Intrusion Detection System for Applications Using Linux Containers

被引：22

作者：

Abed, Amr S. ^{[1
]}

Clancy, Charles ^{[2
]}

Levy, David S. ^{[3
]}

机构：

[1] Virginia Tech, Dept Elect & Comp Engn, Blacksburg, VA 24061 USA

[2] Virginia Tech, Hume Ctr Natl Secur & Technol, Arlington, VA USA

[3] Mitre Corp, Annapolis Jct, MD USA

来源：

SECURITY AND TRUST MANAGEMENT (STM 2015) | 2015年 / 9331卷

关键词：

Intrusion detection; Anomaly detection; System call monitoring; Container security; Security in cloud computing;

D O I：

10.1007/978-3-319-24858-5_8

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Linux containers are gaining increasing traction in both individual and industrial use, and as these containers get integrated into mission-critical systems, real-time detection of malicious cyber attacks becomes a critical operational requirement. This paper introduces a real-time host-based intrusion detection system that can be used to passively detect malfeasance against applications within Linux containers running in a standalone or in a cloud multi-tenancy environment. The demonstrated intrusion detection system uses bags of system calls monitored from the host kernel for learning the behavior of an application running within a Linux container and determining anomalous container behavior. Performance of the approach using a database application was measured and results are discussed.

引用

页码：123 / 135

页数：13

共 20 条

[1]

Alarifi S., 2013, NETWORK SYSTEM SECUR, P321

[2]

Alariti SS, 2012, INT CONF INTERNET, P211

[3]

[Anonymous], 1996, Proceedings of 1996 IEEE Symposium on Security and Privacy, DOI DOI 10.1109/SECPRI.1996.502675

[4] Big Data for Digital Government: Opportunities, Challenges, and Strategies [J].

Chen, Yu-Che ;

Hsieh, Tsui-Chuan .

INTERNATIONAL JOURNAL OF PUBLIC ADMINISTRATION IN THE DIGITAL AGE, 2014, 1 (01) :1-14

[5] Efficient anomaly detection by modeling privilege flows using hidden Markov model [J].

Cho, SB ;

Park, HJ .

COMPUTERS & SECURITY, 2003, 22 (01) :45-55

[6]

Cohen WilliamW., 1995, Fast Effective Rule Induction

[7]

Damele B., 2015, SQLMAP AUTOMATIC SQL

[8]

Helsley M., 2009, LXC LINUX CONTAINER

[9]

Hoang XD, 2003, ICON 2003: 11TH IEEE INTERNATIONAL CONFERENCE ON NETWORKS, P531

[10]

Hofmeyr S. A., 1998, Journal of Computer Security, V6, P151

← 1 2 →