Towards Unsupervised Introspection of Containerized Application

Container (or containerization) as one of the new concepts of virtualization, has attracted increasing attention and occupied a considerable amount of market size owing to the inherent lightweight characteristic. However, the lightweight advantage is achieved at the price of the security. Attacks against weak isolation of the container have been reported, and the use of a shared kernel is another targeted vulnerable point. This work aims to provide secure monitoring of containerized applications, which can help i) the infrastructure owner to ensure the running application is harmless, ii) the application owner to detect anomalous behaviors. We propose to use unsupervised introspection tools to perform the non-intrusive monitoring, which leverages the system call traces to classify the anomalies. Since the traditional dataset used for anomaly detection either only focus on network traces or limited to few attributes of system calls, we crafted and collected various normal and abnormal behaviors of a containerized application, and an optimized and open-source system call based dataset has been built. Unsupervised machine learning classifiers are trained over the proposed dataset, a comprehensive case study has been performed and analyzed. The results show the feasibility of unsupervised introspection of containerized applications.