Proactive Kubernetes Security: Anomaly Detection and Runtime Alertin...
summary
A proof‑of‑concept called KubeCop proof-of-concept inside Kubescape uses an eBPF profiler to build 24‑hour application profiles (demo uses 2 minutes) and enforces anomaly detection plus custom behavioral rules; it flags unexpected processes, service‑account token reads, downloaded kubectl binaries and permission changes, and forwards correlated alerts to Alertmanager output. An integrated ClamAV scan with a custom signature DB runs as an option and reveals a format‑string weakness during testing. Results show practical detection with far fewer false positives.
AI-written summary · about
chapters (17)
- 0:00Proactive Kubernetes security intro
- 1:05Talk agenda
- 5:19Runtime anomaly detection challenges
- 9:11Cube Escape’s app profiling
- 13:25Cube Escape architecture
- 14:28Demo setup with vulnerable app
- 18:59App profile learning period
- 21:27App profile structure
- 22:50Hacking demo app detection
- 27:50Runtime alerting value
- 28:10Antivirus scanning integration
- 30:18ClamAV CVE discovery
- 32:29Security tooling best practices
- 33:34GitOps for app profiles
- 34:59Access pattern handling
- 35:40Updating app profiles
- 36:33Profiles by workload vs image
related talks
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
02h 42mSecuring Your On-Premise Kubernetes Cluster from Scratch
24mRuntime Security: Challenges & Solution Space
38mOpen Source Security Tools for Kubernetes Applications
43mKubernetes Security: Attacking and Defending Modern Infrastructure
35mKubernetes Security - Challenge and Opportunity?
21mNext-Gen K8s Threat Hunting: GenAI & eBPF
26mMulti-layer hardening in Kubernetes