkits, container escapes, APT kill-chains across 7 MITRE categories.
Nora Vision publishes measurable product evidence including Ingest Path (rules disabled): ~600k EPS (internal audit); Full-AI Inline: ~1k EPS; MITRE Coverage: 7 Categories / 22 Rules. THROUGHPUT: ~600k EPS ingest/channel throughput (rules disabled, internal audit measurement); ~1k EPS full-AI inline — event sampling recommended in production.
Nora Vision integrates with Kubernetes, Docker, Prometheus, Sigma Rules, Trivy.
Brain-Eye decoupled architecture: kernel-native eBPF telemetry + 4-layer AI detection with active learning
Evaluate Nora Vision on real workloads — live dashboard and enterprise trial available.