Container intrusion detection method based on host system call frequency

Abstract

Container technology has become a widely used virtualization technology in cloud platform due to its lightweight virtualization characteristics. However, it shares the kernel with the host, so it has poor security and isolation, and is vulnerable to flood, denial of service, and escape attacks. In order to effectively detect whether the container is attacked or not, an intrusion detection method based on host system call frequency was proposed. This method took advantage of the different frequency of system call between different attack behaviors, collected the system call generated when the container was running, extracted the system call features by combining the sliding window and TF-IDF algorithm, and classified by comparing the feature similarity. The experimental results show that the detection rate of this method can reach 97%, and the false alarm rate is less than 4%.

Keywords

• host system call
• intrusion detection
• docker container
• adfa-ld data set