Real-time multi-class threat detection and adaptive deception in Kubernetes environments.

Area of Science:

• Cybersecurity
• Cloud Computing
• Machine Learning

Background:

• Kubernetes is crucial for cloud-native applications but vulnerable to cyber threats like privilege escalation and DoS attacks.
• Existing security measures struggle to keep pace with the dynamic nature of Kubernetes environments.
• There is a need for proactive and adaptive security solutions to protect containerized applications.

Purpose of the Study:

• To present a novel framework enhancing Kubernetes security through real-time threat detection and adaptive deception.
• To integrate machine learning for multi-class threat classification and dynamic decoy deployment.
• To evaluate the framework's effectiveness in mitigating threats and maintaining system resilience.

Main Methods:

• Integration of KServe for scalable machine learning threat classification.
• Utilization of CICFlowMeter for network traffic feature extraction.
• Implementation of KubeDeceive for dynamic decoy deployment, managed by the MAPE-K control loop.

Main Results:

• Achieved high threat detection accuracy, reaching up to 91%.
• Demonstrated efficient resource utilization and effective attacker engagement, with decoy success rates up to 93%.
• Provided actionable intelligence for proactive threat mitigation.

Conclusions:

• The proposed framework offers a scalable and adaptable defense mechanism for Kubernetes.
• It effectively enhances the security and resilience of dynamic cloud infrastructures.
• The unified approach of detection and deception provides a robust solution against sophisticated cyber threats.