eBPF와 AdaBoost를 사용한 컨테이너 공격의 정확한 탐지 기법
A Technique for Accurate Detection of Container Attacks with eBPF and AdaBoost
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
이 논문은 컨테이너 기반의 시스템 보안 강화를 목표로, 커널을 수정하지 않고 시스템콜을 분석하여경쟁 상태를 동적으로 감지하는 새로운 방법을 제시한다. 컨테이너 탈출 공격은 공격자가 컨테이너의격리를 벗어나 다른 시스템에 접근할 수 있게 하는데, 이 중 경쟁 상태 기반의 공격은 병렬 컴퓨팅환경에서 발생할 수 있는 보안 취약점을 이용한다. 이러한 공격을 효과적으로 감지하고 방어하기 위해, 본 연구에서는 eBPF를 활용하여 공격 시 발생하는 시스템콜 패턴을 관찰하고, AdaBoost 모델을 사용하여 공격 프로세스와 정상 프로세스를 구분하는 방법을 개발하였다. 이를 위해 Dirty COW, Dirty Cred와같은 공격과 MongoDB, PostgreSQL, Redis와 같은 일반 컨테이너 사용 사례에서 발생하는 시스템콜을분석하여 학습 데이터로 활용하였다. 실험 결과, 이 방법은 99.55%의 Precision, 99.68%의 Recall 그리고99.62%의 F1-score를 달성했으며, 이로 인한 시스템 오버헤드는 약 8%로 나타났다.
Abstract
This paper proposes a novel approach to enhance the security of container-based systems by analyzing system calls to dynamically detect race conditions without modifying the kernel. Container escape attacks allow attackers to break out of a container's isolation and access other systems, utilizing vulnerabilities such as race conditions that can occur in parallel computing environments. To effectively detect and defend against such attacks, this study utilizes eBPF to observe system call patterns during attack attempts and employs a AdaBoost model to detect them. For this purpose, system calls invoked during the attacks such as Dirty COW and Dirty Cred from popular applications such as MongoDB, PostgreSQL, and Redis, were used as training data. The experimental results show that this method achieved a precision of 99.55%, a recall of 99.68%, and an F1-score of 99.62%, with the system overhead of 8%.
참고문헌 (23)
- "CNCF Annual Survey" (2022)[URL]
- "Dirty COW"[URL]
- Z. Lin, "DirtyCred : Escalating Privilege in Linux Kernel", Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (2022)
- "Docker container escape using the Dirty COW vulnerability"[URL]
- "A new method for container escape using file-based DirtyCred" (2023)[URL]
- "New cryptominer seeks out root permissions on Linux"[URL]
- M. Belair, "SNAPPY : programmable kernel-level policies for containers", Proceedings of the 36th Annual ACM Symposium on Applied Computing (2021)
- N. DeMarinis, "Sysfilter : Automated system call filtering for commodity software", 23rd International Symposium on Research in Attacks, Intrusions and Defenses(RAID 2020) (2020)
- W. Findlay, "Bpfbox : Simple precise process confinement with ebpf", In Proceedings of the 2020ACM SIGSAC Conference on Cloud Computing Security Workshop (2020)
- S. Ghavamnia, "Confine : Automated system call policy generation for container attack surface reduction", 23rd International Symposium on Research in Attacks, ntrusions and Defenses (RAID 2020) (2020)
- S. Lim, "Secure namespaced kernel audit for containers", Proceedings of the ACM Symposium on Cloud Computing (2021)
- F. Loukidis-Andreou, "Docker-sec : A fully automated container security enhancement mechanism", 2018 IEEE 38th International Conference on Distributed Computing Systems (ICDCS) (2018)
- Y. Sun, "Security namespace : making linux security frameworks", 27th USENIX Security Symposium (USENIX Security 18) (2018)
- "About AppArmor" (2019)[URL]
- A. Agache, "Firecracker : Lightweight virtualization for serverless applications", 17th USENIX symposium on networked systems design and implementation (NSDI 20) (2020)
- "gVisor"[URL]
- A. Randazzo, "Kata containers : An emerging architecture for enabling mec services in fast and secure way", 2019 Sixth International Conference on Internet of Things:Systems, Management and Security (IOTSMS) (2019)
- L. Rice, "Container security: Fundamental technology concepts that protect containerized applications" (2020), O’Reilly Media, Inc
- S. Kim, "Prof-gen : Practical study on system call whitelist generation for container attack surface reduction", 2021 IEEE 14th International Conference on Cloud Computing (CLOUD) (2021)
- "eBPF"[URL]
- "Berkeley Packet Filter"[URL]
- S. McCanne, "The BSD Packet Filter : A New Architecture for User-level Packet Capture", USENIX winter (1993)
- "Phoronix Test Suite"[URL]