▣ RootView
Project Name
RootView - a KVM-based eBPF malware detection engine
Team Members and Email Addresses
Faculty Advisor
Dr. Eraldo Ribeiro · eribeiro@fit.edu

First Semester

Plan (Aug 31) Plan, Presentation
Milestone 1 (Sep 28) Requirement, Design, Test, Presentation, Progress Evaluation
Milestone 2 (Oct 26) Presentation, Progress Evaluation
Milestone 3 (Nov 23) Presentation, Progress Evaluation

Florida Tech senior design · 2026-2027

A rootkit can lie to every tool inside the machine.
It cannot lie to the hypervisor.

RootView detects eBPF rootkits in a running Linux guest by reading the guest's kernel memory from outside the guest, on the KVM host, where the malware has no way to reach.

How it fits together

The virtualization stack

Where a guest actually runs, from the hardware up through the hypervisor to the VMs themselves. RootView adds no layer here. It watches this stack from the host side.

Point at a layer, or tab to it, to read what it does

Guest VMs VM VM VM Host OS + KVM Host OS + KVM Hardware Hardware

Layer detail

Nothing selected.

Guest VMs

Independent virtual machines, each with its own guest kernel. This is the layer RootView exists to protect: it is where an eBPF rootkit runs, and where it hides.

Host OS + KVM

The host's Linux kernel with the KVM module loaded, creating, scheduling and isolating the guests above it. RootView runs here, beside the hypervisor rather than inside anything it is watching.

Hardware

The physical machine underneath everything: a CPU with virtualization extensions (VT-x or AMD-V), memory and storage.

The detection engine

RootView's own layers, built outward from the guest. The colour brightens with each ring: the VM at the centre is opaque, and every layer around it adds a little more visibility into what is happening inside.

Point at a ring, or tab to it, to read what it does

Engine Engine Python API Python API RootView RootView VMI VMI VM VM Web server Web server

Layer detail

Nothing selected.

VM

The guest being monitored. From inside, a rootkit can hide itself from the guest's own tools, so RootView treats nothing reported from in here as evidence.

VMI

Virtual machine introspection, built on LibVMI. Reads the guest's memory directly from the host, so a compromised guest kernel cannot lie about its own state.

RootView

The detection logic. Walks the guest memory that VMI hands it to enumerate eBPF programs and maps, and checks what it finds against known rootkit behaviour.

Python API

A researcher-facing interface over the same introspection data, for building eBPF analysis and detection tooling beyond the checks that ship with the engine.

Engine

Ties the detection logic, VMI and the Python API together into one running service. This is the layer the web server talks to.

Web server

The interface: a dashboard that answers whether anything is wrong, and an introspection view for reading the raw eBPF state the engine is working from.

Algorithms and tools

KVM/QEMU Virtualization
LibVMI Virtual machine introspection
Page-table walking Address translation
BTF/DWARF and kernel profiles Interpreting Linux kernel structures
eBPF Kernel telemetry
C/C++ The VMI backend
Python The research API and future detection engine
Web framework The user interface

Technical challenges

KVM and VMI

The team has limited experience with KVM and VMI and must learn how to access guest memory, processor state, and page tables from outside the guest.

Linux kernel introspection

Kernel structures change between versions, so RootView must investigate ways to identify and interpret structures without relying entirely on hardcoded offsets.

eBPF malware

The team must learn how eBPF works internally, how it can be abused by rootkits, and what characteristics of malicious activity can be observed.

Milestones

Milestone 1

Sep 28

Establishes the basic VMI infrastructure.

  • Select KVM/QEMU, LibVMI, web framework, and initial eBPF tools
  • Create simple tooling for setting up an Ubuntu VM
  • Connect to a running guest through LibVMI
  • Read physical and virtual guest memory
  • Investigate address translation
  • Retrieve basic register state
  • Begin process introspection
  • Serve a basic test page
  • Complete the Requirements Document
  • Complete the Design Document
  • Complete the Test Plan

Milestone 2

Oct 26

Expands RootView into a Linux and eBPF introspection platform.

  • Linux kernel introspection
  • BTF/DWARF and kernel symbol investigation
  • Process and kernel object enumeration
  • eBPF introspection
  • Integration of VMI and eBPF observations
  • Web interface improvements
  • Initial kernel-version testing

Milestone 3

Nov 23

Turns the backend into a reusable research platform.

  • C/C++ API for VM, OS, memory, and eBPF introspection
  • Python bindings
  • High-level Python interface
  • Error handling and testing
  • Linux kernel version compatibility
  • Kernel profile improvements
  • API documentation
  • Stable interface for the future detection engine