Resilient intrusion detection system for cloud containers

Abstract

The lightweight virtualisation and isolated execution offered by Linux containers qualify it to be the dominant virtualisation platform for cloud-based applications. The fact that Linux containers run on the same host while sharing the same kernel opens the door for new attacks. However, limited research has been conducted in the area of securing cloud containers. This paper presents a resilient intrusion detection and resolution system for cloud-based containers. The system relies on two main pillars, a real-time smart behaviour monitoring mechanism to detect maliciously behaving containers, and a moving-target defence approach that applies runtime container migration to quarantine such containers and to minimise attack dispersion. To avoid zero-day targeted attacks, the system also induces random live migrations between running containers to obfuscate its execution behaviour. Such obfuscation makes it harder for attackers to execute their targeted attacks. The system was tested by a big-data application using a container-based Apache Hadoop cluster to demonstrate the system's ability to automatically deploy,

AI-driven container security approaches for 5G and beyond: A survey

“…The method involves creating a frequency list 𝑆 = {𝑠 1 , 𝑠 2 , … , 𝑠 𝑛 where 𝑠 𝑖 is the number of times the system call during that time window is observed [18]. BoSC representation has seen frequent use in container intrusion detection literature [19,20] often paired with the Sysdig 1 tool [21,22] to directly stream system calls from running containers with a low overhead. Frequency lists are not the sole method for using system call traces in machine learning applications.…”