BeaCon: Automatic Container Policy Generation using Environment-aware Dynamic Analysis

Haney Kang

doi:10.1016/j.cose.2025.104789

Return

BeaCon: Automatic Container Policy Generation using Environment-aware Dynamic Analysis

2025-12-05

PRE

DOI：10.1016/j.cose.2025.104789

Original

Original request for help

Save

Abstract

En 中文

• We design and implement BeaCon, a practical tool that automatically generates container policies compatible with Linux Seccomp and Capabilities. • We propose a novel approach for container policy generation based on emulated container environments to overcome the limitations of prior dynamic analysis techniques. We design efficient heuristics for environment exploration, an eBPF-based monitor to capture syscalls and capabilities, and security and functionality scores for intention-aware policy tuning. • We evaluate BeaCon on real-world Docker containers, demonstrating its ability to generate effective, low-overhead policies and to mitigate realistic kernel-level attacks more successfully than existing solutions.