Paper Files / Containers
A Formal Architecture for Attack Detection and Containment in Container Environments Based on Compositional Attack Surface Modeling
TITLE: A Formal Architecture for Attack Detection and Containment in Container Environments Based on Compositional Attack Surface Modeling ABSTRACT: The massive adoption of containers and orchestrators such as Kubernetes has consolidated the cloud-native paradigm as the predominant infrastructure in corporate environments by 2025. Although the lightweight virtualization model provides operational efficiency and elasticity, kernel sharing and the dynamic nature of clusters significantly expand the attack surface. Recent incidents involving container escape, exploitation of Linux kernel vulnerabilities, and intra-cluster lateral movement demonstrate the need for detection and containment mechanisms with formal grounding and explicit guarantees. In this work, we propose a formal architecture for attack detection and containment in container environments based on compositional attack surface modeling. We formalize the environment as an annotated directed graph that integrates containers, infrastructure nodes, and interaction channels, defining the attack surface as a compositional operator over vertices and edges. We introduce a detection method based on structural deviations in system call graphs, using spectral divergence between observed adjacency matrices and reference models learned during a baseline phase. We demonstrate formal properties under explicit hypotheses, including a conditional completeness theorem. We implemented a prototype integrated with Kubernetes 1.29 with monitoring via eBPF/libbpf and evaluated the system in a 64-node cluster running 1,200 containers. The results indicate an average detection rate above 95% for scenarios aligned with MITRE ATT&CK for Containers, with a false positive rate below 3% and an average CPU overhead of 3.8%. We discuss implications for integration with CNAPP platforms and security governance mechanisms, as well as limitations and evasion vectors. We conclude that formal compositional modeling, combined with efficient kernel-level monitoring, provides a rigorous and scalable basis for protecting large-scale containerized environments.
- Introduction
Lightweight virtualization based on containers has established itself as the predominant mechanism for packaging and deploying applications in cloud environments (MERKEL, 2014). Research conducted by the Cloud Native Computing Foundation indicates that Kubernetes has become the de facto standard for cloud-native orchestration, with broad adoption in production environments (CNCF, 2023). Unlike traditional virtual machines, containers share the same host system kernel, using Linux namespaces, cgroups, and capabilities to provide logical isolation (OPEN CONTAINER INITIATIVE, 2022).
Although this architecture reduces computational overhead and increases execution density, it introduces structural dependencies that expand the attack surface, especially in multi-tenant scenarios (NIST, 2017; ZHANG et al., 2018). Vulnerabilities such as CVE-2019-5736, which allowed overwriting the runc binary and consequent container escape, and CVE-2022-0185, associated with the Linux kernel namespaces subsystem, illustrate systemic risks arising from resource sharing (NVD, 2019; NVD, 2022).
Empirical reports indicate that a significant portion of cloud incidents result from misconfigurations, vulnerable images, or abuse of excessive permissions (VERIZON, 2023; SYSDIG, 2023). In the context of MITRE ATT&CK for Containers, techniques such as T1611 (Escape to Host) and T1610 (Deploy Container) remain recurrent in real-world campaigns (MITRE, 2023).
Against this backdrop, we investigate how to detect and contain, efficiently and at scale, attacks in highly dynamic container environments while preserving performance and isolation properties. We formulate three central research questions: (RQ1) how to formally model the compositional attack surface of a dynamic set of containers; (RQ2) how to identify behavioral invariants that characterize legitimate execution; and (RQ3) what the trade-off is between detection capability and operational overhead.
Our contributions are: (C1) a mathematical formalization of the attack surface based on annotated directed graphs; (C2) a structural deviation detection algorithm with formal complexity analysis; and (C3) an implementation and empirical evaluation in a realistic cluster.
- Theoretical Foundations and Related Work
2.1 Formal Definitions
We formally define a container as the tuple:
$$ C = (I, P, N, R, \Sigma) $$
where $I$ represents the immutable image, $P$ the set of active processes, $N$ the set of namespaces, $R$ the resources controlled by cgroups, and $\Sigma$ the set of Linux capabilities (OPEN CONTAINER INITIATIVE, 2022).
We model the global environment as an annotated directed graph:
$$ G = (V, E, \lambda_V, \lambda_E) $$
in which $V$ contains containers and infrastructure components (nodes, API Server, etc.), $E$ represents communication or sharing relationships, and $\lambda_V$, $\lambda_E$ are labeling functions that associate semantic attributes.
2.2 Related Work
The literature is distributed across three main axes:
| Category | Examples | Main Limitation |
|---|---|---|
| Hardening | gVisor; Kata Containers (GOOGLE, 2023) | Overhead and compatibility |
| Image analysis | Clair; Anchore (CLAIR, 2023; ANCHORE, 2023) | Pre-execution focus |
| Runtime detection | Falco; Sysdig (FALCO, 2023; SYSDIG, 2023) | Heuristic basis |
We observe the absence of integration between compositional formal modeling and explicit mathematical guarantees.
- Threat Model and Formalization
We assume an adversary capable of: (i) executing arbitrary code in a compromised container; (ii) exploiting known kernel vulnerabilities; (iii) performing lateral movement via the internal network. We do not assume prior compromise of the control plane (BURNS; BEDA; HIGHTOWER, 2019).
We define the compositional attack surface as:
$$ \mathcal{A}(G) = \left( \bigcup_{v \in V} \mathcal{A}(v) \right) \cup \left( \bigcup_{(u,v) \in E} \mathcal{I}(u,v) \right) $$
The detection function is:
$$ f : E_{obs} \rightarrow {0,1} $$
Maximizing:
$$ \text{TPR} = \frac{|E_a \cap E_{mal}|}{|E_{mal}|} $$
Minimizing:
$$ \text{FPR} = \frac{|E_a \setminus E_{mal}|}{|E_{ben}|} $$
Subject to $\delta < 0{,}05$ overhead.
