마이크로서비스 아키텍처에서 효율적인 이상 징후 탐지를 위한 공격 진원지 추적형 컨테이너 스냅샷 기법 설계
Design of a Attack Provenance Trackable Container Snapshot Scheme for Efficient Anomaly Detection in Microservices Architecture
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
마이크로서비스 아키텍처는 소프트웨어 개발에서 주로 사용하는 분산 소프트웨어 아키텍처이다. 그러나, 마이크로서비스 간 통신을 위해 추가하는 요소들로 인해 1) 구조적 복잡성이 증가하는 이슈와 2) 공격 표면이 증가하는 이슈가 발생한다. 구조적 복잡성 증가 이슈를 해결하기 위해 분산 추적 기법이 제안되었으며, 최근엔 이러한 분산 추적 기법을 응용하여 보안성 향상 목적의 관련 연구가 수행되고 있다. 그러나, 분산 추적 기술은 본래 서비스 성능 관리 및 디버깅 수행이 목적이므로, 보안성 향상 목적으로 활용할 수 있는 범위가 제한적이다. 본 논문은 이러한 문제를 해결하기 위해 진원지 추적형 컨테이너 스냅샷 기법을 제안한다. 진원지 추적형 컨테이너 스냅샷 기법은 분산 추적 기법의 인과 관계 정보를 활용하여, 사이버 위협이 발생한 관련 마이크로서비스만을 선별적으로 컨테이너 스냅샷을 수행한다. 이를 통해, 컨테이너 스냅샷 과정을 효율적으로 수행할 수 있다. 제안하는 방안의 실용성을 검증하기 위해, 임의의 마이크로서비스 환경을 구성하여 스냅샷 과정에서 발생하는 오버헤드 및 지연 시간을 측정하였다. 실험 결과, 컨테이너 스냅샷 과정에서 0.7%의 메모리 오버헤드가 발생했으며, 평균 172ms를 필요로 하였다. 본 논문에서 제안하는 진원지 추적형 컨테이너 스냅샷 기법은 마이크로서비스 환경에서 발생한 이상 징후 탐지에 다양하게 활용될 수 있으며, 이를 통해 마이크로서비스 환경의 보안성을 향상할 수 있다.
Abstract
Microservices architecture is a distributed software architecture mainly used in software development. However, due to the elements added for communication between microservices, 1) an issue of increasing structural complexity and 2) an issue of increasing attack surface arises. A distributed tracing scheme has been proposed to solve the issue of increasing structural complexity, and recently, related research for the purpose of improving security has been conducted by applying this distributed tracing scheme. However, since the distributed tracing scheme is originally intended to manage service performance and perform debugging, the scope that can be used for the purpose of improving security is limited. To solve this problem, this paper proposes a container snapshot method for tracking the attack provenance. The attack provenance trackable container snapshot scheme utilizes the causal relationship information of the distributed tracing scheme to selectively perform container snapshots of only related microservices in which cyber threats have occurred. Through this, it is possible to efficiently perform the container snapshot process. To verify the practicality of the proposed scheme, an arbitrary microservices environment was configured to measure the overhead and delay time incurred during the snapshot process. As a result of the experiment, a memory overhead of 0.7% occurred during the container snapshot process, and an average of 172ms was required. The attack provenance trackable container snapshot scheme proposed in this paper can be used in various ways to detect abnormal signs occurring in microservices environments, and through this, the security of the microservices environment can be improved.
참고문헌 (32)
- Yu, Dongjin, "A survey on security issues in services communication of Microservicesenabled fog applications", Concurrency and Computation: Practice and Experience, 31(22), pp.e4436~ (2019)
- Ebert, Christof, "DevOps", Ieee Software, 33(3), pp.94~100 (2016)
- Mace, Jonathan, "Universal context propagation for distributed system instrumentation", Proceedings of the Thirteenth EuroSys Conference (2018)
- "Microservices"[URL]
- "MicroservicePremium"[URL]
- "Microservices Security Probably Not What You Think It Is"[URL]
- Obermeier, Sebastian, "Automatic 공격 표면 reduction in next-generation industrial control systems", 2014 IEEE Symposium on Computational Intelligence in Cyber Security (CICS) (2014), IEEE
- Nedelkoski, Sasho, "Anomaly detection and classification using distributed tracing and deep learning", 201919th IEEE, 2019, ~[DOI]
- "Kubernetes"[URL]
- Shkuro, Yuri, "Mastering Distributed Tracing:Analyzing performance in microservices and complex systems" (2019), Packt Publishing Ltd
- Gregg, Brendan, "DTrace:Dynamic Tracing in Oracle Solaris, Mac OS X, and FreeBSD" (2011), Prentice Hall Professional
- Bailis, Peter, "Research for practice: tracing and debugging distributed systems; programming by examples", Communications of the ACM, 60(7), pp.46~49 (2017)
- Mohsen Ahmadvand, "Requirements reconciliation for scalable and secure microservice (de) composition", Requirements Engineering Conference Workshop s (REW), pp.68~73 (2016), IEEE International
- "NIST"[URL]
- "NIST"[URL]
- Yu, Dongjin, "A survey on security issues in services communication of Microservicesenabled fog applications", Concurrency and Computation: Practice and Experience, 31(22), pp.e4436~ (2019)
- Gupta, Udit, "Comparison between security majors in virtual machine and linux containers", arXiv preprint arXiv:1507.07816, ~ (2015)
- "Jaeger"[URL]
- "Zipkin"[URL]
- "Operations"[URL]
- "X-ray"[URL]
- "Light-step"[URL]
- "CRIU"[URL]
- So, you want to trace your distributed system? Key design insights from years of practical experience, "Sambasivan, Raja R.", Carnegie Mellon Univ., ~, pp.Tech. Rep. CMU-PDL 14 (2014)
- Barham, Paul, "Using Magpie for request extraction and workload modelling", OSDI, 4 (2004)
- Sigelman, Benjamin H., "Dapper, a large-scale distributed systems tracing infrastructure", ~ (2010)
- Mace, Jonathan, "Pivot tracing: Dynamic causal monitoring for distributed systems", Proceedings of the 25th Symposium on Operating Systems Principles (2015)
- Las-Casas, Pedro, "Sifter: Scalable sampling for distributed traces, without feature engineering", Proceedings of the ACM Symposium on Cloud Computing (2019)
- Borkin, Michelle A., "Evaluation of filesystem provenance visualization tools", IEEE transactions on visualization and computer graphics, 19(12), pp.2476~2485 (2013)
- Nedelkoski, Sasho, "Anomaly detection and classification using distributed tracing and deep learning", 201919th IEEE, 2019, ~[DOI]
- Jacob, Stephen, "Detecting Cyber Security Attacks against a Microservices Application using Distributed Tracing", ~ (2021)
- "Busybox"[URL]