.png){kind=icon}
.png){kind=icon}
Return
BeaCon: Automatic Container Policy Generation using Environment-aware Dynamic Analysis
.png){kind=icon}
PRE
AI
H
E
M
D
S
J
DOI：10.1016/j.cose.2025.104789.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
• We design and implement BeaCon, a practical tool that automatically generates container policies compatible with Linux Seccomp and Capabilities. • We propose a novel approach for container policy generation based on emulated container environments to overcome the limitations of prior dynamic analysis techniques. We design efficient heuristics for environment exploration, an eBPF-based monitor to capture syscalls and capabilities, and security and functionality scores for intention-aware policy tuning. • We evaluate BeaCon on real-world Docker containers, demonstrating its ability to generate effective, low-overhead policies and to mitigate realistic kernel-level attacks more successfully than existing solutions.
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W
Organization
Cited Papers