Linux runtime activity becomes telecom security evidence across 5G Core, Open RAN, Kubernetes CNFs, user plane systems, and service based interfaces.
Telovix understands telecom protocols, network function roles, tunnels, sessions, peer relationships, runtime anomalies, attack chains, Kubernetes posture, vulnerabilities, and investigation context.
Capability pipeline
Low level Linux activity is connected with telecom protocol state, network function identity, user plane sessions, Open RAN control paths, Kubernetes workload context, and investigation evidence.
Your infrastructure
Bare metal or cloud nodes you operate
Runtime evidence
Process · Socket · Protocol
Pod · Peer · Tunnel
Inside the workload path
Linux signals mapped to telecom context
Telecom evidence model
Security and operations context
Evidence for triage, forensics, and exposure
Capability coverage
eBPF runtime evidence is combined with 5G Core, Open RAN, Kubernetes, user-plane, service mesh, and network function context so teams can investigate what actually changed.
AMF · SMF · UPF · NRF · CU · DU · RICClassifies telecom workloads from what they actually do at runtime, not only from names, labels, or declared inventory. A process speaking PFCP, binding GTP-U, owning NGAP SCTP, or calling SBI APIs becomes part of the telecom model.
SEID · PDR · FAR · URR · heartbeatTracks session control as state, not just UDP traffic. Invalid SEIDs, peer liveliness failure, session storms, direction violations, setup latency, and session loss after a network function restart can be surfaced.
TEID lifecycle · N3 · N9 · S1-UBuilds tunnel inventory around TEIDs and peers. Orphan TEIDs, TEID churn, TEID spray, unexpected peers, tunnel floods, encapsulation loops, control-plane content inside GTP-U, and DPDK or AF_XDP visibility gaps can be shown.
HTTP/2 · OAuth · NF API meshMaps service-based interface calls into a caller matrix. Cross-NF token reuse, unusual call frequency, high error rates, slow paths, unexpected service access, reconnaissance behavior, and plaintext SBI exposure can be detected.
E2 · O1 · O2 · xApp · rAppTracks RIC peers, E2 subscriptions, O1 management sessions, O2 resource operations, xApp and rApp API calls, KPM access, timing processes, and CU/DU interface boundaries for O-RAN WG11 aligned evidence.
Pods · namespaces · images · hugepages · VFIOConnects container runtime state to telecom risk. CNF binary drift, namespace escape, privilege changes, unexpected management egress, hugepage misuse, VFIO access, SR-IOV misuse, and resource pressure on network function nodes can be flagged.
Where the platform adds value
Security teams get evidence that normally lives in separate places. Kernel activity, telecom protocol behavior, network function identity, user plane state, Kubernetes context, vulnerability exposure, and investigation timelines are connected into one model.
Product surfaces
This is not only protocol detection. Runtime inspection, investigations, behavioral analytics, attack chains, Kubernetes context, vulnerability exposure, and AI assisted analysis are combined in one capability portfolio.
Inspect process trees, top processes, system activity, network connections, red flags, listening services, containers, live events, and protocol capture files from one investigation surface.
process tree · sockets · containers · protocol captureTrace a suspicious binary through process lineage, child processes, network destinations, file activity, shell sessions, linked evidence, and matching behavior on other nodes.
lineage · fingerprints · shell sessions · case timelineBuild per-binary baselines for spawned children, network destinations, file paths, arguments, inbound ports, write paths, and time of execution, then score drift from learned behavior.
spawn profile · net profile · file profile · drift scoreConnect related runtime events into named sequences such as process injection to command and control, privilege escalation to network connection, webshell spawn, rootkit activity, and credential exfiltration.
multi stage correlation · MITRE mapping · evidence sequenceEvidence depth
Host behavior, packet level protocol evidence, network function identity, Kubernetes workload context, and service impact are linked into one telecom aware model.
The result is a portfolio of capabilities for security teams that operate 5G Core, Open RAN, user plane, cloud native network functions, and mixed 4G or 5G environments.
Kubernetes CNF security
Kubernetes inventory, workload posture, image exposure, runtime events, and network policy context are connected with the telecom behavior of the functions running inside the cluster.
Every pod, namespace, workload owner, running phase, container image, image digest, restart count, labels, node, and cluster context connected to runtime activity.
Privileged containers, host networking, host PID, host IPC, SYS_ADMIN, NET_ADMIN, root containers, and privilege escalation are surfaced as workload risk.
Container images are discovered from workload inventory, scanned for CVEs, connected to affected hosts, and exported as CycloneDX SBOM documents.
Observed services, network policies, reconstructed YAML, and admission decisions help explain how CNF configuration relates to runtime exposure.
Coverage
| Capability | Runtime evidence | Product surface | Scope |
|---|---|---|---|
| Telecom protocol intelligence | NGAP, PFCP, GTP-U, F1AP, E1AP, XnAP, E2AP, SCTP, Diameter, RADIUS, SIP, SBI HTTP/2, NAS5G, M3UA, IKEv2 | Protocol state, procedure behavior, peer direction, decode errors | 5G Core, Open RAN, 4G EPC, IMS, SIGTRAN |
| Network function understanding | Ports, peers, protocols, process names, binary paths, runtime behavior | AMF, SMF, UPF, NRF, PCF, CU, DU, RIC, MME, SGW, PGW, HSS, IMS roles | Radio, core, user plane, service mesh |
| User plane and session state | PFCP sessions, SEIDs, PDRs, FARs, URRs, heartbeats, GTP-U TEIDs | Tunnel churn, tunnel floods, peer drift, boundary violations, session loss | N3, N4, N6, N9 and user plane nodes |
| Open RAN security | E2, O1, O2, xApp, rApp, RIC peers, KPM, management sessions | Rogue RIC, public peer exposure, management drift, WG11 evidence | Near RT RIC, CU, DU, O Cloud |
| Investigation and attack chains | Process lineage, network connections, file activity, shell sessions, suspicious event sequences | Cases, timelines, MITRE mapping, multi stage attack chains, fleet correlation | Security operations and incident response |
| Kubernetes CNF security | Pods, namespaces, workloads, images, posture, network policies, reconstructed YAML | Privileged workloads, host namespace risk, image exposure, admission history | Cloud native 5G Core and CNF clusters |
| SBOM and vulnerability exposure | Container image references, digests, cluster and node placement | Trivy scans, CVE counts, CycloneDX export, affected hosts | Container image supply chain |
| AI assisted investigation | Events, flows, DNS, privilege changes, namespaces, resource metrics, telecom snapshots | 44 structured tools over alerts, anomalies, tunnels, SLOs, SBOM, O RAN, and correlation | Analyst workflows and telecom triage |
Linux kernel activity is mapped to 5G Core, Open RAN, Kubernetes workloads, network function roles, protocol behavior, tunnels, peers, and service availability.