02
User plane and Open RAN evidence
Track PFCP sessions, SEIDs, PDRs, FARs, URRs, GTP-U TEIDs, tunnel churn, rogue RIC insertion, E2 and O1 peers, xApp and rApp behavior, KPM access, and WG11 evidence.
The complete eBPF security platform for telecom infrastructure.
Telovix understands telecom protocols, network function roles, tunnels, sessions, peer relationships, runtime anomalies, attack chains, Kubernetes posture, vulnerabilities, and investigation context.
Telecom protocol intelligence
5G Core, Open RAN, user plane, IMS, 4G EPC, service mesh, and legacy telecom interfaces become connected to process, pod, node, peer, and network function role.
From node activity to telecom security context.
Low level Linux activity is connected with telecom protocol state, network function identity, user plane sessions, Open RAN control paths, Kubernetes workload context, and investigation evidence.
- N2 · NGAP
- Connect signaling procedures and SCTP peers to the gNB and AMF processes that own them.
- N3 · GTP-U
- Track TEID lifecycle, user-plane peers, tunnel churn, and the UPF workload behind the traffic.
- N4 · PFCP
- Follow session state, SEIDs, rules, and heartbeat behavior between SMF and UPF.
- SBI · HTTP/2
- Map service calls, caller roles, API paths, and response behavior across 5G Core functions.
More than protocol alerts. A telecom runtime model.
eBPF runtime evidence is combined with 5G Core, Open RAN, Kubernetes, user-plane, service mesh, and network function context so teams can investigate what actually changed.
- 01
Behavioral NF role inference
AMF · SMF · UPF · NRF · CU · DU · RICClassifies telecom workloads from what they actually do at runtime, not only from names, labels, or declared inventory. A process speaking PFCP, binding GTP-U, owning NGAP SCTP, or calling SBI APIs becomes part of the telecom model.
- 02
PFCP session and peer state
SEID · PDR · FAR · URR · heartbeatTracks session control as state, not just UDP traffic. Invalid SEIDs, peer liveliness failure, session storms, direction violations, setup latency, and session loss after a network function restart can be surfaced.
- 03
GTP-U tunnel intelligence
TEID lifecycle · N3 · N9 · S1-UBuilds tunnel inventory around TEIDs and peers. Orphan TEIDs, TEID churn, TEID spray, unexpected peers, tunnel floods, encapsulation loops, control-plane content inside GTP-U, and DPDK or AF_XDP visibility gaps can be shown.
- 04
SBI service graph and caller behavior
HTTP/2 · OAuth · NF API meshMaps service-based interface calls into a caller matrix. Cross-NF token reuse, unusual call frequency, high error rates, slow paths, unexpected service access, reconnaissance behavior, and plaintext SBI exposure can be detected.
- 05
Open RAN and O-Cloud control
E2 · O1 · O2 · xApp · rAppTracks RIC peers, E2 subscriptions, O1 management sessions, O2 resource operations, xApp and rApp API calls, KPM access, timing processes, and CU/DU interface boundaries for O-RAN WG11 aligned evidence.
- 06
CNF runtime and host integrity
Pods · namespaces · images · hugepages · VFIOConnects container runtime state to telecom risk. CNF binary drift, namespace escape, privilege changes, unexpected management egress, hugepage misuse, VFIO access, SR-IOV misuse, and resource pressure on network function nodes can be flagged.
Telecom evidence across protocol, runtime, cloud, and investigation layers.
Security teams get evidence that normally lives in separate places. Kernel activity, telecom protocol behavior, network function identity, user plane state, Kubernetes context, vulnerability exposure, and investigation timelines are connected into one model.
- 01
Protocol intelligence for 5G Core, Open RAN, 4G EPC, IMS, service mesh, and legacy telecom interfaces
- 02
Runtime forensics with process lineage, behavioral fingerprints, shell sessions, live activity, and fleet correlation
- 03
Kubernetes CNF security with workload posture, image exposure, network policy context, reconstructed YAML, and admission history
- 04
AI assisted investigation over events, alerts, anomalies, telecom inventory, tunnels, SLOs, SBOM, O RAN, and correlation
A capability portfolio for telecom security teams.
This is not only protocol detection. Runtime inspection, investigations, behavioral analytics, attack chains, Kubernetes context, vulnerability exposure, and AI assisted analysis are combined in one capability portfolio.
03
Investigation and exposure context
Move from a telecom finding into process lineage, runtime inspector, behavioral fingerprints, fleet correlation, shell sessions, Kubernetes CNF posture, SBOM exposure, and AI assisted investigation.
Product surfaces for investigation and response.
Each operator surface keeps the evidence trail connected to the process, node, network function, and telecom behavior that produced it.
