Container intrusion detection method based on host system call frequency

Yimu JI; Weidong YANG; Kui LI; Shangdong LIU; Qiang LIU; Sisi SHAO; Shuai YOU; Naijiao HUANG

doi:10.11959/j.issn.2096-109x.2021073

您当前的位置：

首页 >

文章列表页 >

Container intrusion detection method based on host system call frequency

TopicⅠ: Network Security: Attack and Defense | 更新时间：2024-06-03

- Container intrusion detection method based on host system call frequency
- Chinese Journal of Network and Information Security Vol. 7, Issue 4, Pages: 18-29(2021)
- 作者机构：
  
  1. 南京邮电大学计算机学院，江苏南京 210023
  2. 国家高性能计算中心南京分中心，江苏南京 210023
  3. 南京邮电大学高性能计算与大数据处理研究所，江苏南京 210023
  4. 南京邮电大学高性能计算与智能处理工程研究中心，江苏南京 210023
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021073
  CLC： TP399
- Online First：2021-08，
  
  Published：15 August 2021
- 稿件说明：
移动端阅览
Yimu JI, Weidong YANG, Kui LI, et al. Container intrusion detection method based on host system call frequency[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 18-29.
DOI：

Yimu JI, Weidong YANG, Kui LI, et al. Container intrusion detection method based on host system call frequency[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 18-29. DOI： 10.11959/j.issn.2096-109x.2021073.

摘要

容器技术由于其轻量级虚拟化的特点，已成为云平台中广泛使用的虚拟化技术，但它与宿主机共享内核，安全性和隔离性较差，易遭受泛洪、拒绝服务、逃逸攻击。为了有效检测容器是否遭受攻击，提出了一种基于主机系统调用频率的入侵检测方法，该方法利用不同攻击行为之间系统调用频率不同的特点，收集容器运行时产生的系统调用，结合滑动窗口和 TF-IDF 算法提取系统调用特征，通过对比特征相似度进行分类。通过实验验证，该方法的检测率可达97%，误报率低于4%。

Abstract

Container technology has become a widely used virtualization technology in cloud platform due to its lightweight virtualization characteristics.However

it shares the kernel with the host

so it has poor security and isolation

and is vulnerable to flood

denial of service

and escape attacks.In order to effectively detect whether the container is attacked or not

an intrusion detection method based on host system call frequency was proposed.This method took advantage of the different frequency of system call between different attack behaviors

collected the system call generated when the container was running

extracted the system call features by combining the sliding window and TF-IDF algorithm

and classified by comparing the feature similarity.The experimental results show that the detection rate of this method can reach 97%

and the false alarm rate is less than 4%.

关键词

Keywords

references

GAO X , GU Z , KAYAALP M , et al . ContainerLeaks:Emerging security threats of information leakages in container clouds [C ] // 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . 2017 : 237 - 248 .

COMBE T , MARTIN A , DI PIETRO R . To docker or not to docker:A security perspective [J ] . IEEE Cloud Computing , 2016 , 3 ( 5 ): 54 - 62 .

SHU R , GU X , ENCK W . A study of security vulnerabilities on docker hub [C ] // Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy . 2017 : 269 - 280 .

周天昱 , 申文博 , 杨男子 , 等 . Docker组件间标准输入输出复制的DoS攻击分析 [J ] . 网络与信息安全学报 , 2020 , 6 ( 6 ): 45 - 56 .

ZHOU T Y , SHEN W B , YANG N Z , et al . Analysis of DoS attacks on Docker inter-component stdio copy [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 6 ): 45 - 56 .

MARTIN A , RAPONI S , COMBE T , et al . Docker ecosystem–vulnerability analysis [J ] . Computer Communications , 2018 , 122 : 30 - 43 .

FLORA J , ANTUNES N . Studying the applicability of intrusion detection to multi-tenant container environments [C ] // 2019 15th European Dependable Computing Conference (EDCC) . 2019 : 133 - 136 .

