基于注意力机制和多尺度卷积神经网络的容器异常检测OA北大核心
Container Anomaly Detection Based on Attention Mechanism and Multi-scale Convolutional Neural Network
容器因为其轻量、灵活和便干部署等优点被广泛使用,成为云计算不可或缺的技术,但也因为其共享内核、相对虚拟机更弱的资源隔离的特性受到安全性方面的担忧.基于注意力机制和卷积神经网络提出一种基于系统调用序列的容器内进程异常检测方法,使用容器进程运行产生的数据对进程行为进行异常分析判断.在公开数据集和模拟攻击场景下的实验结果表明,该方法能检测出容器内进程行为的异常,并且在精确率、准确率等指标上高于随机森林、LSTM等对比方法.
Containers are widely used in cloud computing due to their lightweight,flexibility,and ease of deployment,making them an indispensable technology.However,they also face security concerns due to their shared kernel and weaker resource isolation compared to virtual machines.Based on attention mechanism and convolutional neural network,this paper proposes a method of process anomaly detection in container based on system call sequence,which uses the data generated by container process operation to analyze and judge the abnormal behavior of process.The experimental results on public datasets and simulated attack scenarios show that this method can detect anomalies in the behavior of processes within containers,and is higher in accuracy and precision than comparison methods such as random forest and LSTM.
李为;袁泽坤;吴克河;程瑞
华北电力大学控制与计算机工程学院 北京 102206华北电力大学控制与计算机工程学院 北京 102206华北电力大学控制与计算机工程学院 北京 102206华北电力大学控制与计算机工程学院 北京 102206
计算机与自动化
系统调用容器异常检测深度学习注意力机制
system callcontaineranomaly detectiondeep learningattention mechanism
《信息安全研究》 2025 (1)
35-42,8
国家重点研发计划项目(2020YFB0905900)
评论