Intrusion Detection System for Applications Using Linux Containers

Abstract

Abstract. Linux containers are gaining increasing traction in both individual and industrial use, and as these containers get integrated into mission-critical systems, real-time detection of malicious cyber attacks becomes a critical operational requirement. This paper introduces a realtime host-based intrusion detection system that can be used to passively detect malfeasance against applications within Linux containers running in a standalone or in a cloud multi-tenancy environment. The demonstrated intrusion detection system uses bags of system calls monitored from the host kernel for learning the behavior of an application running within a Linux container and determining anomalous container behavior. Performance of the approach using a database application was measured and results are discussed.

Standardized container virtualization approach for collecting host intrusion detection data

“…The major advantage of this approach is that it provides a high degree of flexibility in the form of scenarios that can be adapted to individual technical as well as policy requirements. For example, the evaluation MySQL example 9 from chapter V can easily be adapted using real network data. With this approach we have created a new data set.…”

“…It was published as "Leipzig Intrusion Detection -Data Set (LID-DS)" in [8] which contains different use cases shown in table II. LID-DS framework and ready to use data sets are free to use and published on GitHub 9 . It is the first HIDS data set which contains normal and abnormal behavior, system calls and their timestamps, thread ids, process names, 9 https://github.com/LID-DS/LID-DS arguments, return values and excerpts of their data buffers from traces of normal and attack behavior of several recent, multi-process, multi-threaded scenarios.…”

“…The authors show this with the software example Firefox. Abed et al describe in [9] a real-time IDS for passive monitoring of Linux containers using the tool strace. The evaluation takes place with the example of the database application MySQL in the normal and malicious behavior under consideration of the frequencies of system calls.…”

Resilient intrusion detection system for cloud containers

“…In this paper, we propose a resilient intrusion detection system (RIDS) for misbehaving containers that extends upon the former work previously applied to standalone containers (Abed et al, 2015) to be used in cloud environments, where a colony of similar containers may collaborate to complete a certain task.…”

“…In a recent survey, Modi et al (2013) concluded that cloud environments should incorporate intrusion detection and prevention systems to address one of the major concerns of cloud users after data security. To address those concerns, Abed et al (2015Abed et al ( , 2016 presented a simple host-based intrusion detection system (HIDS) that monitors system calls between the container processes and the host kernel for malfeasance detection.…”