Runtime Abuse Detection

Modal has implemented a syscall-based program analysis component called `seccheck` within its serverless container runtime. This system leverages gVisor's syscall interception capabilities to monitor and detect cryptomining activities by analyzing syscall patterns. The `seccheck` component identifies suspicious syscall sequences, such as specific file access patterns or network connections associated with mining pools, and can automatically disable offending Functions, ban users, and prevent further abuse. This builds on earlier metadata-based detection systems.