Abstract:By penetrating into a large number of machines and stealthily installing malicious pieces of code, a distributed denial of service (DDoS) attack constructs a hierarchical network and uses it to launch coordinated assaults. DDoS attacks often exhaust the network bandwidth, processing capacity and information resources of victims, thus, leading to unavailability of computing systems services. Various defense mechanisms for the detection, mitigation and/or prevention of DDoS attacks have been suggested including resource redundancy, traceback of attack origins and identification of programs with suspicious behavior. Contemporary DDoS attacks employ sophisticated techniques including formation of hierarchical networks, one-way communication channels, encrypted messages, dynamic ports allocation and source address spoofing to hide the attackers' identities; such techniques make both detection and tracing of DDoS activities a challenge and render traditional DDoS defense mechanisms ineffective. In this paper, we propose the DDoS Container, a comprehensive framework that uses network-based detection methods to overcome the above complex and evasive types of attacks; the framework operates in 'inline' mode to inspect and manipulate ongoing traffic in real-time. By keeping track of connections established by both potential DDoS attacks and legitimate applications, the suggested DDoS Container carries out stateful inspection on data streams and correlates events among sessions. The framework performs stream re-assembly and dissects the resulting aggregations against protocols followed by various known DDoS attacks facilitating their identification. The traffic pattern analysis and data correlation of the framework further enhance its detection accuracy on DDoS traffic camouflaged with encryption. Actions available on identified DDoS traffic range from simple alerting to message blocking and proactive session termination. Experimentation with the prototype of our DDoS Container shows its effectiveness in classifying DDoS traffic.

Analysis of DoS Attacks on Docker Inter-Component Stdio Copy

Houdini's Escape

Experimental Analysis of Security Attacks for Docker Container Communications

HODOR: Shrinking Attack Surface on Node.js Via System Call Limitation

Coda: Runtime Detection of Application-Layer CPU-Exhaustion DoS Attacks in Containers

Whispers Between The Containers: High-Capacity Covert Channel Attacks In Docker

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

RSDS: Getting System Call Whitelist for Container Through Dynamic and Static Analysis

Shrinking the Kernel Attack Surface Through Static and Dynamic Syscall Limitation

Towards Understanding and Defeating Abstract Resource Attacks for Container Platforms

An Inline Detection and Prevention Framework for Distributed Denial of Service Attacks

SWAT4J: Generating System Call Allowlist for Java Container Attack Surface Reduction

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Research on Container-Oriented Isolation Control Technology

Demons in the Shared Kernel

Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization

Challenges in Docker Development: A Large-scale Study Using Stack Overflow

A Container Escape Detection Method Based on a Dependency Graph

Research on Security Issues of Docker and Container Monitoring System in Edge Computing System

Attacks are Forwarded: Breaking the Isolation of MicroVM-based Containers Through Operation Forwarding

Security Challenges in the Container Cloud