Launch Intel
De

Deft-Intruder – Real-time malware detection daemon for Linux

Hacker News

Deft-Intruder – Real-time malware detection daemon for Linux

I built an open-source malware detection daemon that monitors all running processes in real-time using ML + heuristics. No kernel modules or eBPF required. Key points: - Polls /proc for new processes (works on any Linux kernel 2.6+) - Random Forest model trained on EMBER 2018 dataset (2.3M samples) - Heuristic rules for crypto miners, ransomware, rootkits - ~20MB RAM, <1% CPU, sub-millisecond scan latency - Pure C, zero runtime dependencies - Model embedded directly in binary (50KB) Why I built this: Existing solutions either require modern kernels (eBPF) or are heavy/proprietary. I wanted something lightweight that works everywhere - servers, containers, old distros. Detection approach: Extract features from executables (entropy, imports, sections), run ML prediction, apply heuristic rules, combine scores. If above threshold, kill the process. Happy to discuss implementation details or Linux security in general.

Visit productView on Hacker NewsNov 25, 2025
Share card

Actual performance

6points
Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →
Hacker NewsStrong engagement from HN community · Strong signals: exist, existing, io · Missing: https docs, excited, just released
78%78% predicted probability of success on Hacker News, based on ML models trained on real launch data.
nativeThis product was originally launched on this platform.
Product HuntOn track for Day 1 leaderboard · Strong signals: model, new, using · Missing: mac, agents, macos
69%69% predicted probability of success on Product Hunt, based on ML models trained on real launch data.
Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting
53%53% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.
AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive
43%43% predicted probability of success on AppSumo, based on ML models trained on real launch data.
TrustMRRLess likely to generate early MRR · Missing: mobile apps, ios, personal
38%38% predicted probability of success on TrustMRR, based on ML models trained on real launch data.
Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue
19%19% predicted probability of success on Acquire.com, based on ML models trained on real launch data.
BetaListMay not resonate with beta-testers · Strong signals: crypto · Missing: web3, chat, cryptocurrency
2%2% predicted probability of success on BetaList, based on ML models trained on real launch data.

Incorrect prediction on native model

Similar products

De
Deft-Intruder – Real-time malware detection daemon for Linux80%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Deft-Intruder – Real-time malware detection daemon for Linux

Hacker News1
In
Intrusion Detection in Real-time62%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Intrusion Detection in Real-time

Hacker News69
Ca
CandleVision Real-time candlestick detection with YOLOv876%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

CandleVision Real-time candlestick detection with YOLOv8

Hacker News1
Gaize
Gaize27%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Real-time impairment detection for cannabis and other drugs.

Product Hunt+13
Ca
Cadmus – a real-time microphone noise suppressor for Linux66%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Cadmus – a real-time microphone noise suppressor for Linux

Hacker News5
Me
MeloCraft – Pitch detection in real-time62%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

MeloCraft – Pitch detection in real-time

Hacker News36
Rt
Rtipc – real-time, zero-copy IPC for Linux67%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Rtipc – real-time, zero-copy IPC for Linux

Hacker News1
Re
Real-Time Anomaly Detection in Graphs55%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Real-Time Anomaly Detection in Graphs

Hacker News4
Ge
Getgud.io – Server-Side cheater and griefer detection in Real-Time63%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Getgud.io – Server-Side cheater and griefer detection in Real-Time

Hacker News1
YetPulse
YetPulse41%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Real-time anomaly detection for online advertising.

Indie Hackerscommitment-full-time
Browse all productsAnalyze your launch