Malchain: Virtual Application Behaviour Profiling by Aggregated Microservice Data Exchange Graph

In the recent literature, Machine Learning (ML) techniques are increasingly used to detect the abnormal behaviour for different applications. Recently, these applications have moved to the cloud and virtualized environments due to the unique benefits such as deployment agility, scalability, flexibility and resiliency. However, those benefits pose a new challenge for classical ML approaches to accurately identify abnormal behaviours due to their highly dynamic and heterogeneous nature. In this paper, we propose a new approach Malchain for profiling virtual applications based on using a new concept: microservice role. The roles are used to provide a consistent view of the virtual application addressing the mentioned new challenges. The microservice data exchange graph built using this consistent view is then used to extract features providing the appropriate measures to profile the aggregated behaviour of the microservices comprising a virtual application. We show the efficiency and feasibility of our approach by implementing several different real-world attacks, and measuring high detection rates (86%-99%) for those attacks.