Abstract:Summary Cloud's operating‐system‐level virtualization has introduced a new phase of lightweight virtualization through containers. The architecture of cloud‐native and microservices‐based application development strongly advocates for the use of containers due to their swift and convenient deployment capabilities. However, the security of applications within containers is important, as malicious or vulnerable content could jeopardize the container and the host system. This vulnerability also extends to neighboring containers and may compromise data integrity and confidentiality. The article focuses on developing an intrusion detection system tailored to containerized cloud environments by identifying system call analysis techniques and also proposes an anomaly‐based host intrusion detection system (Ab‐HIDS). This system employs the frequency of N‐grams system calls as distinctive features. To enhance performance, two ensemble learning models, namely voting‐based ensemble learning and XGBoost ensemble learning, are employed for training and testing the data. The proposed system is evaluated using the Leipzig Intrusion Detection Data Set (LID‐DS), demonstrating substantial performance compared to existing state‐of‐the‐art methods. Ab‐HIDS is validated for class imbalance using the imbalance ratio and synthetic minority over‐sampling technique methods. Our system achieved significant improvements in detection accuracy with 4% increase for the voting‐based ensemble model and 6% increase for the XGBoost ensemble model. Additionally, we observed reductions in the false positive rate by 0.9% and 0.8% for these models, respectively, compared to existing state‐of‐the‐art methods. These results illustrate the potential of our proposed approach in improving security measures within containerized environments.

Intrusion Detection System for Applications using Linux Containers

Applying Bag of System Calls for Anomalous Behavior Detection of Applications in Linux Containers

A Clustered Learning Framework for Host Based Intrusion Detection in Container Environment.

Ab‐HIDS: An anomaly‐based host intrusion detection system using frequency of N‐gram system call features and ensemble learning for containerized environment

A Novel Intrusion Detection System Based on an Optimal Hybrid Kernel Extreme Learning Machine

An Intrusion Detection System Based On System Call

DL-HIDS: deep learning-based host intrusion detection system using system calls-to-image for containerized cloud environment

On Security Measures for Containerized Applications Imaged with Docker

Host-Based Intrusion Detection System with System Calls

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

DockerWatch: a two-phase hybrid detection of malware using various static features in container cloud

Toward Smart Moving Target Defense for Linux Container Resiliency

ContainerGuard: A Real-Time Attack Detection System in Container-Based Big Data Platform

An integrated pattern recognition approach for intrusion detection

Understanding the Quality of Container Security Vulnerability Detection Tools

Container Performance and Vulnerability Management for Container Security Using Docker Engine

Kernel Intrusion Detection Method Based on Xen Hypervisor

Two-Tier Intrusion Detection Framework for Embedded Systems

Toward Efficient Intrusion Detection System Using Hybrid Deep Learning Approach

Survey on Intrusion Detection Systems Based on Machine Learning Techniques for the Protection of Critical Infrastructure