title: ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² ÑÐ°Ð±Ð¾ÑÐµ docker-ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ° Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¼Ð°Ð³Ð¸ÑÑÑÐ°
titleType: Subtitle
title: Anomaly detection in the docker container runtime using machine learning approach
Creators: name: ÐÐ¸ÐºÑÐ»Ð¸ÑÐµÐ², ÐÐ¸ÐºÑÐ¾Ñ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2020
Subjects: ÐÐ°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ
ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÐµ ÑÐ¸ÑÑÐµÐ¼Ñ
Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹
ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ¸Ð·Ð°ÑÐ¸Ñ
Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
behavior analysis
anomaly detection
containerisation
machine learning

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² ÑÐ°Ð±Ð¾ÑÐµ docker-ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ° Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸ÑÂ». ÐÐ°Ð½Ð½Ð°Ñ Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÐµÐ¹ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼, Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð½ÑÑ Ð½Ð° Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÐµ ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Docker, Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ð¹ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð² Ð·Ð°Ð´Ð°ÑÐ°Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð¸ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ Ð¼ÐµÑÐ¾Ð´Ð° Ð´ÐµÑÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ð¸ docker-ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ° Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. ÐÐ°Ð´Ð°ÑÐ¸, ÐºÐ¾ÑÐ¾ÑÑÐµ ÑÐµÑÐ°Ð»Ð¸ÑÑ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÐ¾Ð²ÐµÑÑÐ¸ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÐµÑÐµÐ½Ð¸Ð¹, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ðµ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Docker-ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ¾Ð². 2. ÐÑÐ¾Ð²ÐµÑÑÐ¸ Ð°Ð½Ð°Ð»Ð¸Ð· Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÑ Ð¸ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÑ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð¾Ð² Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ docker-ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ¾Ð². 3. ÐÐ¿ÑÐµÐ´ÐµÐ»Ð¸ÑÑ ÑÐ¿ÐµÐºÑÑ ÑÐ³ÑÐ¾Ð·, ÑÐ°ÑÐ°ÐºÑÐµÑÐ½ÑÑ Ð´Ð»Ñ ÑÐ¸ÑÑÐµÐ¼ Ð½Ð° Ð±Ð°Ð·Ðµ docker- ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ¾Ð². 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¼ÐµÑÐ¾Ð´ Ð´ÐµÑÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ð¸ docker- ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°. 5. ÐÑÐ¾Ð²ÐµÑÑÐ¸ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½Ð¾Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð°. 6. ÐÑÐ¾Ð²ÐµÑÑÐ¸ ÑÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð° Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ð¼Ð¸ ÑÐµÑÐµÐ½Ð¸ÑÐ¼Ð¸. Ð Ð°Ð±Ð¾ÑÐ° Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð° Ð½Ð° Ð±Ð°Ð·Ðµ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑÐ°. Ð ÑÐ°Ð¼ÐºÐ°Ñ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½ Ð°Ð½Ð°Ð»Ð¸Ð· Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÑ ÑÐ¸ÑÑÐµÐ¼, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ¸Ñ Docker, Ð¸ ÑÐ°ÑÐ°ÐºÑÐµÑÐ½ÑÑ Ð´Ð»Ñ ÑÐ°ÐºÐ¸Ñ ÑÐ¸ÑÑÐµÐ¼ ÑÐ³ÑÐ¾Ð· Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð° ÑÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½Ð°Ñ Ð¾ÑÐµÐ½ÐºÐ° Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹, Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½ Ð¿Ð¾Ð´ÑÐ¾Ð´ Ðº Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ð¸ ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ° Ð² ÑÐ¾Ð¾ÑÐ²ÐµÑÑÑÐ²Ð¸Ð¸ Ñ Ð²ÑÐ´ÐµÐ»ÐµÐ½Ð½Ð¾Ð¹ Ð¼Ð¾Ð´ÐµÐ»ÑÑ ÑÐ³ÑÐ¾Ð·, Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½ÑÐ¹ Ð¿Ð¾Ð´ÑÐ¾Ð´ ÑÐ¾Ð¿Ð¾ÑÑÐ°Ð²Ð»ÐµÐ½ Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ð¼Ð¸ ÑÐµÑÐµÐ½Ð¸ÑÐ¼Ð¸ Ð² ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¸ ÑÐºÐ¾ÑÐ¾ÑÑÐ¸ ÑÐ°Ð±Ð¾ÑÑ. ÐÐ½Ð°Ð»Ð¸Ð· Ð¿ÑÐ¾Ð²Ð¾Ð´Ð¸Ð»ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð¼ Ð±Ð¸Ð±Ð»Ð¸Ð¾Ð³ÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð»Ð¸ÑÐµÑÐ°ÑÑÑÑ Ð¸ Ð¼Ð°ÑÐµÑÐ¸Ð°Ð»Ð¾Ð² ÑÐµÑÐ¸ ÐÐ½ÑÐµÑÐ½ÐµÑ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ ÑÐµÐ¾ÑÐ¸Ð¸ Ð¸Ð³Ñ Ð¸ Ð±ÐµÑÐ¿ÑÐ¾Ð²Ð¾Ð´Ð½ÑÑ Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¸Ñ ÑÐµÑÐµÐ¹. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° ÑÑÐ¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð° Ð¼Ð¾Ð´ÐµÐ»Ñ ÑÐ³ÑÐ¾Ð· Ð´Ð»Ñ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼, Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð½ÑÑ Ð½Ð° Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÐµ ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ¸Ð·Ð°ÑÐ¸Ð¸, Ð° ÑÐ°ÐºÐ¶Ðµ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¼ÐµÑÐ¾Ð´ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ð¸ docker-ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ° Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð¸ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ñ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½ÑÐµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¼ÐµÑÐ¾Ð´Ð° Ð½Ð° ÑÐ°ÑÑÐ½Ð¾Ð¼ Ð½Ð°Ð±Ð¾ÑÐµ Ð´Ð°Ð½Ð½ÑÑ.
description: The subject of the qualification work is "Anomaly detection in the docker container runtime using machine learning approach". The given work is devoted to the study of the security features of information systems built on the Docker containerization architecture, the study of behavioral analysis directions in the problems of anomaly detection and the suggestion of a method for detecting anomalies in the behavior of a docker container runtime using machine learning approach. The research set the following goals: 1. To analyze existing solutions aimed at ensuring the security of Docker containers. 2. To analyze the architecture and basic security mechanisms of docker containers. 3. Identify the range of threats specific to systems based on docker containers. 4. Develop a method for detecting anomalies in the behavior of the docker container. 5. Conduct an experimental study of the developed method. 6. Conduct a comparative analysis of the developed method with existing solutions. The work was fulfilled on the premises of the university. Within the framework of the work, an analysis was made of the architecture of systems using Docker and information security threats typical of such systems, a comparative assessment of machine learning methods aimed at detecting anomalies was made, an approach to detecting anomalies in the behavior of the container in accordance with the selected threat model was presented, and the proposed approach compared with existing solutions in terms of productivity and speed. The analysis was carried out by the method of bibliographic analysis of literature and materials on the Internet in the field of game theory and wireless dynamic networks. As a result of the work, a threat model was created for information systems built on the containerization architecture. A method was developed for detecting anomalies in the behavior of a docker container using machine learning methods. Experimental studies of the method were conducted on a private data set.