Containers are fundamental to pursue the vision of cloud-native applications and implement frameworks taking advantage of the microservice paradigm. Owing to their rapid diffusion, understanding the security posture of containerized deployments is of prime importance. An aspect largely neglected concerns network covert channels, which can be used to implement advanced persistent threats or ex-filtrate sensitive data. Unfortunately, revealing the presence of parasitic information hidden in network traffic is a hard task often clashing with privacy, performance and scalability constraints. Therefore, this paper proposes to use a mixture of experts, i.e., deep neural models trained on local datasets that are combined to enhance the overall detection capabilities. Results obtained by considering covert communications targeting the TTL field of IPv4 traffic collected in realistic settings demonstrated the effectiveness of our approach.

A Few to Unveil Them All: Leveraging Mixture of Experts on Minimal Data for Detecting Covert Channels in Containerized Cloud Infrastructures

Caviglione L.
Co-primo
;
Guarascio M.
Co-primo
;
Pisani F. S.
Co-primo
;
Zuppelli M.
Co-primo
2024

Abstract

Containers are fundamental to pursue the vision of cloud-native applications and implement frameworks taking advantage of the microservice paradigm. Owing to their rapid diffusion, understanding the security posture of containerized deployments is of prime importance. An aspect largely neglected concerns network covert channels, which can be used to implement advanced persistent threats or ex-filtrate sensitive data. Unfortunately, revealing the presence of parasitic information hidden in network traffic is a hard task often clashing with privacy, performance and scalability constraints. Therefore, this paper proposes to use a mixture of experts, i.e., deep neural models trained on local datasets that are combined to enhance the overall detection capabilities. Results obtained by considering covert communications targeting the TTL field of IPv4 traffic collected in realistic settings demonstrated the effectiveness of our approach.
2024
Istituto di Calcolo e Reti ad Alte Prestazioni - ICAR
Istituto di Matematica Applicata e Tecnologie Informatiche - IMATI - Sede Secondaria Genova
container security, covert channels, deep ensemble methods, Docker, mixture of experts
File in questo prodotto:
File Dimensione Formato  
2024_EuroS&PW.pdf

solo utenti autorizzati

Licenza: NON PUBBLICO - Accesso privato/ristretto
Dimensione 1.07 MB
Formato Adobe PDF
1.07 MB Adobe PDF   Visualizza/Apri   Richiedi una copia

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/20.500.14243/500061
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 0
  • ???jsp.display-item.citation.isi??? ND
social impact