CHRONOS: An AI-Powered Kernel Monitoring and Attack Visualization Platform Using eBPF Telemetry and Behavioural Graphs

Security tools generate many endpoint alerts that analysts must correlate manually to understand an intrusion. This paper presents CHRONOS, an AI-assisted kernel-monitoring and attack-visualization platform that links low-level Linux telemetry to interpretable behavioural context. The design combines eBPF event collection, schema normalization, optional Kafka streaming, PostgreSQL/TimescaleDB storage, a time-aware NetworkX behavioural graph, rule- and model-assisted threat analysis, evidence-linked MITRE ATT&CK mapping, template-based narration and a React dashboard. A policy-gated response design keeps human approval before disruptive action. We describe the architecture, graph model, workflow, prototype components and a layered verification plan. CHRONOS is a research prototype; no accuracy, latency or overhead figures are claimed because reproducible measurements have not yet been collected. Its contribution is a traceability-first design in which every finding and narrative statement links to source events