Abstract:Multi-tenant coexistence and resource sharing in the SaaS cloud pose serious security risks.On the one hand, soft isolation of logical namespaces is easy to be bypassed or broken.On the other hand, it is easy to be subjected to co-resident attacks due to sharing of the host operating system and underlying physical resources.Therefore it poses a serious threat to data availability, integrity and confidentiality in the container cloud.Given the problem that SaaS cloud services are vulnerable to container escape and side-channel equivalent resident attack, network deception technology increases the uncertainty of the cloud environment and reduces the effectiveness of attack by hiding the business function and characteristic attributes of the executor.Aiming at the security threat caused by the co-resident attack, combining dynamic migration and virtual honeypot security technology, the economical and reasonable network deception method was studied.Specifically, a container migration and honeypot deployment strategy based on the signal game was proposed.According to the security threat analysis, container migration and honeypot were used as defense methods.The former improved the undetectability of the system based on the idea of moving to target defense, while the latter confused attackers by placing decoy containers or providing false services.Furthermore, since network reconnaissance was the pre-step of the network attack chain, the attack and defense process was modeled as a two-person signal game with incomplete information.The sender chose to release a signal according to his type, and the receiver could only obtain the signal released by the sender but could not determine the type.Then, a game tree was constructed for the complete but imperfect information dynamic game, and the costs and benefits of different strategy combinations were set.The optimal deception strategy was determined by equilibrium analysis of attack-defense model.Experimental results show that the proposed strategy can effectively improve system security.Besides, it can also reduce container migration frequency and defense cost.

A Node Security Determination Method Based on Container Monitoring

Security Challenges in the Container Cloud

A Secure Edge Power System Based on a Docker Container

A Container Escape Detection Method Based on a Dependency Graph

A Lightweight Container Security Framework Adapted to the Power Cloud Platform

Research on Security Issues of Docker and Container Monitoring System in Edge Computing System

Blockchain-based Automated Container Cloud Security Enhancement System.

Use Trust Management Module to Achieve Effective Security Mechanisms in Cloud Environment

On Security Measures for Containerized Applications Imaged with Docker

Research and implementation of intelligent monitoring for containerized PaaS

Experimental Analysis of Security Attacks for Docker Container Communications

Strategy of Container Migration and Honeypot Deployment Based on Signal Game in Cloud Environment

DockerWatch: a two-phase hybrid detection of malware using various static features in container cloud

Self-adaptive Approach for Container-based Cloud Resources Management

Whispers Between The Containers: High-Capacity Covert Channel Attacks In Docker

Understanding the Quality of Container Security Vulnerability Detection Tools

Docker container hardening method based on trusted computing

Towards Understanding and Defeating Abstract Resource Attacks for Container Platforms

Securing Vulnerabilities in Docker Images

ContainerGuard: A Real-Time Attack Detection System in Container-Based Big Data Platform

Real-time network virtualization based on SDN and Docker container