pWarden - Process Behavior Guardian

Learns what normal looks like for every process on your system, then alerts you when behavior deviates — not generic signatures, but context for each process.

Download v0.9 Documentation

About pWarden

pWarden learns what "normal" looks like for every process on your system, then watches for deviations in real-time. It's not asking "is this bad?" but rather "is this unusual for this specific process?"

Traditional security tools either look for known bad patterns (signatures) or monitor resources without context. They miss the subtle deviations that indicate a breach, compromised process, or insider threat.

pWarden establishes behavioral baselines automatically, then continuously monitors for anomalies. When a web server suddenly spawns a shell, a database connects to unexpected ports, or any process deviates from its established pattern, pWarden alerts you.

Usage

Basic Usage

Run pWarden in the foreground to see output:

pwarden

Run as a daemon:

pwarden -d

Learning Mode

By default, pWarden runs in learning mode for 24 hours. During this time, it:

Discovers all running processes
Collects behavioral data (network connections, file access, resource usage)
Builds statistical models for each process
Saves baselines to ~/.pwarden/baselines/

Monitoring Mode

After the learning period, pWarden switches to monitoring mode:

Continuously monitors all processes
Compares current behavior against learned baselines
Alerts when anomalies are detected

Signal Handling

SIGTERM / SIGINT: Graceful shutdown
SIGHUP: Reload configuration

Key Features

Automatic Baseline Learning: Observes processes during a learning period to establish normal behavior patterns
Real-time Anomaly Detection: Monitors network connections, file access, and resource usage
Context-Aware: Understands that "unusual" differs for each process
Multiple Alert Channels: Supports stdout, log file, and syslog
Lightweight: Uses Linux proc filesystem for efficient monitoring

Example

A simulated network anomaly alert:

Network Anomaly

[2025-01-15 14:32:18] ANOMALY DETECTED
  Type: NETWORK_UNKNOWN_CONNECTION
  PID: 2847
  Process: nginx
  Executable: /usr/sbin/nginx
  Severity: 0.92
  Details: Unknown TCP connection to 192.168.1.100:4444
  Baseline: nginx typically connects to ports 80, 443, 8080

nginx connecting to port 4444 is unusual for this process and may indicate compromise or data exfiltration.

More examples — resource spikes, file access anomalies, and baseline format — are in the documentation.

Upcoming

Planned for a future release:

Web Dashboard — real-time monitoring, anomaly visualization, and configuration