title: ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ° Ð² Kubernetes-Ð¾ÐºÑÑÐ¶ÐµÐ½Ð¸Ð¸ Ð¼ÐµÑÐ¾Ð´Ð¾Ð¼ Ð¾Ð±Ð¼Ð°Ð½Ð°
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Detecting an intruder in a Kubernetes environment by deception
Creators: name: ÐÐµÐ½Ð¸ÑÐ¾Ð², ÐÐ¸ÐºÑÐ¾Ñ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2025
Subjects: kubernetes
Ð»Ð¾Ð²ÑÑÐºÐ¸
ebpf
Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ¸
traps
attackers

description: Ð¦ÐµÐ»Ñ ÑÐ°Ð±Ð¾ÑÑ â Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÐµÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ¾Ð² ÑÐµÑÐµÐ· Ð°Ð½Ð°Ð»Ð¸Ð· Ð¾Ð±ÑÐ°ÑÐµÐ½Ð¸Ð¹ Ðº Ð»Ð¾Ð²ÑÑÐºÐ°Ð¼ Ð² Kubernetes. ÐÑÐµÐ´Ð¼ÐµÑ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ â ÑÐµÑÐµÐ½Ð¸Ðµ Ð´Ð»Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ¾Ð² ÑÐµÑÐµÐ· Ð°Ð½Ð°Ð»Ð¸Ð· Ð¾Ð±ÑÐ°ÑÐµÐ½Ð¸Ð¹ Ðº Ð»Ð¾Ð²ÑÑÐºÐ°Ð¼ Ð² Kubernetes-Ð¾ÐºÑÑÐ¶ÐµÐ½Ð¸Ð¸. ÐÐ°Ð´Ð°ÑÐ¸ ÑÐ°Ð±Ð¾ÑÑ: 1. Ð¡Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°ÑÑ Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÑ ÑÐ¸ÑÑÐµÐ¼Ñ Ñ ÑÑÐµÑÐ¾Ð¼ ÑÑÐµÐ±Ð¾Ð²Ð°Ð½Ð¸Ð¹ Ðº Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³Ñ ÑÐµÑÐµÐ²Ð¾Ð³Ð¾ ÑÑÐ°ÑÐ¸ÐºÐ°. 2. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð°Ð³ÐµÐ½ÑÐ° Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐµÑÐµÐ²Ð¾Ð³Ð¾ ÑÑÐ°ÑÐ¸ÐºÐ° Ð½Ð° Ð½Ð¾Ð´Ðµ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ eBPF, Ð¾Ð±ÐµÑÐ¿ÐµÑÐ¸Ð²Ð°ÑÑÐµÐ³Ð¾ ÑÐ¸ÐºÑÐ°ÑÐ¸Ñ Ð¸ÑÑÐ¾Ð´ÑÑÐ¸Ñ Ð·Ð°Ð¿ÑÐ¾ÑÐ¾Ð² Ð² ÑÑÐ¾ÑÐ¾Ð½Ñ Ð»Ð¾Ð²ÑÑÐµÐº. 3. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°ÑÑ ÑÑÐ°Ð½ÐµÐ½Ð¸Ðµ Ð¸ Ð¾Ð±Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ðµ Ð´Ð°Ð½Ð½ÑÑ Ð¾ Ð¿Ð¾Ð´Ð°Ñ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Kubernetes API Ð´Ð»Ñ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð¸Ñ Ð°ÐºÑÑÐ°Ð»ÑÐ½Ð¾Ð¹ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¸ Ð¾ Ð¿Ð¾Ð´Ð°Ñ Ð½Ð° Ð½Ð¾Ð´Ðµ. 4. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°ÑÑ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¾Ð¿Ð¾Ð²ÐµÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐ²ÐµÐ´Ð¾Ð¼Ð»ÐµÐ½Ð¸Ñ Ð¾ Ð¿Ð¾Ð´Ð¾Ð·ÑÐ¸ÑÐµÐ»ÑÐ½Ð¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð² ÑÐµÑÐ¸, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½Ð¾Ð¹ Ðº Ð»Ð¾Ð²ÑÑÐºÐ°Ð¼. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð° Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÐ° Kubernetes-Ð¾ÐºÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¸ Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ñ Ð² Ð½ÐµÐ¼ ÑÐµÑÐµÐ²Ð¾Ð³Ð¾ Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¾ ÑÐ¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¾ ÑÐµÑÐµÐ½Ð¸Ðµ Ð´Ð»Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ¾Ð² ÑÐµÑÐµÐ· Ð°Ð½Ð°Ð»Ð¸Ð· Ð¾Ð±ÑÐ°ÑÐµÐ½Ð¸Ð¹ Ðº Ð»Ð¾Ð²ÑÑÐºÐ°Ð¼ Ð² Kubernetes. ÐÐ¾Ð»ÑÑÐµÐ½Ð½Ð¾Ðµ ÑÐµÑÐµÐ½Ð¸Ðµ Ð¿Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ¾Ð² Ð¼ÐµÑÐ¾Ð´Ð¾Ð¼ Ð¾Ð±Ð¼Ð°Ð½Ð° Ð¼Ð¾Ð¶ÐµÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¾ Ð² ÐºÐ»Ð°ÑÑÐµÑÐµ Kubernetes Ð´Ð»Ñ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ñ ÑÑÐ¾Ð²Ð½Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸.
description: The purpose of the work is to design a solution for automatic detection of intruders through the analysis of trap requests in Kubernetes. The subject of the research is a solution for automatic detection of intruders through the analysis of trap calls in the Kubernetes environment. Work objectives: 1. Design the architecture of the system taking into account the requirements for monitoring network traffic. 2. Develop an agent for analyzing network traffic on the node using eBPF, which ensures that outgoing requests are fixed towards traps. 3. Implement storage and updating of pod data using the Kubernetes API to get up-to-date pod information on the node. 4. Implement an alert system for prompt notification of suspicious network activity directed to traps. In the course of the work, the architecture of the Kubernetes environment and the organization of network interaction in it were investigated. As a result of the work, a solution was designed for automatic detection of intruders through the analysis of trap requests in Kubernetes. The resulting deception detection solution can be used in a Kubernetes cluster to increase security.