基于主机系统调用频率的容器入侵检测方法

Container intrusion detection method based on host system call frequency

容器技术由于其轻量级虚拟化的特点,已成为云平台中广泛使用的虚拟化技术,但它与宿主机共享内核,安全性和隔离性较差,易遭受泛洪、拒绝服务、逃逸攻击。为了有效检测容器是否遭受攻击,提出了一种基于主机系统调用频率的入侵检测方法,该方法利用不同攻击行为之间系统调用频率不同的特点,收集容器运行时产生的系统调用,结合滑动窗口和TF-IDF算法提取系统调用特征,通过对比特征相似度进行分类。通过实验验证,该方法的检测率可达97%,误报率低于4%。

Container technology has become a widely used virtualization technology in cloud platform due to its lightweight virtualization characteristics.However,it shares the kernel with the host,so it has poor security and isolation,and is vulnerable to flood,denial of service,and escape attacks.In order to effectively detect whether the container is attacked or not,an intrusion detection method based on host system call frequency was proposed.This method took advantage of the different frequency of system call between different attack behaviors,collected the system call generated when the container was running,extracted the system call features by combining the sliding window and TF-IDF algorithm,and classified by comparing the feature similarity.The experimental results show that the detection rate of this method can reach 97%,and the false alarm rate is less than 4%.