Securing Cloud Containers through Intrusion Detection and Remediation

Linux containers are gaining increasing traction in both individual and industrial use. As these containers get integrated into mission-critical systems, real-time detection of malicious cyber attacks becomes a critical operational requirement. However, a little research has been conducted in this area. This research introduces an anomaly-based intrusion detection and remediation system for container-based clouds. The introduced system monitors system calls between the container and the host server to passively detect malfeasance against applications running in cloud containers. We started by applying a basic memory-based machine learning technique to model the container behavior. The same technique was also extended to learn the behavior of a distributed application running in a number of cloud-based containers. In addition to monitoring the behavior of each container independently, the system used prior knowledge for a more informed detection system. We then studied the feasibility and effectiveness of applying a more sophisticated deep learning technique to the same problem. We used a recurrent neural network to model the container behavior. We evaluated the system using a typical web application hosted in two containers, one for the front-end web server, and one for the back-end database server. The system has shown promising results for both of the machine learning techniques used. Finally, we describe a number of incident handling and remediation techniques to be applied upon attack detection.

Name thesis:degree_name

Ph. D.

Level thesis:degree_level

doctoral

Discipline thesis:degree_discipline

Computer Engineering

Department dc:contributor.department

Electrical and Computer Engineering

Grantor dc:publisher

Virginia Tech

Year dc:date.issued

2017

Author dc:creator

• Abed, Amr Sayed Omar

Chair dc:contributor.committeechair

• Clancy, Thomas Charles III

Committee members dc:contributor.committeemember

• Rakha, Hesham A.
• Yang, Yaling
• Azab, Mohamed Mahmoud Mahmoud
• Reed, Jeffrey H.

• Security in Cloud Computing
• Deep learning (Machine learning)
• Intrusion Detection
• Container Security
• Behavior Modeling
• Anomaly Detection

Statement dc:rights

• In Copyright

Licence dc:rights.uri

• http://rightsstatements.org/vocab/InC/1.0/

Dc Identifier Other

vt_gsexam:12652

OAI identifier oai:identifier

oai:vtechworks.lib.vt.edu:10919/87730