CPCED: a container escape detection system based on CNI plugin

Container escape detection is a critical research topic in the field of cloud security. Among the challenges faced in modern cloud security, the issue of container escape poses a significant threat due to its direct impact on the security of the host machine. Although recent research has proposed various methods to address such issue, they have shortcomings in terms of real-time capabilities and deployment in multinode environments. Meanwhile, container network interface (CNI) plugins provide network functionality for container management systems such as Kubernetes, offering ease of use and scalability. Therefore, we propose CPCED, a real-time container escape detection system running on a generic CNI plugin, and implement the prototype. The system defines the container namespace event that is used to detect insecure interactions by monitoring its changes in the permissions of the process namespace. To detect the events, an algorithm is proposed to extract suspicious process paths and command context in Kubernetes and Docker environments. The experimental results show that this system detects nine container escape vulnerabilities successfully. Compared to PACED, one of the real-time container escape attack detection systems, the memory usage of CPCED is reduced by 7.6% on average, and the average detection time of single vulnerability is 18.6% of PACED’s.