Intrusion Detection System for Applications using Linux Containers

TL;DR

This paper presents a real-time host-based intrusion detection system for Linux containers that monitors system calls to detect malicious activity, enhancing security in containerized environments.

Contribution

It introduces a novel passive detection method using system call bags to identify anomalous behavior in Linux containers in real-time.

Findings

Effective detection of container malfeasance demonstrated with database application

System call monitoring achieves real-time performance

Applicable to standalone and multi-tenant cloud environments

Abstract

Linux containers are gaining increasing traction in both individual and industrial use, and as these containers get integrated into mission-critical systems, real-time detection of malicious cyber attacks becomes a critical operational requirement. This paper introduces a real-time host-based intrusion detection system that can be used to passively detect malfeasance against applications within Linux containers running in a standalone or in a cloud multi-tenancy environment. The demonstrated intrusion detection system uses bags of system calls monitored from the host kernel for learning the behavior of an application running within a Linux container and determining anomalous container behavior. Performance of the approach using a database application was measured and results are discussed.