Intrusion Detection in Container Orchestration Clusters : A framework proposal based on real-time system call analysis with machine learning for anomaly detection
Savio Levy Rocha, Georges Daniel Amvame Nze, Fábio Lúcio Lópes de Mendonça · 2022 17th Iberian Conference on Information Systems and Technologies (CISTI) · 2022
Despite the benefits containerization brings, threats and risks of attacks against containerized technology have grown in equal proportion to its adoption. Intrusion Detection Systems (IDS) have been employed to secure cloud and container environments. However, the inherent characteristics of these environments have presented new challenges to ensuring an adequate level of security. In this paper, a framework is proposed for implementing a Host-based Intrusion Detection System (HIDS) by analyzing system calls with machine learning on a Kubernetes container orchestration cluster. The presented framework prevents the overhead of the cluster nodes from processing focused on intrusion detection through a distributed and scalable architecture. Alerts generated in the occurrence of detected anomalies can be used as a complementary source of information for decision making and action by the Security Operations Center (SOC) team to deal with an eventual security incident. The proposed architecture was implemented in the GNS3 software, emulating a corporate network environment to demonstrate the feasibility of implementing the framework in a real environment.