Protect Containerized Applications With System Call Profiling
summary
Claim: automated static analysis of container images and Dockerfiles produces accurate system call profiles used at runtime that detect deviations and block malicious behavior. Implementation uses Linux features like seccomp and AppArmor, plus image-layer parsing and optional strace-based tracing for custom binaries. Measured overhead is about 5–8% performance impact, and a Node.js microservice demo shows nonintrusive anomaly detection with low false positives.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:18Agenda
- 2:12What is Container
- 3:48Container vs VMS
- 5:48Darker
- 8:43Darker Hub
- 11:12Security Challenges
- 13:42AppArmor
- 14:54Circum
- 16:33Container Threat Model
- 16:49Assumptions
- 17:47Remote Attacks
- 19:46Container Attacks
- 25:17Container Characteristics
- 26:36Darken File
- 29:24Console Log
- 29:35RightToLog
- 30:08Demo
- 34:41Key Control System Call
- 36:10Performance Hit
- 37:55Performance Hit 2
- 38:52Application Types
- 41:20Static Analysis
- 43:13Challenges
- 45:35Practical Considerations
- 46:18Value of Twister
- 47:10Questions
related talks
31mAutomatic application hardening by leveraging container runtime behavior analysis
50mThe state of container security
39mCustom seccomp Profiles with Inspektor Gadget
43mThe Power of Application Intent Analysis for Container Security [I]
32mListen to your Engine
20mGenerate seccomp profiles for containers using bpf
34mHow secure are Docker containers?
41mIdentifying and Mitigating Cloud and Container Threats