Search

HT has become a serious threat to the Internet of Things due to the globalization of the integrated circuit industry. To evade functional verification, HTs tend to have at least one trigger signal at the gate-level netlist with a very low transition probability. Based on this nature, previous studies use imbalanced controllability as a feature to detect HTs, assuming that signals with imbalanced controllability are always accompanied by low transition probability. However, this study has found out a way to create a new type of HT that has low transition probability but balanced controllability, against previous methods. Hence, current imbalanced controllability detectors are inadequate in this scenario. To address this limitation, we propose a probability-based detection method that uses unsupervised anomaly analysis to detect HTs. Our proposed method detects not only the proposed HT but also the 580 Trojan benchmarks on Trusthub. Experimental results show that our proposed detector outperforms other detectors, achieving an overall 100% true positive rate and 0.37% false positive rate on the 580 benchmarks. [ABSTRACT FROM AUTHOR]

Kubernetes, which is the most popular orchestration platform for Docker containers, is used widely for developing microservices and automating Docker instance life cycle administration. Because of advancements in containerization technology, a single server can run multiple services and use hardware resources more efficiently. However, containerized environments also bring new challenges in terms of complete monitoring and security provision. Thus, hackers can exploit the security vulnerabilities of containers to gain remote control permissions and cause extensive damage to company assets. Therefore, in this study, we propose KubAnomaly, a system that provides security monitoring capabilities for anomaly detection on the Kubernetes orchestration platform. We develop a container monitoring module for Kubernetes and implement neural network approaches to create classification models that strengthen its ability to find abnormal behaviors such as web service attacks and common vulnerabilities and exposures attacks. We use three types of datasets to evaluate our system, including privately collected and publicly available datasets as well as real‐world experiment data. Furthermore, we demonstrate the effectiveness of KubAnomaly by comparing its accuracy with that of other machine learning algorithms. KubAnomaly is shown to achieve an overall accuracy of up to 96% for anomaly detection. It successfully identifies four real attacks carried out by hackers in September 2018. Moreover, its performance overhead is only 5% greater than that of current methods. In summary, KubAnomaly significantly improves container security by avoiding anomaly attacks. [ABSTRACT FROM AUTHOR]