Anomaly Detection in Containerized Systems Based on System Call Histograms and Autoencoder Neural Network

When deploying complex, highly loaded end-to-end solutions, container systems are becoming an increasingly popular choice as an alternative to virtual operating systems. These technologies can significantly reduce the cost of computing resources, and also provide flexible and fast scaling of container infrastructure. However, attacks and vulnerabilities that grow proportionally to the technologies being implemented leave the question on the security of such systems open. In order to improve the efficiency of anomalous behavior detection in container systems, this paper presents an approach based on a new method for generating a training dataset based on creating and generating sequences of process histograms. The process of creating histograms is based on tracing and counting all system calls executed within a process. After the histograms are created, they undergo a normalization stage to “remember” significant information about the sequences of executed processes. After that, the generated dataset is passed to the unsupervised Autoencoder neural network model for training or subsequent detection. The process of anomalous behavior detection is based on calculating the reconstruction error of the input test data vector in relation to a given threshold value. Exceeding the specified threshold indicates the presence of abnormal values in the test data vector. The paper describes in detail the stages of creating a prototype of the proposed solution: data collection and normalization, training and detection. Estimates obtained during a number of experiments show that the proposed method demonstrates an accuracy of more than 92%.