**What syscall-layer tooling cannot see in P2P infrastructure** > If you run Fa

**What syscall-layer tooling cannot see in P2P infrastructure**

> If you run Falco, an EDR, or a generic host agent on a validator and a network-DoS attack against the node went undetected, this explains why. A technique-by-technique analysis of five reproduced P2P-infrastructure attacks against the syscall detection surface. Zero are detectable as attributable rules, and the reasons are structural, not a matter of tuning. ← Back to Research Research · July 23, 2026 What syscall-la...

**来源信息**
- **来源**：Hacker News：AI 热帖
- **分类**：论文
- **发布时间**：2026-07-25 03:49（北京时间）
- **原文**：[打开原文](https://nullrabbit.ai/research/why-syscall-tooling-cannot-see-p2p-infrastructure)