Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{201150,
        author = {K Mohamed Ibrahim},
        title = {Hunter X: A Hybrid eBPF-ML Framework for Explainable Kernel-Level Threat Detection},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {12},
        pages = {12783-12789},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=201150},
        abstract = {Signature-based intrusion detection misses novel attacks; most ML-based alternatives trade explainability and operational safety for raw detection numbers. Hunter X takes a different path. By pairing eBPF kernel telemetry with a hybrid anomaly pipeline Isolation Forest for volume anomalies and a Variational Autoencoder for sequence anomalies the system catches the attack classes that trip up single-model approaches while holding CPU overhead below 2%. SHAP attribution maps each detection to specific behavioral features and then to MITRE ATT&CK tactics, giving analysts something they can act on rather than just a score. Active blocking passes through six independent safety layers before any process is touched, significantly reducing false-positive risk. Evaluated on live attack simulations across five categories, Hunter X achieves 81.3% precision and a 0.860 F1-score. Where direct performance comparisons with prior work are not meaningful due to differing evaluation environments, architectural comparisons are: a 3.1 MB deployment package, hot-swappable models that need no kernel recompilation, and explicit documentation of failure modes rather than the usual silence on the topic.},
        keywords = {Intrusion Detection, eBPF, Behavioral Analysis, Machine Learning, Explainable AI},
        month = {May},
        }