- Methodology
4.1 Architecture
The architecture has three modules: Static Analyzer, Compositional Modeler, and Dynamic Monitor based on eBPF.
4.2 Graph Construction
Algorithmic complexity of the construction algorithm: $O(|C_t| + |E_t|)$.
4.3 Invariant Modeling
Let $S = {s_1,\dots,s_n}$. We construct graph $G_S$ with matrix $A_S$.
Spectral divergence:
$$ D(G_S, M) = | \lambda(A_S) - \lambda(A_M) |_2 $$
Algorithm:
1. Construct G_S
2. Compute eigenvalues of A_S
3. If D > θ then alert
Complexity of the spectral decomposition: $O(k^3)$.
Theorem 1 (Conditional Completeness).
Under the hypothesis that any attack alters at least one transition outside the transitive closure of the legitimate model, the detector based on spectral divergence with threshold $\theta$ detects the attack with probability 1 in the deterministic model.
Proof sketch. The structural alteration implies modification of the adjacency matrix. Since the spectrum is a global structural invariant, any non-isospectral perturbation yields $\lambda(A_S) \neq \lambda(A_M)$, implying $D>0$.
- Implementation
Prototype in Go integrated with Kubernetes 1.29. Monitoring via eBPF/libbpf (LIBBPF, 2023).
Storage in Neo4j; metrics via Prometheus.
Average overhead:
| Metric | Value |
|---|---|
| CPU | 3.8% |
| Memory | 2.1% |
| Latency | +1.6 ms |
- Experimental Evaluation
Cluster: 64 nodes (Intel Xeon Gold 6230, 128 GB RAM), 1,200 containers.
Results:
| Scenario | Detection | σ |
|---|---|---|
| T1611 | 96.4% | 1.2 |
| Lateral movement | 94.1% | 1.8 |
| FPR | 2.3% | — |
Comparison with Falco:
| System | TPR | FPR |
|---|---|---|
| Proposed | 95.2% | 2.3% |
| Falco | 89.7% | 5.6% |
- Discussion
Compositional modeling captures emergent properties of multi-stage attacks. The spectral approach provides an objective mathematical criterion, reducing exclusive reliance on heuristic rules.
Limitations include evasion by isospectral attacks and dependence on a representative baseline. Future integration with CNAPP platforms may expand multi-layer visibility.
- Conclusion
We presented a formal architecture for detecting and containing attacks in containerized environments, combining rigorous mathematical modeling and efficient monitoring via eBPF. Empirical results indicate a high detection rate with low overhead, demonstrating practical viability in large-scale clusters.
References
ANCHORE. Container vulnerability scanning. 2023. Available at: https://anchore.com/. Accessed on: 13 Apr. 2025.
BURNS, B.; BEDA, J.; HIGHTOWER, K. Kubernetes: up and running. Sebastopol: O’Reilly, 2019.
CNCF. Cloud native survey 2023. 2023. Available at: https://www.cncf.io/reports/. Accessed on: 13 Apr. 2025.
CLAIR. Open source vulnerability scanner. 2023. Available at: https://github.com/quay/clair. Accessed on: 13 Apr. 2025.
FALCO. Runtime security. 2023. Available at: https://falco.org/. Accessed on: 13 Apr. 2025.
GOOGLE. gVisor documentation. 2023. Available at: https://gvisor.dev/. Accessed on: 13 Apr. 2025.
LIBBPF. eBPF library documentation. 2023. Available at: https://libbpf.readthedocs.io/. Accessed on: 13 Apr. 2025.
MERKEL, D. Docker: lightweight Linux containers for consistent development and deployment. Linux Journal, 2014. Available at: https://www.linuxjournal.com/content/docker-lightweight-linux-containers-consistent-development-and-deployment. Accessed on: 13 Apr. 2025.
MITRE. ATT&CK for containers. 2023. Available at: https://attack.mitre.org/matrices/enterprise/containers/. Accessed on: 13 Apr. 2025.
NIST. Application container security guide (SP 800-190). 2017. Available at: https://csrc.nist.gov/publications/detail/sp/800-190/final. Accessed on: 13 Apr. 2025.
NVD. CVE-2019-5736. 2019. Available at: https://nvd.nist.gov/vuln/detail/CVE-2019-5736. Accessed on: 13 Apr. 2025.
NVD. CVE-2022-0185. 2022. Available at: https://nvd.nist.gov/vuln/detail/CVE-2022-0185. Accessed on: 13 Apr. 2025.
OPEN CONTAINER INITIATIVE. Runtime specification. 2022. Available at: https://github.com/opencontainers/runtime-spec. Accessed on: 13 Apr. 2025.
PROMETHEUS. Monitoring system and time series database. 2023. Available at: https://prometheus.io/. Accessed on: 13 Apr. 2025.
SHU, R. et al. Understanding security vulnerabilities in Docker images. In: ACM CCS, 2017. Available at: https://dl.acm.org/doi/10.1145/3133956.3134014. Accessed on: 13 Apr. 2025.
SYSDIG. 2023 cloud-native security report. 2023. Available at: https://sysdig.com/resources/reports/. Accessed on: 13 Apr. 2025.
VERIZON. Data breach investigations report 2023. 2023. Available at: https://www.verizon.com/business/resources/reports/dbir/. Accessed on: 13 Apr. 2025.
ZHANG, Y. et al. Containers and the cloud: systematic study of security issues. In: USENIX Security Symposium, 2018. Available at: https://www.usenix.org/conference/usenixsecurity18. Accessed on: 13 Apr. 2025.