Abstract:Multi-tenant coexistence and resource sharing in the SaaS cloud pose serious security risks.On the one hand, soft isolation of logical namespaces is easy to be bypassed or broken.On the other hand, it is easy to be subjected to co-resident attacks due to sharing of the host operating system and underlying physical resources.Therefore it poses a serious threat to data availability, integrity and confidentiality in the container cloud.Given the problem that SaaS cloud services are vulnerable to container escape and side-channel equivalent resident attack, network deception technology increases the uncertainty of the cloud environment and reduces the effectiveness of attack by hiding the business function and characteristic attributes of the executor.Aiming at the security threat caused by the co-resident attack, combining dynamic migration and virtual honeypot security technology, the economical and reasonable network deception method was studied.Specifically, a container migration and honeypot deployment strategy based on the signal game was proposed.According to the security threat analysis, container migration and honeypot were used as defense methods.The former improved the undetectability of the system based on the idea of moving to target defense, while the latter confused attackers by placing decoy containers or providing false services.Furthermore, since network reconnaissance was the pre-step of the network attack chain, the attack and defense process was modeled as a two-person signal game with incomplete information.The sender chose to release a signal according to his type, and the receiver could only obtain the signal released by the sender but could not determine the type.Then, a game tree was constructed for the complete but imperfect information dynamic game, and the costs and benefits of different strategy combinations were set.The optimal deception strategy was determined by equilibrium analysis of attack-defense model.Experimental results show that the proposed strategy can effectively improve system security.Besides, it can also reduce container migration frequency and defense cost.

Toward Smart Moving Target Defense for Linux Container Resiliency

Houdini's Escape

EI-MTD: Moving Target Defense for Edge Intelligence Against Adversarial Attacks

Intrusion Detection System for Applications using Linux Containers

Towards Understanding and Defeating Abstract Resource Attacks for Container Platforms

A Survey of Moving Target Defenses for Network Security

Strategy of Container Migration and Honeypot Deployment Based on Signal Game in Cloud Environment

Moving-target Defense against Botnet Reconnaissance and an Adversarial Coupon-Collection Model

An SRN-Based Model for Assessing Co-Resident Attack Mitigation in Cloud with VM Migration and Allocation Policies*

Enhancing TinyML-Based Container Escape Detectors With Systemcall Semantic Association in UAVs Networks

A Container Escape Detection Method Based on a Dependency Graph

Learning Effective Strategies for Moving Target Defense with Switching Costs

Moving Target Defense Techniques: A Survey

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Adaptive Attacker Strategy Development Against Moving Target Cyber Defenses

Attacks are Forwarded: Breaking the Isolation of MicroVM-based Containers Through Operation Forwarding

Spatial-Temporal Moving Target Defense: A Markov Stackelberg Game Model

A Moving Target Defense for Securing Cyber-Physical Systems

Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats - Volume 54

Enhancing cloud security: harnessing bayesian game theory for a dynamic defense mechanism

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense