Kernel Borderlands: An eBPF-Based Behavioral Detection and Multi-Agent Containment Architecture for Linux Server Workloads

Linux servers are usually defended by tools that observe kernel activity but leave the response to a human, or by static policies that cannot recognise a hijacked legitimate binary. We present Kernel Borderlands (KB), a kernel-level runtime defence that closes the loop from observation to enforcement. An eBPF sensor scores process behaviour and enforces five graded containment levels, the first four reversible, through BPF-LSM hooks, behind authorisation gates that prevent it from acting against PID 1, critical daemons or its own components. A Go control plane keeps a SHA-256 hash-chained audit log and detects beaconing; a Ray-based agent swarm implements a containment policy trained by Proximal Policy Optimisation and quorum confirmation of actions; and a Rust watchdog verifies BPF bytecode and gates the boot sequence. On 908 held-out samples derived from ADFA-LD, the containment policy reaches 97.1–100% accuracy on every attack class with no under-containment, and the Jury policy has no false negatives. In a live capture, the control plane issued a throttle within about 1 ms of each of six escalations to BORDERLANDS. With all hooks loaded, KB adds 38 ns per system call and 26 µs per process creation, with no measurable overhead on a parallel compile or a CPU-bound workload.