## 2 Related Works
\begin{table}
\begin{tabular}{c l l} \hline \hline
**Related Work** & **Key Contributions** & **Limitations** \\ \hline
[17] & Describes a literature review of deep & The use of different datasets for training \\  & learning (DL) methods for cyber security & and testing did not allow for fair \\  & applications & comparison across all of the different approaches \\ \hline
[20] & Proposes a model for a real-time intrusion & The sequence of the system calls \\  & detection system (IDS) that can be used & are ignored (frequency based approach). \\  & to detect malicious applications running & Does not utilize machine learning models. \\  & in Docker containers & Existing systems need to leverage all \\ \hline
[21] & Proposes a detail study of intrusion detection, & available countermeasures discussed \\  & discussing popular attacks, examining & in their work and automate them \\  & problems associated with their detection and & as immediate responses in order to \\  & exploring possible solutions & minimize the continued damage that \\ \hline
[22] & Provides empirical evidence to identify the & Limited to assessing the effectiveness \\  & gap, and provide data useful for identifying & of methods for conducting intrusion \\  & and developing new and more effective & detection and analysis in Docker \\  & methods to secure application container & Linux application container networks \\ \hline
[23] & Introduces a real-time host-based intrusion & Applying the same workload to the \\  & detection system that can be used to & MySQL database may not generate the \\  & passively detect malfeasance against & exact same BoSCs, which is normally \\  & applications within Linux containers & expected by an instance-based technique \\ \hline
[24] & Prevents the results of using bags of system & Modify the algorithm to be more \\  & calls for learning the behavior of Linux & suitable for deployment in a real-time \\  & containers for use in anomaly-detection-based & intrusion detection system \\ \hline
[25] & Compares the performance of several machine & If the attacker knows the intrusion \\  & learning techniques far misuse detection and & detection mechanism, their approach \\  & show experimental results on & can be deceived by mimicry attacks \\  & anomaly detection & \\ \hline
[26] & Propose a machine learning based HDS & \\  & using the same ADFA-LD dataset that & Need to improve the model in detecting \\  & possesses the ability to perform early detection & real-time intrusion \\  & of intrusions & \\ \hline
[27] & Proposes a computation efficient HDS & Improve and fine tune various \\  & framework that initially transforms the system call & parameters of the proposed framework \\  & traces to n-gram vector representational model & to further enhance its performance \\ \hline
[28] & Proposed a Probabilistic real-time HDS for & Make possible the detection of other \\  & detecting malicious applications running in & attacks toward Docker containers, such \\  & Docker containers & as Container Breakout, Cross-site Request \\  & & Forgery, XSS injection, and \\  & detection of malware in the container \\ \hline
[29] & Proposes to use unsupervised introspection & \\  & tools to perform the non-intrusive & Necessity of an extension of features for \\  & monitoring, which leverages the system & detecting certain classes of anomalies \\  & call traces to classify the anomalies & \\ \hline
[32] & Present CDL, a classified distributed & Overcome the challenges of lacking \\  & learning framework to achieve efficient & sufficient training data for individual \\  & security attack detection for containerized applications & short-lived containers \\ \hline
[33] & Proposes a framework for implementing & \\  & a Host-based Intrusion Detection System & Ongoing research. Provides an initial \\  & (HIDS) by analyzing system calls with machine & version of a framework for a HIDS \\  & learning on a Kubernetes container & focused on containerized environments \\  & orchestration cluster & \\ \hline
[34] & Proposes KubAnomaly, a system that & Limitation in identifying container \\  & provides security monitoring capabilities & behavior as normal or abnormal, and \\  & for anomaly detection on the Kubernetes orchestration & runtime anomaly behavior detection \\  & platform & \\ \hline \hline \end{tabular}
\end{table}