Microservice Security Framework for IoT by Mimic Defense Mechanism

Abstract

Containers and microservices have become the most popular method for hosting IoT applications in cloud servers. However, one major security issue of this method is that if a container image contains software with security vulnerabilities, the associated microservices also become vulnerable at run-time. Existing works attempted to reduce this risk with vulnerability-scanning tools. They, however, demand an up-to-date database and may not work with unpublished vulnerabilities. In this paper, we propose a novel system to strengthen container security from unknown attack using the mimic defense framework. Specifically, we constructed a resource pool with variant images and observe the inconsistency in execution results, from which we can identify potential vulnerabilities. To avoid continuous attack, we created a graph-based scheduling strategy to maximize the randomness and heterogeneity of the images used to replace the current images. We implemented a prototype using Kubernetes. Experimental results show that our framework makes hackers have to send 54.9% more random requests to complete the attack and increases the defence success rate by around 8.16% over the baseline framework to avoid the continuous unknown attacks.

Real-Time Monitoring and Management of Hardware and Software Resources in Heterogeneous Computer Networks through an Integrated System Architecture

“…Thus, the incorrectly patched software containers may determine vulnerable microservices. Ying et al [46] proposed a system to enhance container-side security models, which concern unknown attack patterns related to a "mimic defence network". Thus, a set of resources regarding attack pattern images was created.…”

Relevant Cybersecurity Aspects of IoT Microservices Architectures Deployed over Next-Generation Mobile Networks

“…Although some existing contributions aim to reduce the implied security risks using vulnerability detection tools, outdated databases prevent a proper detection process to occur on newly published vulnerabilities. The research work reported in [ 47 ] describes a system intended to enhance container-side security models, which targets unknown attack patterns using a "mimic defence network". More precisely, a resource pool that contains attack pattern images is built.…”

Toward deceiving the intrusion attacks in containerized cloud environment using virtual private cloud‐based moving target defense

“…Mimic defense 24 The scheme is based on the cloud with a container environment using Kubernetes native environment.…”

“…Similarly, it is displayed that proxy servers can be focused on specific proxy‐related attacks, that is, proxy harvesting, which needs nonstop remapping to interrupt the attacks 23 . The authors in Reference 24 proposed a mechanism for the enhancement of microservices security using the mimic defensive framework based on the MTD mechanism. They created a resource pool with different images and observed the inconsistency in the execution outcomes.…”