## 6 Conclusions  
The developed work presented a framework comprising a reference architecture for the implementation of a HIDS focused on container platforms. The main contributions of this framework are highlighted as follows:  
* Remote collection of system calls from different nodes of a cluster of container orchestration, enabling collaborative learning of anomalies;
* Reduction of processing overhead caused by intrusion detection in the nodes of a container orchestration cluster through a HIDS architecture with distributed components;
* Scalable architecture implemented with free tools in an emulated corporate environment;
* Ability to build own datasets of system calls and possibility of sharing with the community;
* Generation of anomaly detection alerts in applications to support the SOC through the analysis of system calls;
* Data analysis through web interface containing datasets and indexed anomalies;
* Possibility of implementing different machine learning algorithms and approaches for detecting anomalies in system calls (frequency, sequence, arguments and other data) aiming at greater detection efficiency;
* Ability to integrate framework with other tools, improving collaborative security. Through experimentation with a public dataset of system calls it was possible to validate the feasibility of implementing and functioning the proposed framework with \begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline
**Attack** & **NPV** & **ACC** & **COV** & **PRE** & **TPR** & **FPR** & **F1** & **ROC** & **CI** \\ \hline Brute Force Login & 78.34\% & 84.18\% & 99.53\% & 99.06\% & 64.24\% & 0.47\% & 77.93\% & 81.88\% & 99\% \\ Remote Shell & 77.79\% & 88.94\% & 99.31\% & 99.49\% & 82.55\% & 0.69\% & 90.23\% & 90.33\% & 99\% \\ Meterpreter & 85.55\% & 91.44\% & 99.70\% & 99.64\% & 83.21\% & 0.30\% & 90.69\% & 91.46\% & 99\% \\ Malicious Script & 69.89\% & 86.74\% & 99.32\% & 99.63\% & 81.21\% & 0.68\% & 89.48\% & 90.26\% & 99\% \\ Docker Escape & 78.10\% & 95.48\% & 99.50\% & 99.90\% & 94.72\% & 0.50\% & 97.24\% & 97.11\% & 99\% \\ SQL Injection & 76.56\% & 76.60\% & 99.00\% & 77.76\% & 10.34\% & 1.00\% & 18.26\% & 54.67\% & 99\% \\ SQL Misbehavior & 60.12\% & 64.64\% & 99.77\% & 98.96\% & 24.63\% & 0.23\% & 39.44\% & 62.20\% & 99\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: All attack detection performance metrics obtained in this work. free tools in a functional architecture composed of five layers. Techniques and approaches used in state-of-the-art studies in the field of research were studied and applied for the development of the framework. More than the theoretical proposition of a framework, the main objective of this work was to guarantee the real functioning of an architecture and integration between its tools, for this reason, the topology emulated in the software GNS3 containing a functional environment. The results obtained by this work for seven different attacks achieved values equal to or greater than 99% for the COV metric and less than or equal to 1% for the FPR. Also, 80.95% of all metrics collected surpassed the performance of the study that originated the dataset with model SFN-opt. The unsupervised machine learning approach achieved promising performance, demonstrating to be an alternative to supervised techniques. The possibility of visualizing datasets through an analytical graphical interface is a differential of the framework, facilitating the understanding and analysis of data through filtering, aggregation, searches, and other functionalities that can contribute to the activities of experts and improvement of detection methods. Additionally, through the analysis of detected anomaly alerts, the SOC team will be provided with additional information about the security of containerized environments for correlation with data from other tools and support in decision-making and response. Regarding the machine learning algorithms and anomaly detection, many optimizations can be performed in a universe of parameters and possible fine-tuning.