Open-Source Rust and eBPF Tool Kills Ransomware Processes in Real Time

A developer has built Talus, an open-source Linux security tool written in Rust that uses eBPF tracepoints to monitor file-open syscalls and automatically terminate suspicious processes the moment a ransomware-like pattern is detected. Unlike conventional antivirus software that only alerts users, Talus issues a SIGKILL signal to the offending process immediately upon verdict, before significant file encryption can occur. The tool uses per-CPU perf buffers and a zero-copy event pipeline to achieve throughput of roughly 280,000 events per second while consuming only about 7.6% CPU on a live desktop. To reduce false positives from legitimate high-activity processes like backup jobs or build systems, Talus employs a sliding-window file-open rate heuristic combined with Shannon entropy scoring of filenames. The project is MIT-licensed and publicly available on GitHub, and supports configurable thresholds for both passive monitoring and active auto-kill modes.