Container Anomaly Detection Using Neural Networks Analyzing System Calls

Container environments permeate all areas of computing, such as HPC, since they are lightweight, efficient, and ease the deployment of software. However, due to the shared host kernel, their isolation is considered to be weak, so additional protection mechanisms are needed. This paper shows that neural networks can be used to do anomaly detection by observing the behavior of containers through system call data. In more detail the detection of anomalies in file and directory paths used by system calls is evaluated to show their advantages and drawbacks.