基于主机系统调用频率的容器入侵检测方法

季一木; 杨卫东; 李奎; 刘尚东; 刘强; 邵思思; 尤帅; 黄乃娇

doi:10.11959/j.issn.2096-109x.2021073

您当前的位置：

首页 >

文章列表页 >

基于主机系统调用频率的容器入侵检测方法

专栏Ⅰ：网络攻防技术 | 更新时间：2024-06-03

- 基于主机系统调用频率的容器入侵检测方法
- Container intrusion detection method based on host system call frequency
- 网络与信息安全学报 2021年7卷第4期页码：18-29
- 作者机构：
  
  1. 南京邮电大学计算机学院，江苏南京 210023
  2. 国家高性能计算中心南京分中心，江苏南京 210023
  3. 南京邮电大学高性能计算与大数据处理研究所，江苏南京 210023
  4. 南京邮电大学高性能计算与智能处理工程研究中心，江苏南京 210023
- 作者简介：
  
  [ "季一木（1978− ），男，江苏南京人，南京邮电大学计算机院教授、博士生导师，主要研究方向为 P2P 网络、云计算和大数据安全等" ]
  [ "杨卫东（1994− ），男，河南周口人，南京邮电大学硕士生，主要研究方向为容器安全" ]
  [ "李奎（1988− ），男，江苏南通人，南京邮电大学博士生，主要研究领域为高性能计算、大数据理论与技术" ]
  [ "刘尚东（1979− ），男，甘肃永靖人，南京邮电大学讲师，主要研究方向为网络行为分析、大数据处理等" ]
  [ "刘强（1985− ），男，安徽蚌埠人，南京邮电大学讲师，主要研究方向为图计算、大数据处理等" ]
  [ "邵思思（1997− ），女，江苏东海人，南京邮电大学硕士生，主要研究方向为边缘计算、云计算和大数据安全" ]
  [ "尤帅（1995− ），男，安徽芜湖人，南京邮电大学硕士生，主要研究领域为高性能计算、大数据和边缘计算" ]
  [ "黄乃娇（1995− ），女，河南信阳人，南京邮电大学硕士生，主要研究方向为机器学习和云计算安全" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(62076139;61902194);江苏省（高校）自然科学基金;The Natural Science Foundation of Jiangsu Province (Higher Education Institutions)(BK20170900;19KJB520046;20KJA520001);江苏省六大人才高峰项目;Six talent peak projects in Jiangsu Province(JY02);之江实验室开放课题;Zhejiang Lab(2021KF0AB05);南京邮电大学鼎山人才培养对象项目和南京邮电大学人才启动基金;NUPT DingShan Scholar Project and NUPTSF(NY219132);江苏省研究生创新计划项目;Postgra-duate Research ＆ Practice Innovation Program of Jiangsu Province(KYCX19_0921;KYCX19_0906)
- DOI：10.11959/j.issn.2096-109x.2021073
  中图分类号： TP399
- 网络首发：2021-08，
  
  纸质出版：2021-08-15
- 稿件说明：
移动端阅览
季一木, 杨卫东, 李奎, 等. 基于主机系统调用频率的容器入侵检测方法[J]. 网络与信息安全学报, 2021,7(4):18-29.

Yimu JI, Weidong YANG, Kui LI, et al. Container intrusion detection method based on host system call frequency[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 18-29.
季一木, 杨卫东, 李奎, 等. 基于主机系统调用频率的容器入侵检测方法[J]. 网络与信息安全学报, 2021,7(4):18-29. DOI： 10.11959/j.issn.2096-109x.2021073.

Yimu JI, Weidong YANG, Kui LI, et al. Container intrusion detection method based on host system call frequency[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 18-29. DOI： 10.11959/j.issn.2096-109x.2021073.

摘要

容器技术由于其轻量级虚拟化的特点，已成为云平台中广泛使用的虚拟化技术，但它与宿主机共享内核，安全性和隔离性较差，易遭受泛洪、拒绝服务、逃逸攻击。为了有效检测容器是否遭受攻击，提出了一种基于主机系统调用频率的入侵检测方法，该方法利用不同攻击行为之间系统调用频率不同的特点，收集容器运行时产生的系统调用，结合滑动窗口和 TF-IDF 算法提取系统调用特征，通过对比特征相似度进行分类。通过实验验证，该方法的检测率可达97%，误报率低于4%。

Abstract

Container technology has become a widely used virtualization technology in cloud platform due to its lightweight virtualization characteristics.However

it shares the kernel with the host

so it has poor security and isolation

and is vulnerable to flood

denial of service

and escape attacks.In order to effectively detect whether the container is attacked or not

an intrusion detection method based on host system call frequency was proposed.This method took advantage of the different frequency of system call between different attack behaviors

collected the system call generated when the container was running

extracted the system call features by combining the sliding window and TF-IDF algorithm

and classified by comparing the feature similarity.The experimental results show that the detection rate of this method can reach 97%

and the false alarm rate is less than 4%.

