Anomalous Container Deployment Detection via ML Anomaly Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In container orchestration services like Kubernetes, there is a risk of deploying malicious containers from public repositories, which can interfere with other containers due to the lack of secure access control, posing a threat to the network's operations.
Innovation Solution
Implementing machine-learning models trained on historical container deployment data to detect anomalous deployments by extracting features from deployment datasets and generating probability scores to identify potential threats, allowing for security alerts, rejecting requests, or terminating containers as necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If containers are deployed from public repositories, then ease of operation is improved, but security reliability deteriorates due to potential malicious containers
Solution Approach 1:
The system performs preliminary analysis of container images before deployment by extracting features and computing anomaly scores in advance. This allows potential threats to be identified before the container is actually deployed, preventing malicious containers from entering the system while still allowing legitimate containers to be deployed efficiently.
Solution Approach 2:
The anomaly detection system acts as an intermediary layer between the public container registry and the container orchestration service. It intercepts deployment requests, analyzes container images using machine learning models, and only permits deployments that pass the security check, thus mediating between the need for public repository access and security concerns.
2Reliability
If anomaly detection is performed on all container deployments, then security reliability is improved, but processing time increases
Solution Approach 1:
The system changes the parameter of analysis depth based on the computed anomaly score. For containers with low anomaly scores (appearing legitimate), the system performs minimal verification and allows fast deployment. For containers with high anomaly scores (suspected malicious), the system performs more thorough analysis. This dynamic parameter adjustment maintains security while reducing average deployment time.
Solution Approach 2:
The system applies different levels of detection scrutiny to different container deployments based on their individual characteristics. Instead of uniform deep analysis on all containers, it focuses intensive analysis only on suspicious cases while allowing quick passage for obviously legitimate containers, optimizing the balance between security and speed.
3Measurement precision
If multiple feature collections are analyzed, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The system segments the anomaly detection task into multiple independent feature collections (e.g., container metadata, image characteristics, deployment context). Each feature collection is analyzed by a separate machine learning model, and the results are aggregated. This segmentation allows the system to achieve high detection precision through comprehensive analysis while managing complexity by organizing the analysis into modular, independent components.
Data Source
AI summary
A computing system is configured to detect a request for a deployment of a container at a container orchestration service. One or more datasets associated with the deployment of the container are collected, and a plurality of features associated with the deployment are extracted based on the one or more datasets. A probability score is then generated based on the plurality of features, using a machine-learning model trained on datasets associated with historical deployments of containers that have been performed via the container orchestration service. The probability score indicates a probability that the deployment of the container is anomalous compared to the historical deployments of containers. When the probability score is greater than a threshold, the deployment of the container is determined as anomalous.