A Container-Oriented Virtual-Machine-Introspection-Based Security Monitor to Secure Containers in Cloud Computing

Abstract

In recent years, container technology has been widely used in cloud computing, so the security monitoring technology for containers has also received widespread attention. To enhance the isolation of containers, cloud service providers usually run containers in different virtual machines. In this environment, in-container security tools can be detected or attacked by in-container attackers, and in-VM security tools face the risk of container escape attacks. This paper proposes a container-oriented virtual machine introspection technology to secure containers in cloud computing. It runs in cloud hypervisor and analyzes in-VM containers, so it is more secure and transparent. Even though there is container escaping to the operating system of VM, the security monitors are secure. Firstly, our approach automatically identifies the namespace and container processes in the virtual machine from outside by using virtual machine introspection technology. Secondly, security analysis is performed on processes belonging to different containers in the virtual machine, and our system can perform real-time abnormal response based on the analysis results. Finally, our system can monitor container escape behaviors from outside. Experimental results show that the approach proposed in this paper can automatically perform security analysis for different containers, and can monitor container escape behaviors with acceptable overhead.