Abstract
Modern cloud-native paradigms rely heavily on microservices architecture deployed across ephemeral container environments. While this model provides unparalleled scalability and operational agility, it introduces severe challenges for digital forensics and incident response (DFIR). Traditional post-mortem memory acquisition techniques fail in microservice ecosystems due to the transient nature of containers, where volatile memory artifacts vanish upon pod termination or node auto-scaling. In this paper, we present a novel, non-invasive memory forensic framework powered by Extended Berkeley Packet Filter (eBPF) technology operating at the Linux kernel level. Our framework continuously traces kernel-level event allocations, process memory mappings, and inter-container communications in real time, capturing volatile artifacts directly from kernel space without introducing intrusive execution overhead. By hooking into tracepoints, kprobes, and memory-related system calls, the framework maintains an immutable, cryptographically verifiable forensic log mapped precisely to container namespaces and cgroups. We evaluate our implementation on a production-grade Kubernetes cluster under simulated fileless malware, process injection, and transient C2 communication attacks. Experimental results demonstrate that the eBPF tracing framework captures 99.4% of volatile memory artifacts with an average system CPU overhead of under 2.1% and a negligible memory footprint, vastly outperforming traditional snapshot-based memory acquisition tools in speed, granularity, and retention capability.