MANU A R , PATEL J K , AKHTAR S , et al . A study,analysis and deep dive on cloud PaaS security in terms of Docker container security [C ] // 2016 international conference on circuit,power and computing technologies (ICCPCT) . 2016 : 1 - 13 .

YASRAB R . Mitigating docker security issues [J ] . arXiv preprint arXiv:1804.05039 , 2018 .

ALARIFI S S , WOLTHUSEN S D . Detecting anomalies in IaaS environments through virtual machine host system call analysis [C ] // 2012 International Conference for Internet Technology and Secured Transactions . 2012 : 211 - 218 .

MASKE S A , PARVAT T J . Advanced anomaly intrusion detection technique for host based system using system call patterns [C ] // 2016 International Conference on Inventive Computation Technologies (ICICT) . 2016 , 2 : 1 - 4 .

JIAN Z , CHEN L . A defense method against docker escape attack [C ] // Proceedings of the 2017 International Conference on Cryptography,Security and Privacy . 2017 : 142 - 146 .

FORREST S , HOFMEYR S A , SOMAYAJI A , et al . A sense of self for unix processes [C ] // Proceedings 1996 IEEE Symposium on Security and Privacy . 1996 : 120 - 128 .

WARRENDER C , FORREST S , PEARLMUTTER B . Detecting intrusions using system calls:alternative data models [C ] // Proceedings of the 1999 IEEE symposium on security and privacy (Cat.No.99CB36344) . 1999 : 133 - 145 .

HOFMEYR S A , FORREST S , SOMAYAJI A . Intrusion detection using sequences of system calls [J ] . Journal of computer security , 1998 , 6 ( 3 ): 151 - 180 .

KANG D K , FULLER D , HONAVAR V . Learning classifiers for misuse and anomaly detection using a bag of system calls representation [C ] // Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop . 2005 : 118 - 125 .

ABED A S , CLANCY C , LEVY D S . Intrusion detection system for applications using linux containers [C ] // International Workshop on Security and Trust Management . 2015 : 123 - 135 .

SRINIVASAN S , KUMAR A , MAHAJAN M , et al . Probabilistic real-time intrusion detection system for docker containers [C ] // International Symposium on Security in Computing and Communication . 2018 : 336 - 347 .

KHREICH W , KHOSRAVIFAR B , HAMOU-LHADJ A , , et al . An anomaly detection system based on variable N-gram features and one-class SVM [J ] . Information and Software Technology , 2017 , 91 : 186 - 197 .

董玲 , 张宏莉 , 叶麟 . 基于系统调用序列分析入侵检测的层次化模型 [J ] . 智能计算机与应用 , 2014 , 4 ( 4 ): 13 - 16 .

DONG L , ZHANG H L , YE L . A new study of the system call sequence analysis method [J ] . Intelligent Computer and Applications , 2014 , 4 ( 4 ): 13 - 16 .

张东 , 张尧 , 刘刚 , 等 . 基于机器学习算法的主机恶意代码检测技术研究 [J ] . 网络与信息安全学报 , 2017 , 3 ( 7 ): 25 - 32 .

ZHANG D , ZHANG Y , LIU G , et al . Research on host malcode detection using machine learning [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 7 ): 25 - 32 .

AZAB M , MOKHTAR B M , ABED A S , et al . Smart moving target defense for linux container resiliency [C ] // 2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC) . 2016 : 122 - 130 .

Views

293

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Application research of sample data generation based on improved Cycle-GAN in intrusion detection

Research on intrusion detection model based on synchronization of heterogenous executer

Personalized lightweight distributed network intrusion detection system in fog computing

Method on intrusion detection for industrial internet based on light gradient boosting machine

Related Author

HUANG Kai

JIANG Libing

JIANG Yuchang

GUO Hangkai

ZENG Qingpeng

WEI Shuai

Yu Hong

ZHU Zhengbin

Related Institution

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Mathematics and Computer Sciences, Nanchang University

Information Engineering University

Songshan Laboratory

College of Automation/ Institute of Industrial Internet, Chongqing University of Posts and Telecommunications

⁰