Ninja is a privilege escalation detection and prevention system for GNU/Linux hosts. While running, it will monitor process activity on the local host, and keep track of all processes running as root. If a process is spawned with UID or GID zero (root), ninja will log necessary information about this process, and optionally kill the process if it was spawned by an unauthorized user.
You can download it from the following link: https://packetstormsecurity.com/files/download/83468/ninja-0.1.3.tar.bz2
Source: https://packetstormsecurity.com/files/83468/Ninja-Intrusion-And-Prevention-System.html