CubeMig: MTD Live Migration in Kubernetes with LLM-Augmented Post-Incident Analysis

Future networks are expected to rely heavily on cloud-native technologies. However, the security and resilience of those systems deserve more attention. CubeMig presents an approach to enhancing security in Kubernetes environments, enabling pods to live migrate, leveraged as part of a Moving Target Defense (MTD) strategy. CubeMig showcases reactive defensive mechanisms by incorporating automated live migrations as a response to threats detected in near real-time at the OS kernel level, using an eBPF-based approach. The mitigation process is further enhanced with forensic analysis on the checkpoint of the migrated container, providing insights into the compromised containers offline and instantiating the container in a sandboxed environment for further online analysis. Finally, we augment the forensic analysis output using LLMs, generating human-explainable analysis from the forensic logs to support post-incident investigation and providing relevant security recommendations. Experimental results validate the approach’s effectiveness in a human-in-the-loop setting, showcasing the system’s ability to detect and respond to attack scenarios such as reverse shell execution, log tampering, and system destruction.