Software Container Out-Call Ratio Analysis for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the use of software containers grows, so does the challenge of detecting unauthorized or malicious application instances, making it difficult to differentiate between legitimate and anomalous behavior within these isolated environments.
Innovation Solution
Probabilistic and machine-learning based systems model software container behavior by analyzing out-calls and their distributions across different layers, using relative entropy measures to identify anomalies and determine application types, thereby enhancing detection of unauthorized or malicious instances.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If software container usage increases to improve productivity and deployment speed, then application deployment efficiency is improved, but the difficulty of detecting malicious instances increases
Solution Approach 1:
The system performs preliminary actions by building probabilistic models of normal container behavior during a training phase before deployment. These models capture expected out-call patterns, system call distributions, and resource usage characteristics. During runtime, the pre-built models enable rapid anomaly detection without interfering with container execution, thus maintaining high deployment efficiency while improving detection capability.
Solution Approach 2:
The patent introduces probabilistic models as an intermediary between the container execution environment and the detection system. These models act as mediators that translate raw container behavior data (out-calls, system calls, resource usage) into meaningful anomaly scores. The intermediary layer enables efficient detection by processing behavior patterns statistically rather than requiring complex real-time analysis of each container instance.
2Measurement precision
If probabilistic modeling with multiple out-call types is used to improve detection accuracy, then detection precision is improved, but computational complexity increases
Solution Approach 1:
The detection system segments the analysis into distinct out-call type categories (e.g., network out-calls, file system out-calls, process management out-calls). Each segment is modeled independently with its own probability distribution, allowing the system to capture specific behavioral patterns for different resource access types. This segmentation improves detection precision by focusing on category-specific anomalies while managing computational complexity through modular processing.
Solution Approach 2:
The system employs parameter changes by using relative entropy (Kullback-Leibler divergence) as a metric to measure the difference between observed behavior and expected behavior. By transforming raw out-call counts into probability distributions and then computing relative entropy, the system achieves high detection precision through a mathematically efficient approach. The parameter transformation from discrete call counts to continuous probability metrics simplifies the complexity of comparing heterogeneous out-call types.
Data Source
AI summary
A system determines a first volume of out-calls of a first out-call type made by a software container that is executing an application during a time period. The system determines a second volume of out-calls of a second out-call type made by the software container. The system determines a first ratio of the first volume to a combined volume of out-calls of all out-call types made by the software container. The system determines a second ratio of the second volume to the combined volume of out-calls of all out-call types made by the software container. The system determines a measure by comparing the first ratio to a third ratio associated with the first out-call type, and by comparing the second ratio to a fourth ratio associated with the second out-call type. The system identifies any behavior or any application type associated with the application, based on the measure.