Learning State Machines to Monitor and Detect Anomalies on a Kubernetes Cluster

Abstract

These days more companies are shifting towards using cloud environments to provide their services to their client. While it is easy to set up a cloud environment, it is equally important to monitor the system's runtime behaviour and identify anomalous behaviours that occur during its operation. In recent years, the utilisation of Recurrent Neural Networks (RNNs) and Deep Neural Networks (DNNs) to detect anomalies that might occur during runtime has been a trending approach. However, it is unclear how to explain the decisions made by these networks and how these networks should be interpreted to understand the runtime behaviour that they model. On the contrary, state machine models provide an easier manner to interpret and understand the behaviour that they model. In this work, we propose an approach that learns state machine models to model the runtime behaviour of a cloud environment that runs multiple microservice applications. To the best of our knowledge, this is the first work that tries to apply state machine models to microservice architectures. The state machine model is used to detect the different types of attacks that we launch on the cloud environment. From our experiment results, our approach can detect the attacks very well, achieving a balanced accuracy of 99.2% and a 𝐹 1 score of 0.982. CCS CONCEPTS• Computing methodologies → Anomaly detection.

SoK: Explainable Machine Learning for Computer Security Applications

“…(1) XAI-enabled user assistance covers techniques that are developed and utilized to support model users in making informed decisions, usually with the help of visual analytics dashboards. The explanations are meant to give control back to the user by helping them understand the model [96], and providing additional insights regarding the input data [28]. Since it is the model designers who typically develop the explanations for model users, it is essential to include model users during the evaluation process to understand the explanation efficacy.…”

“…Discoverer [40] and Prospex [38] are two other popular systems for reverse engineering application-level specifications of network protocols. Similarly, Cho et al [35] learn an automaton from botnet traffic to understand its Command and Control (C&C) channels; Lin et al [85] learn an automaton from sensors of a water treatment plant to detect potential sensor malfunction, and Cao et al [28] learn an automaton from the network traffic of a Kubernetes cluster to identify misbehaving pods.…”