.png){kind=icon}
返回
Optimus: association-based dynamic system call filtering for container attack surface reduction
.png){kind=icon}
OA
AI
DOI：10.1186/s13677-024-00639-3.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
While container adoption has witnessed significant growth in facilitating the operation of large-scale applications, this increased attention has also attracted adversaries who exploit numerous vulnerabilities present in contemporary containers. Unfortunately, existing security solutions largely overlooked the need to restrict container access to the shared host kernel, particularly exhibiting critical limitations in enforcing the least privilege for containers during runtime. Hence, we propose Optimus, an automated and comprehensive system that confines container operations and governs their interactions with the host kernel using an association-based system call filtering. Optimus efficiently identifies the essential system calls required by containers and enhances their security posture by dynamically enforcing the minimal set of system calls for each container during runtime. This is achieved through (1) lightweight system call monitoring leveraging eBPF, (2) system call validation via association analysis, and (3) dynamic system call filtering by adopting covert container renewal. Our evaluation shows that Optimus effectively minimizes the necessary system calls for containers while maintaining their serviceability and operational efficiency during runtime.
Keyword:
Container security
Association analysis
System call
eBPF
Seccomp
期刊
J
IF:
4.3
论文数:
756
被引数:
2.2K
机构
暂无机构信息
引用论文
.png){kind=icon}
Stochastic static fault slip inversion from geodetic data with non-negativity and bound constraints具有非负性和约束约束的大地测量数据的随机静态断层滑动反演
OAAI
OAAI分享收藏分享收藏
查看更多内容