Search

Aiming at the problem of high false negative rate in container escape detection technologies, a real-time detecting method of heterogeneous observation was proposed.Firstly, the container escape behavior utilizing kernel vulnerabilities was modeled, and the critical attributes of the process were selected as observation points.A heterogeneous observation method was proposed with “privilege escalation” as the detection criterion.Secondly, the kernel module was adopted to capture the attribute information of the process in real time, and the process provenance graph was constructed.The scale of the provenance graph was reduced through container boundary identification technology.Finally, a heterogeneous observation chain was built based on the process attribute information, and the prototype system HOC-Detector was implemented.The experiments show that HOC-Detector can successfully detect all container escapes using kernel vulnerabilities in the test dataset, and the increased runtime overhead is less than 0.8%.

Copyright of Machine Tool & Hydraulics is the property of Guangzhou Mechanical Engineering Research Institute (GMERI) and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Aiming at the problem of high false negative rate in container escape detection technologies, a real-time detecting method of heterogeneous observation was proposed. Firstly, the container escape behavior utilizing kernel vulnerabilities was modeled, and the critical attributes of the process were selected as observation points. A heterogeneous observation method was proposed with "privilege escalation" as the detection criterion. Secondly, the kernel module was adopted to capture the attribute information of the process in real time, and the process provenance graph was constructed. The scale of the provenance graph was reduced through container boundary identification technology. Finally, a heterogeneous observation chain was built based on the process attribute information, and the prototype system HOC-Detector was implemented. The experiments show that HOC-Detector can successfully detect all container escapes using kernel vulnerabilities in the test dataset, and the increased runtime overhead is less than 0.8%. [ABSTRACT FROM AUTHOR]

Provenance is a rapidly progressing new field with many open research problems. With the huge amount of information and processes available, provenance becomes crucial for understanding the creation, manipulation and quality of data and processes. Being related to data and processes, provenance research is at the cross road of research from several communities, such as databases, networks. However, there is a lot of confusion when comparing research efforts from different point of views. In this survey paper, we define provenance, provenance types, point out standardization approaches, describe provenance work in sensors network community to sketch a panoramic view of the recent research. [ABSTRACT FROM AUTHOR]