A Graph Neural Network-Based Method for Detecting Malicious Behavior in Containers

The number of deployed IoT networks today is vast, forming a significant “attack surface” that leads to an exponential increase in malware posing an unprecedented and significant security risk to IoT networks. In the IoT environment, traditional antivirus software is increasingly difficult to effectively detect modern complex malware. To address this challenge, this paper proposes a container malware detection method based on Graph Neural Networks (GNNs). The method constructs an IoT environment using LXC container technology, collecting hardware performance counter data at the node level to detect malicious behavior within containers. Compared to traditional machine learning-based detection methods, the paper’s adoption of Graph Neural Network algorithms can learn richer feature representations, and experimental results show that the container malware detection method based on Graph Neural Networks has a higher accuracy rate.