We believe end users should not be responsible for writing security rules for third-party software, rather, we show how vendors can distribute benign runtime-behavior rules along their supply chain using a “Bill of Behavior” (BoB) inside OCI artifacts.

A BoB is a profile of known syscalls, fileaccess, network and capabilities generated using eBPF, and allows anomaly detection. Thus, users can infer both malicious behavior and tampering without writing/maintaining custom runtime rules.

We detail which parts of the BoB specification translate across ecosystems, languages, stacks, and tools and why the process must be transparent for users. We will also discuss the current scope and ongoing evolution of BoB, laying out a strategic roadmap as it progresses towards a de-facto standard, thus complementing our security ecosystem of seccomp profiles, SBOMs and policy engines.

A public on-demand lab of the reference implementation using well-known cloud native tools will be supplied.