关键词

Keywords

references

GAO X , GU Z , KAYAALP M , et al . ContainerLeaks:Emerging security threats of information leakages in container clouds [C ] // 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . 2017 : 237 - 248 .

COMBE T , MARTIN A , DI PIETRO R . To docker or not to docker:A security perspective [J ] . IEEE Cloud Computing , 2016 , 3 ( 5 ): 54 - 62 .

SHU R , GU X , ENCK W . A study of security vulnerabilities on docker hub [C ] // Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy . 2017 : 269 - 280 .

周天昱 , 申文博 , 杨男子 , 等 . Docker组件间标准输入输出复制的DoS攻击分析 [J ] . 网络与信息安全学报 , 2020 , 6 ( 6 ): 45 - 56 .

ZHOU T Y , SHEN W B , YANG N Z , et al . Analysis of DoS attacks on Docker inter-component stdio copy [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 6 ): 45 - 56 .

MARTIN A , RAPONI S , COMBE T , et al . Docker ecosystem–vulnerability analysis [J ] . Computer Communications , 2018 , 122 : 30 - 43 .

FLORA J , ANTUNES N . Studying the applicability of intrusion detection to multi-tenant container environments [C ] // 2019 15th European Dependable Computing Conference (EDCC) . 2019 : 133 - 136 .

MANU A R , PATEL J K , AKHTAR S , et al . A study,analysis and deep dive on cloud PaaS security in terms of Docker container security [C ] // 2016 international conference on circuit,power and computing technologies (ICCPCT) . 2016 : 1 - 13 .

YASRAB R . Mitigating docker security issues [J ] . arXiv preprint arXiv:1804.05039 , 2018 .

ALARIFI S S , WOLTHUSEN S D . Detecting anomalies in IaaS environments through virtual machine host system call analysis [C ] // 2012 International Conference for Internet Technology and Secured Transactions . 2012 : 211 - 218 .

MASKE S A , PARVAT T J . Advanced anomaly intrusion detection technique for host based system using system call patterns [C ] // 2016 International Conference on Inventive Computation Technologies (ICICT) . 2016 , 2 : 1 - 4 .

JIAN Z , CHEN L . A defense method against docker escape attack [C ] // Proceedings of the 2017 International Conference on Cryptography,Security and Privacy . 2017 : 142 - 146 .

FORREST S , HOFMEYR S A , SOMAYAJI A , et al . A sense of self for unix processes [C ] // Proceedings 1996 IEEE Symposium on Security and Privacy . 1996 : 120 - 128 .

WARRENDER C , FORREST S , PEARLMUTTER B . Detecting intrusions using system calls:alternative data models [C ] // Proceedings of the 1999 IEEE symposium on security and privacy (Cat.No.99CB36344) . 1999 : 133 - 145 .

HOFMEYR S A , FORREST S , SOMAYAJI A . Intrusion detection using sequences of system calls [J ] . Journal of computer security , 1998 , 6 ( 3 ): 151 - 180 .

KANG D K , FULLER D , HONAVAR V . Learning classifiers for misuse and anomaly detection using a bag of system calls representation [C ] // Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop . 2005 : 118 - 125 .

ABED A S , CLANCY C , LEVY D S . Intrusion detection system for applications using linux containers [C ] // International Workshop on Security and Trust Management . 2015 : 123 - 135 .

SRINIVASAN S , KUMAR A , MAHAJAN M , et al . Probabilistic real-time intrusion detection system for docker containers [C ] // International Symposium on Security in Computing and Communication . 2018 : 336 - 347 .

KHREICH W , KHOSRAVIFAR B , HAMOU-LHADJ A , , et al . An anomaly detection system based on variable N-gram features and one-class SVM [J ] . Information and Software Technology , 2017 , 91 : 186 - 197 .

董玲 , 张宏莉 , 叶麟 . 基于系统调用序列分析入侵检测的层次化模型 [J ] . 智能计算机与应用 , 2014 , 4 ( 4 ): 13 - 16 .

DONG L , ZHANG H L , YE L . A new study of the system call sequence analysis method [J ] . Intelligent Computer and Applications , 2014 , 4 ( 4 ): 13 - 16 .

张东 , 张尧 , 刘刚 , 等 . 基于机器学习算法的主机恶意代码检测技术研究 [J ] . 网络与信息安全学报 , 2017 , 3 ( 7 ): 25 - 32 .

ZHANG D , ZHANG Y , LIU G , et al . Research on host malcode detection using machine learning [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 7 ): 25 - 32 .

AZAB M , MOKHTAR B M , ABED A S , et al . Smart moving target defense for linux container resiliency [C ] // 2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC) . 2016 : 122 - 130 .

浏览量

293

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究

基于异构执行体同步控制的入侵检测模型研究

面向雾计算的个性化轻量级分布式网络入侵检测系统

基于轻量级梯度提升机优化的工业互联网入侵检测方法