Context-Aware Threat Hunting in Kubernetes Clusters: A Behavioral Profiling Approach using Extended Berkeley Packet Filter (eBPF) and Graph Neural Networks

The rapid adoption of microservice architectures orchestrated via Kubernetes has introduced unprecedented operational complexity and expanded the enterprise attack surface. Traditional intrusion detection and digital forensic mechanisms often fail within cloud-native environments due to high container churn, dynamic IP allocation, and significant computational overhead. In this paper, we propose a context-aware threat hunting framework that combines low-overhead kernel telemetry via Extended Berkeley Packet Filter (eBPF) with Heterogeneous Graph Neural Networks (HGNNs) for fine-grained behavioral profiling. Our architecture intercepts low-level system call sequences and socket lifecycle events in real time, enriching them with orchestration-level metadata, including namespace, pod, and service-account contexts. We construct dynamic provenance graphs that capture the multi-layered interactions between host kernel primitives and Kubernetes abstractions. Using a relational graph convolutional network with temporal attention, our model learns structural and sequential patterns of benign cluster behavior to detect subtle anomalies indicative of advanced persistent threats, privilege escalation, and lateral movement. Evaluated on a production-grade multi-node Kubernetes testbed subjected to diverse real-world attack scenarios, our approach achieved an F1-score of 0.968, outperforming state-of-the-art signature-based and baseline anomaly detection tools while maintaining a negligible CPU overhead of under 2.4%.