容器的安全跨空间内核审计
Secure Namespaced Kernel Audit for Containers
摘要：
尽管基于容器的云计算被广泛使用，但用于安全分析的容器审计主要依赖于内置的主机审计系统，该系统通常缺乏捕获高保真容器日志的能力。最先进的基于引用监视器的审计技术极大地提高了审计日志的质量，但是它们的系统范围架构太昂贵，无法适应单个容器。此外，这些技术通常需要大量的内核修改，使得它们难以在实际环境中部署。在本文中，我们提出了saBPF（安全审计BPF），扩展的eBPF框架能够部署安全的系统级审计机制，在容器的粒度。我们通过设计一个审计框架、一个入侵检测系统和一个轻量级的访问控制机制来证明saBPF在Kubernetes中的实用性。我们评估saBPF，并表明它是可比的性能和安全保证审计系统从文献中直接实现在内核中。
英文摘要：
Despite the wide usage of container-based cloud computing, container auditing for security analysis relies mostly on built-in host audit systems, which often lack the ability to capture high-fidelity container logs. State-of-the-art reference-monitor-based audit techniques greatly improve the quality of audit logs, but their system-wide architecture is too costly to be adapted for individual containers. Moreover, these techniques typically require extensive kernel modifications, making them difficult to deploy in practical settings. In this paper, we present saBPF (secure audit BPF), an extension of the eBPF framework capable of deploying secure system-level audit mechanisms at the container granularity. We demonstrate the practicality of saBPF in Kubernetes by designing an audit framework, an intrusion detection system, and a lightweight access control mechanism. We evaluate saBPF and show that it is comparable in performance and security guarantees to audit systems from the literature that are implemented directly in the kernel.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
