Intrusion Detection System for Applications using Linux Containers

Simple item page
dc.contributor.authorAbed, Amr S.en
dc.contributor.authorClancy, Thomas Charles IIIen
dc.contributor.authorLevy, David S.en
dc.contributor.departmentElectrical and Computer Engineeringen
dc.contributor.departmentComputer Scienceen
dc.contributor.departmentHume Center for National Security and Technologyen
dc.date.accessioned2017-11-17T16:11:23Zen
dc.date.available2017-11-17T16:11:23Zen
dc.date.issued2015-12-09en
dc.description.abstractLinux containers are gaining increasing traction in both individual and industrial use, and as these containers get integrated into mission-critical systems, real-time detection of malicious cyber attacks becomes a critical operational requirement. This paper introduces a real-time host-based intrusion detection system that can be used to passively detect malfeasance against applications within Linux containers running in a standalone or in a cloud multi-tenancy environment. The demonstrated intrusion detection system uses bags of system calls monitored from the host kernel for learning the behavior of an application running within a Linux container and determining anomalous container behavior. Performance of the approach using a database application was measured and results are discussed.en
dc.description.sponsorshipThis work was funded by Northrop Grumman Corporation via a partnership agreement through S2ERC; an NSF Industry/University Cooperative Research Center. We would like to express our appreciation to Donald Steiner and Joshua Shapiro for their support and collaboration efforts in this work.en
dc.format.mimetypeapplication/pdfen
dc.identifier.doihttps://doi.org/10.1007/978-3-319-24858-5_8en
dc.identifier.urihttp://hdl.handle.net/10919/80422en
dc.identifier.urlhttps://arxiv.org/abs/1611.03056en
dc.identifier.volume9331en
dc.language.isoenen
dc.publisherSpringeren
dc.rightsIn Copyrighten
dc.rights.urihttp://rightsstatements.org/vocab/InC/1.0/en
dc.subjectIntrusion Detectionen
dc.subjectAnomaly Detectionen
dc.subjectSystem Call Monitoringen
dc.subjectContainer Securityen
dc.subjectSecurity in Cloud Computingen
dc.titleIntrusion Detection System for Applications using Linux Containersen
dc.title.serialLecture Notes in Computer Scienceen
dc.typeArticle - Refereeden
dc.type.dcmitypeTexten

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
ClancyIntrusionDetectionSystem2016.pdf
Size:
363.53 KB
Format:
Adobe Portable Document Format
Description:
Download

Collections

Destination Area: Integrated Security (IS)
Scholarly Works, Computer Science
Scholarly Works, Electrical and Computer Engineering
Scholarly Works, Hume Center for National Security and Technology