Skip to content
OpenTrain AIFor AI Companies

Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity

Published Mar 1, 2025
arXiv PDF
Researcher verdict
Starting point
Use as implementation starting point
Benchmark evidence
Missing
Not verified yet
Time to first repro
A few hours
Fast first run
Risk flags
1
Review before use

Results and benchmarks

Freshness tier: cold
Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity is the primary contribution described in this paper.

Implementation

Best maintained implementation now

Recommended
Confidence: High
Reproducibility: Moderate
ait-aecid/rootkit-detection-ebpf-time-trace

Detection of rootkit file hiding activities through analysis of shifts in kernel function execution times.

29 stars · 3 forks · Last push Aug 21, 2026 · GPL-3.0 license

  • License
  • CI
  • Dependencies
  • Docker

Official implementation from Papers with Code · Strong overlap with paper title keywords · Community adoption signal (29 stars)

Why this implementation
Confidence: high

ait-aecid/rootkit-detection-ebpf-time-trace is the strongest maintained implementation based on ranking signals. License is declared (GPL-3.0). Dependency/environment manifests are present.

Open ait-aecid/rootkit-detection-ebpf-time-trace
Reproduction risks
  • No CI workflows detected
  • Selected ait-aecid/rootkit-detection-ebpf-time-trace as the strongest maintained implementation for new work.
  • Includes dependency/environment manifest signals.
  • Repository activity is within the last 24 months.
  • Official repository is preserved separately as historical context.

Compare implementation paths

Compare maintenance quality, reproducibility coverage, and evidence confidence before choosing a reproduction baseline.

ait-aecid/rootkit-detection-ebpf-time-trace
best maintained
Maintenance
Active
Confidence
High
Reproducibility
Moderate
Stars
29
Last push
Aug 21, 2026 (4d)

Official implementation from Papers with Code · Strong overlap with paper title keywords

  • No CI pipeline detected
  • No tagged releases
  • No Docker setup
ait-aecid/caraxes
historical official
Maintenance
Active
Confidence
High
Reproducibility
Limited
Stars
50
Last push
Aug 21, 2026 (4d)

Official implementation from Papers with Code · Community adoption signal (50 stars)

  • No CI pipeline detected
  • No tagged releases
  • No Docker setup
InnerWarden/chronomancy
alternative
Maintenance
Recently updated
Confidence
Low
Reproducibility
Limited
Stars
0
Last push
Mar 29, 2026 (150d)

Matched via arXiv identifier search

  • No CI pipeline detected
  • No tagged releases
  • No Docker setup

Reproduction readiness

Time to first repro: hours
Last checked: Aug 24, 2026

Setup required

Dependencies pinned, manual setup needed

  • ait-aecid/rootkit-detection-ebpf-time-trace has requirements.txt but requires manual environment setup.
  • No Dockerfile, so you will set up the environment manually.
  • No CI pipeline, so test coverage is unknown.
Open ait-aecid/rootkit-detection-ebpf-time-trace

Quick start

git clone https://github.com/ait-aecid/rootkit-detection-ebpf-time-trace.git
pip install -r requirements.txt

Repositories and ecosystem

No additional verified repositories beyond the primary recommendation.

Hugging Face artifacts

No direct paper-linked artifacts were found. Showing strongest curated related artifacts for faster exploration.

Models

Curated Related

Broaden model search

trace times rootkit detection

Datasets

No trustworthy datasets matches right now.

Search datasets on Hugging Face

Spaces

No trustworthy spaces matches right now.

Search spaces on Hugging Face

Research context

Evaluation and human feedback data

Open this paper in HFEPX to review benchmark signals, evaluation modes, and human-feedback protocol context.

Open in HFEPX

Data includes links from Papers with Code ( CC-BY-SA-4.0 ).