Delta

Delta is a small, dependency-free C tool that collects host “signals” — running processes, open ports, mounts, file fingerprints, installed packages, and network interfaces / routes / neighbors — and checks them against a configured policy (“norm”). It is built for host and firmware integrity verification: capture a golden baseline, detect drift, scan an offline image, watch a live device, or compare a fleet — and ship the result to a collector.

It has no third-party runtime dependency (only a bundled JSON parser), emits structured JSON with CI-friendly exit codes, cross-compiles to a wide range of targets, and builds down to a tiny static binary for embedded use.

What it checks

  • Processes — the running process list (name, PID/PPID, CPU), validated against allowed-process norms.

  • Ports — open ports / connections (protocol, state, owner), validated against allowed-port norms.

  • Mounts — mount layout, filesystem types and options, cross-checked across sources; offline via /etc/fstab.

  • Files — recursive checksums plus setuid/setgid, owner and Linux capabilities — modified / missing / unexpected files and privilege drift.

  • Packages — the installed-package inventory (dpkg/opkg/apk) as an SBOM, matched against a CVE feed (see Packages & vulnerabilities).

  • Network — interfaces (incl. PROMISC), the routing table and the neighbor/ARP table — sniffer, redirect (MITM) and ARP-spoofing signals (see Network).

  • Connections & threats — the live socket table (with remote peers) matched against a threat-intel (IOC) feed, plus loaded kernel modules, /etc/ld.so.preload, UID-0 accounts, SSH authorized_keys and DNS resolvers — C2, rootkit, backdoor and DNS-hijack signals (see Threat detection).

  • Kernel memory — /proc/meminfo and the SLAB/SLUB allocator: exhaustion and kernel-object-leak thresholds, plus the exploitation surface (a readable /proc/slabinfo, freelist hardening) and slab caches hidden from slabinfo (see Threat detection).

  • Syscall behavior — what the running software does. Delta samples the syscalls in one bounded window for each cycle, with eBPF, ptrace or seccomp on Linux, and with Endpoint Security or per-task counters on macOS. It puts each observation into a behavior class such as module, ptrace, bpf or memexec (see Syscall behavior tracing).

  • Device identity — OS/version, kernel and machine-id, for fleet grouping and detecting an unplanned OS/firmware swap.

Findings carry a severity, an aggregate risk score / grade, and a MITRE ATT&CK technique id where applicable, so they drop straight into a SIEM.

Every check above is a comparison against something the operator declared — a policy, a baseline, a peer group, or a list of indicators. Delta reports the differences; it classifies nothing on its own and changes nothing on the host. Acting on a finding is a separate, explicitly commanded step (Shipping reports to a server), and can be compiled out of the binary altogether (Report-only builds).

Five axes of detection

  • Against a baseline — Baseline capture / Configuration: a captured golden norm, or a hand-written policy.

  • Over time — Continuous monitoring: re-check on a timer (or event-driven via inotify) and report drift between cycles, including statistical (behavioral) outliers, with optional cross-run state.

  • Across a population — Fleet / cohort analysis: learn “normal” from a fleet and flag the device that differs from its peers.

  • Against threats — Packages & vulnerabilities and Threat detection: match the package inventory against a CVE feed and observed peers/files against an IOC feed, and surface rootkit / backdoor / hijack indicators.

Offline & on the wire

  • Offline image analysis — point Delta at a mounted firmware image / extracted rootfs (--root) to verify its contents before it boots.

  • Shipping reports to a server — POST reports to a collector, once or every monitor cycle, with an on-disk retry spool and optional HTTPS.

Where to start

License

Copyright Interpretica, Unipessoal Lda. Contact sales@interpretica.io or https://interpretica.io.