Insight from a Docker Container Introspection

Abstract

Large-scale adoption of virtual containers has stimulated concerns by practitioners and academics about the viability of data acquisition and reliability due to the decreasing window to gather relevant data points. These concerns prompted the idea that introspection tools, which are able to acquire data from a system as it is running, can be utilized as both an early warning system to protect that system and as a data capture system that collects data that would be valuable from a digital forensic perspective. An exploratory case study was conducted utilizing a Docker engine and Prometheus as the introspection tool. The research contribution of this research is twofold. First, it provides empirical support for the idea that introspection tools can be utilized to ascertain differences between pristine and infected containers. Second, it provides the ground work for future research conducting an analysis of large-scale containerized applications in a virtual cloud.

Insight from a Containerized Kubernetes Workload Introspection

“…Watts et. al [25] also examined containers, but that research was focused on detecting malware through introspection tools. The researchers introduced a known piece of malware to an Apache server container and ran a series of tests to determine what differences, if any, appeared in the metrics that the introspection tool Prometheus produced.…”

Container and VM Visualization for Rapid Forensic Analysis

“…Both containers and virtual machines provide a means for software isolation, and are an essential components of any cloud based-environment. With containers, the abstraction is performed at the operating system level [4]. Multiple containers can share a single host operating system.…”

“…The introspective approach consists of a family of techniques which uses introspection in order to gain insights into the processes being executed within [13]. Although this approach was originally developed for virtual machines, parallel techniques and tools can be used within the container space as well [4]. Introspection techniques monitor the runtime processes and applications currently running in a virtual machine or container.…”

Network Attack Detection Using an Unsupervised Machine Learning Algorithm

“…The rise in internet users appears to correlate with an escalation in cyber-crimes, which creates a risk for the organization's information security [2]. Detecting and responding to security incidents interest both industry and academicians [3][4][5][6]. According to a report by Forrester's, government, retail, and technology industries constituted 95% of the breached records in 2016, which included personal identifying information [7].…”