Catching What Signatures Miss: AI and eBPF for Cloud-Native Threat Detection
Main Article Content
Abstract
Cloud-native environments bring forth dynamic workloads, ephemeral containers, distributed services, and dynamically changing execution patterns, with which signature-based security mechanisms are often ill-suited. The signature-based detection, whilst working well with the known threats, might not detect newer attacks, altered malware, and suspicious activities that do not correlate with the standard indicators. The paper suggests an AI-assisted framework of threat detection on clouds using a combination of a long-term Berkeley Packet Filter (eBPF) telemetry with behavioral analytics and machine learning. The framework gathers runtime events related to the execution of processes, network communication, access of files and activities related to privileges. These happenings are turned into contextual characteristics and decomposed through supervised and unsupervised learning algorithms to determine abnormalities in workload behavior. Risk-based analysis element is an integration of a model confidence, behavior deviation, and asset criticality, and corroborating evidence to rank alerts. An empirical methodology of assessment is suggested that can be reproduced to investigate detection performance, false-positive, performance, and performance on threats not being studied. The research places AI and eBPF as complementary technologies that have the potential of reinforcing the current cloud-native security controls.
Article Details
Section
How to Cite
References
Mishra, P., Pilli, E. S., Varadharajan, V., & Tupakula, U. (2017). Intrusion detection techniques in cloud environment: A survey. Journal of Network and Computer Applications, 77, 18–47. https://doi.org/10.1016/j.jnca.2016.10.015
Liu, Z., Xu, B., Cheng, B., Hu, X., & Darbandi, M. (2022). Intrusion detection systems in the cloud computing: A comprehensive and deep literature review. Concurrency and Computation: Practice and Experience, 34(4), Article e6646. https://doi.org/10.1002/cpe.6646
Linux Kernel Documentation. (n.d.). BPF documentation. https://www.kernel.org/doc/html/latest/bpf/
Aldweesh, A., Derhab, A., & Emam, A. Z. (2020). Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues. Knowledge-Based Systems, 189, Article 105124. https://doi.org/10.1016/j.knosys.2019.105124
Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey. ACM Computing Surveys, 41(3), Article 15. https://doi.org/10.1145/1541880.1541882
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019). Survey of intrusion detection systems: Techniques, datasets and challenges. Cybersecurity, 2, Article 20. https://doi.org/10.1186/s42400-019-0038-7
Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153–1176. https://doi.org/10.1109/COMST.2015.2494502
Sommer, R., & Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE Symposium on Security and Privacy (pp. 305–316). IEEE. https://doi.org/10.1109/SP.2010.25
The Falco Authors. (n.d.). Falco: Cloud native runtime security. GitHub. https://github.com/falcosecurity/falco
Souppaya, M., Morello, J., & Scarfone, K. (2017). Application container security guide (NIST Special Publication 800-190). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-190
Kubernetes Authors. (n.d.). Security checklist. Kubernetes documentation. https://kubernetes.io/docs/concepts/security/security-checklist/
MITRE. (n.d.). Containers matrix. MITRE ATT&CK. https://attack.mitre.org/matrices/enterprise/containers/
Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In 2015 Military Communications and Information Systems Conference (MilCIS) (pp. 1–6). IEEE. https://doi.org/10.1109/MilCIS.2015.7348942
Sharafaldin, I., Lashkari, A. H., & Ghorbani, A. A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy (pp. 108–116). SCITEPRESS. https://doi.org/10.5220/0006639801080116
Sculley, D., Holt, G., Golovin, D., Davydov, E., Phillips, T., Ebner, D., Chaudhary, V., Young, M., Crespo, J.-F., & Dennison, D. (2015). Hidden technical debt in machine learning systems. In Advances in Neural Information Processing Systems (Vol. 28). Curran Associates, Inc. https://proceedings.neurips.cc/paper/2015/hash/86df7dcfd896fcaf2674f757a2463eba-Abstract.html