## 6 Conclusions  
We introduce an unsupervised method for generating containerized edge-cloud system call filtering rules. This method, based on cluster templates and sequence pattern mining, obtains multi-level filtering rules to strike a balance between filtering performance and effectiveness. This enables the anomaly-detection method to filter out substantial irrelevant information while retaining suspicious or high-risk sequences for subsequent analysis. Furthermore, these rules support online analysis and hot updates, allowing the method to dynamically adapt to environmental changes while avoiding rule contamination issues. These characteristics meet the requirements of anomaly detection in containerized edge-cloud environments. The experiment shows that our filtering rules can significantly reduce the number of system calls that need to be handled by the anomaly-detection model, remaining only 13% of the original system calls, which reduces the cost of computing resources. We propose Syscall2 vec, a method for embedding parameterized container system call sequences, along with an anomaly-detection model. This method embeds system call sequences based on automatically discovered templates and feeds them into a deep learning model for secondary analysis of unfiltered sequences. The approach enhances anomaly-detection accuracy while reducing false positives. Through random masking, the model improves robustness and enables rapid root cause analysis via per-parameter anomaly scores. The experiment shows that with the combination of Syscall2 vec and our anomaly-detection model, our method improves the F1 score by 23.88% and 41.31%, respectively, compared to HIDS and LSTM-VAE, two representative methods in this field, in the experiment scenarios of this work. Along with the case study and the ablation study, we believe our method shows powerful capabilities in utilizing system calls for anomaly detection with less resource overhead. We construct a dataset based on modern containerized cloud microservices as an experimental background. We validate the applicability of traditional anomaly-detection methods that consider only system call types in this context. We also compare the detection performance under different parameters. **Future works. ** We consider adding the payload of certain system calls (read, write, etc.) as additional features for container anomaly detection to capture a broader range of anomalous behaviors. Additionally, we plan to explore the use of large language models (LLMs) to enhance the interpretability of the detection results. Apart from that, we intend \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Window Size**} & \multicolumn{4}{c}{**U-SCAD with Params**} & \multicolumn{4}{c}{**U-SCAD Without Params**} \\ \cline{2-9}  & **P** & **R** & **F1** & **FPR** & **P** & **R** & **F1** & **FPR** \\ \hline
64 & 0.629 & 1.000 & 0.772 & 0.020 & 0.579 & 0.819 & 0.679 & 0.019 \\
128 & 0.774 & 1.000 & 0.873 & 0.011 & 0.677 & 0.843 & 0.751 & 0.013 \\
256 & 0.914 & 0.978 & 0.944 & 0.014 & 0.802 & 0.822 & 0.779 & 0.031 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Anomaly classification results in different window sizes. to perform evaluations in high-load environments on larger-scale clusters, such as by increasing the number of Kubernetes nodes and the rate of active containers per second, to better assess the scalability and performance of our system under realistic scenarios. We also intend to evaluate our method with other existing methods in a wider range of experiment scenarios and datasets. Conceptualization, J.Y. and M.Y. ; Methodology, J.Y., M.Y. and S.W. ; Software, S.W. ; Validation, S.W. ; Resources, J.Y. and M.Y. ; Data curation, S.W. and J.T. ; Writing--original draft, J.Y., S.W. and M.Y. ; Writing--review and editing, J.W., J.Y. and J.T. ; Visualization, S.W. and J.T. ; Supervision, J.W. and M.Y. All authors have read and agreed to the published version of the manuscript.