Scholarlink

<p>As cloud-native technologies continue to evolve, containerization and orchestration have become fundamental for deploying microservices. However, this advancement introduces significant security vulnerabilities, particularly due to vulnerabilities and misconfigurations that grant attackers excessive control over clusters. Existing works, including model-based learning and static rule-based approaches, suffer from limitations such as false positives and maintenance overhead, which pose significant challenges to cloud-native security.</p><p>To mitigate intrusion targeting container orchestration, we present <i>ShadowKube</i>, an innovative active defense framework tailored for Kubernetes. <i>ShadowKube</i> integrates behavioral monitoring with shadow honeypots to effectively detect and neutralize anomalous behavior. By establishing behavioral baselines to identify deviations and converting compromised nodes into honeypots, <i>ShadowKube</i> isolates and traps attackers, thereby mitigating the threats they pose. Comprehensive evaluations demonstrate <i>ShadowKube</i>’s ability to detect and migrate exploitations across 43 severe CVEs and 7 common misconfiguration types. Deployment in a live environment further validates its effectiveness, with <i>ShadowKube</i> identifying 635 attack attempts, successfully decoying 23 active attacks. Additionally, <i>ShadowKube</i> could isolate attackers and convert affected nodes into honeypots within seconds. These results highlight <i>ShadowKube</i>’s efficacy as a robust solution for enhancing security in Kubernetes clusters, offering a proactive defense mechanism against both current and emerging threats.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Shadowkube: enhancing Kubernetes security with behavioral monitoring and honeypot integration

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年8月25日

查看全文
  • Qingwang Chen,
  • Yuling Liu,
  • Ru Tan,
  • Ze Jin,
  • Juxin Xiao,
  • Xiao Wang,
  • Fangjiao Zhang,
  • Qixu Liu

摘要

As cloud-native technologies continue to evolve, containerization and orchestration have become fundamental for deploying microservices. However, this advancement introduces significant security vulnerabilities, particularly due to vulnerabilities and misconfigurations that grant attackers excessive control over clusters. Existing works, including model-based learning and static rule-based approaches, suffer from limitations such as false positives and maintenance overhead, which pose significant challenges to cloud-native security.

To mitigate intrusion targeting container orchestration, we present ShadowKube, an innovative active defense framework tailored for Kubernetes. ShadowKube integrates behavioral monitoring with shadow honeypots to effectively detect and neutralize anomalous behavior. By establishing behavioral baselines to identify deviations and converting compromised nodes into honeypots, ShadowKube isolates and traps attackers, thereby mitigating the threats they pose. Comprehensive evaluations demonstrate ShadowKube’s ability to detect and migrate exploitations across 43 severe CVEs and 7 common misconfiguration types. Deployment in a live environment further validates its effectiveness, with ShadowKube identifying 635 attack attempts, successfully decoying 23 active attacks. Additionally, ShadowKube could isolate attackers and convert affected nodes into honeypots within seconds. These results highlight ShadowKube’s efficacy as a robust solution for enhancing security in Kubernetes clusters, offering a proactive defense mechanism against both current and emerging threats.