- 01Runtime Inspector
- Inspect process trees, top processes, system activity, network connections, red flags, listening services, containers, live events, and protocol capture files from one investigation surface.
- 02Investigation and forensics
- Trace a suspicious binary through process lineage, child processes, network destinations, file activity, shell sessions, linked evidence, and matching behavior on other nodes.
- 03Behavioral analytics
- Build per-binary baselines for spawned children, network destinations, file paths, arguments, inbound ports, write paths, and time of execution, then score drift from learned behavior.
- 04Attack chains
- Connect related runtime events into named sequences such as process injection to command and control, privilege escalation to network connection, webshell spawn, rootkit activity, and credential exfiltration.
Cloud native network functions need telecom aware workload security.
Kubernetes inventory, workload posture, image exposure, runtime events, and network policy context are connected with the telecom behavior of the functions running inside the cluster.
- 01
Pod inventory and runtime posture
Every pod, namespace, workload owner, running phase, container image, image digest, restart count, labels, node, and cluster context connected to runtime activity.
- 02
Kubernetes posture findings
Privileged containers, host networking, host PID, host IPC, SYS_ADMIN, NET_ADMIN, root containers, and privilege escalation are surfaced as workload risk.
- 03
Image and vulnerability exposure
Container images are discovered from workload inventory, scanned for CVEs, connected to affected hosts, and exported as CycloneDX SBOM documents.
- 04
Network policy and admission context
Observed services, network policies, reconstructed YAML, and admission decisions help explain how CNF configuration relates to runtime exposure.
Fits how your team operates.
Self-hosted or managed deployment. The same telecom protocol intelligence and runtime evidence in both models.
- 01Run the platform in your own environment.
Choose a customer operated deployment when local control, data residency, offline operation, or strict infrastructure ownership is required.
- 02Let Telovix provision the platform for you.
Use the same telecom security capabilities without owning the platform operations.
- 03Same telecom evidence in both modes.
Protocol decoding, network function context, user plane state, Open RAN evidence, CNF posture, and investigation workflows stay consistent in either deployment model.
The telecom coverage goes deeper than generic runtime security.
Host behavior, packet level protocol evidence, network function identity, Kubernetes workload context, and service impact are linked into one telecom aware model.
The result is a portfolio of capabilities for security teams that operate 5G Core, Open RAN, user plane, cloud native network functions, and mixed 4G or 5G environments.
| Capability | Runtime evidence | Product surface | Scope |
|---|---|---|---|
| Telecom protocol intelligence | NGAP, PFCP, GTP-U, F1AP, E1AP, XnAP, E2AP, SCTP, Diameter, RADIUS, SIP, SBI HTTP/2, NAS5G, M3UA, IKEv2 | Protocol state, procedure behavior, peer direction, decode errors | 5G Core, Open RAN, 4G EPC, IMS, SIGTRAN |
| Network function understanding | Ports, peers, protocols, process names, binary paths, runtime behavior | AMF, SMF, UPF, NRF, PCF, CU, DU, RIC, MME, SGW, PGW, HSS, IMS roles | Radio, core, user plane, service mesh |
| User plane and session state | PFCP sessions, SEIDs, PDRs, FARs, URRs, heartbeats, GTP-U TEIDs | Tunnel churn, tunnel floods, peer drift, boundary violations, session loss | N3, N4, N6, N9 and user plane nodes |
| Open RAN security | E2, O1, O2, xApp, rApp, RIC peers, KPM, management sessions | Rogue RIC, public peer exposure, management drift, WG11 evidence | Near RT RIC, CU, DU, O Cloud |
| Investigation and attack chains | Process lineage, network connections, file activity, shell sessions, suspicious event sequences | Cases, timelines, MITRE mapping, multi stage attack chains, fleet correlation | Security operations and incident response |
| Kubernetes CNF security | Pods, namespaces, workloads, images, posture, network policies, reconstructed YAML | Privileged workloads, host namespace risk, image exposure, admission history | Cloud native 5G Core and CNF clusters |
| SBOM and vulnerability exposure | Container image references, digests, cluster and node placement | Trivy scans, CVE counts, CycloneDX export, affected hosts | Container image supply chain |
| AI assisted investigation | Events, flows, DNS, privilege changes, namespaces, resource metrics, telecom snapshots | 44 structured tools over alerts, anomalies, tunnels, SLOs, SBOM, O RAN, and correlation | Analyst workflows and telecom triage |
Bring telecom-aware eBPF security to your runtime.
Linux kernel activity is mapped to 5G Core, Open RAN, Kubernetes workloads, network function roles, protocol behavior, tunnels, peers, and service availability.