Container Anomaly Detection via Behavioral Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increased adoption of container technology in modern companies introduces new security risks due to a lack of effective container protection technologies, with hackers easily bypassing existing malicious image signatures and third-party container creation complicating reputation and behavior profiling, leading to increased computational costs and delayed deployments.
Innovation Solution
Dynamic profiling of container runtime behaviors to identify and mitigate anomalous containers by clustering them with peer containers based on shared purposes and file structures, maintaining a dynamic baseline, and reducing computational overhead by only profiling containers with a shared identified purpose.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic profiling of all containers is performed to identify anomalous containers, then container security is improved, but computational overhead increases
Solution Approach 1:
The patent segments containers into clusters based on their runtime behavior characteristics and file structures. By dividing the container population into distinct groups with similar profiles, the system can apply security analysis more efficiently to each segment rather than treating all containers uniformly, reducing overall computational overhead while maintaining security effectiveness.
Solution Approach 2:
The patent applies profiling and anomaly detection selectively to containers that exhibit deviant behavior or belong to specific risk categories, rather than performing exhaustive profiling on all containers. This partial action approach focuses computational resources on high-risk targets, improving security where needed while reducing unnecessary computational overhead for low-risk containers.
2Measurement precision
If clustering based on runtime behavior and file structure is implemented, then anomaly detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent performs preliminary clustering of containers based on their runtime behavior and file structure characteristics before conducting detailed anomaly detection. By pre-organizing containers into behavior-based clusters, the system establishes a foundation for more accurate anomaly detection while managing complexity through structured preprocessing rather than complex real-time analysis.
Solution Approach 2:
The patent creates simplified representations or profiles of container behavior patterns that can be copied and compared across clusters. Instead of performing complex direct comparisons between all container pairs, the system uses copied behavioral profiles and file structure signatures to efficiently assess similarity and detect anomalies, reducing computational complexity while maintaining detection accuracy.
Data Source
AI summary
One or more computer processors determine a runtime feature set for a first container, wherein the runtime feature set includes aggregated temporally collocated container behavior. The one or more computer processors cluster the first container with one or more peer containers or peer pods based on a shared container purpose, similar container behaviors, and similar container file structure. The one or more computer processors determine an additional runtime feature set for each peer container. The one or more computer processors calculate a variance between the first container and each peer container. The one or more computer processors, responsive to the calculated variance exceeding a variance threshold, identify the first container as anomalous.