Paper Files / Containers
A Formal Architecture for Detection and Containment of Attacks in Container Environments Based on Compositional Modeling of the Attack Surface
TITLE: A Formal Architecture for Detection and Containment of Attacks in Container Environments Based on Compositional Modeling of the Attack Surface ABSTRACT: The massive adoption of containers and orchestrators such as Kubernetes has consolidated the cloud-native paradigm as the predominant infrastructure in corporate environments by 2025. Although the lightweight virtualization model provides operational efficiency and elasticity, kernel sharing and the dynamic nature of clusters significantly expand the attack surface. Recent incidents involving container escape, exploitation of vulnerabilities in the Linux kernel, and intra-cluster lateral movement demonstrate the need for detection and containment mechanisms with formal grounding and explicit guarantees. In this work, we propose a formal architecture for the detection and containment of attacks in container environments based on compositional modeling of the attack surface. We formalize the environment as an annotated directed graph that integrates containers, infrastructure nodes, and interaction channels, defining the attack surface as a compositional operator over vertices and edges. We introduce a detection method based on structural deviations in system call graphs, using spectral divergence between observed adjacency matrices and reference models learned during a baseline phase. We demonstrate formal properties under explicit hypotheses, including a conditional completeness theorem. We implemented a prototype integrated with Kubernetes 1.29 with monitoring via eBPF/libbpf and evaluated the system on a 64-node cluster running 1,200 containers. The results indicate an average detection rate above 95% for scenarios aligned with MITRE ATT&CK for Containers, with a false positive rate below 3% and an average CPU overhead of 3.8%. We discuss implications for integration with CNAPP platforms and security governance mechanisms, as well as limitations and evasion vectors. We conclude that formal compositional modeling, combined with efficient kernel-level monitoring, provides a rigorous and scalable foundation for protecting large-scale containerized environments.
- Introduction
Lightweight virtualization based on containers has consolidated itself as the predominant mechanism for packaging and deploying applications in cloud environments (MERKEL, 2014). Research conducted by the Cloud Native Computing Foundation indicates that Kubernetes has become the de facto standard for cloud-native orchestration, with broad adoption in production environments (CNCF, 2023). Unlike traditional virtual machines, containers share the same host system kernel, using Linux namespaces, cgroups, and capabilities to provide logical isolation (OPEN CONTAINER INITIATIVE, 2022).
Although this architecture reduces computational overhead and increases execution density, it introduces structural dependencies that expand the attack surface, especially in multi-tenant scenarios (NIST, 2017; ZHANG et al., 2018). Vulnerabilities such as CVE-2019-5736, which allowed overwriting of the runc binary and consequent container escape, and CVE-2022-0185, associated with the Linux kernel namespace subsystem, illustrate systemic risks arising from resource sharing (NVD, 2019; NVD, 2022).
Empirical reports indicate that a significant portion of cloud incidents results from misconfigurations, vulnerable images, or abuse of excessive permissions (VERIZON, 2023; SYSDIG, 2023). In the context of MITRE ATT&CK for Containers, techniques such as T1611 (Escape to Host) and T1610 (Deploy Container) remain recurrent in real-world campaigns (MITRE, 2023).
Given this scenario, we investigate how to efficiently and scalably detect and contain attacks in highly dynamic container environments while preserving performance and isolation properties. We formulate three central questions: (RQ1) how to formally model the compositional attack surface of a dynamic set of containers; (RQ2) how to identify behavioral invariants that characterize legitimate execution; and (RQ3) what the trade-off is between detection capability and operational overhead.
Our contributions are: (C1) mathematical formalization of the attack surface based on annotated directed graphs; (C2) a structural deviation detection algorithm with formal complexity analysis; and (C3) implementation and empirical evaluation in a realistic cluster.
- Theoretical Foundations and Related Work
2.1 Formal Definitions
We formally define a container as the tuple:
$$ C = (I, P, N, R, \Sigma) $$
where $I$ represents the immutable image, $P$ the set of active processes, $N$ the set of namespaces, $R$ the resources controlled by cgroups, and $\Sigma$ the set of Linux capabilities (OPEN CONTAINER INITIATIVE, 2022).
We model the global environment as an annotated directed graph:
$$ G = (V, E, \lambda_V, \lambda_E) $$
in which $V$ contains containers and infrastructure components (nodes, API Server, etc.), $E$ represents communication or sharing relationships, and $\lambda_V$, $\lambda_E$ are labeling functions that associate semantic attributes.
2.2 Related Work
The literature is distributed across three main axes:
| Category | Examples | Main Limitation |
|---|---|---|
| Hardening | gVisor; Kata Containers (GOOGLE, 2023) | Overhead and compatibility |
| Image analysis | Clair; Anchore (CLAIR, 2023; ANCHORE, 2023) | Pre-execution focus |
| Runtime detection | Falco; Sysdig (FALCO, 2023; SYSDIG, 2023) | Heuristic-based |
We observe a lack of integration between compositional formal modeling and explicit mathematical guarantees.
- Threat Model and Formalization
We assume an adversary capable of: (i) executing arbitrary code in a compromised container; (ii) exploiting known vulnerabilities in the kernel; and (iii) performing lateral movement via the internal network. We do not assume prior compromise of the control plane (BURNS; BEDA; HIGHTOWER, 2019).
We define the compositional attack surface as:
$$ \mathcal{A}(G) = \left( \bigcup_{v \in V} \mathcal{A}(v) \right) \cup \left( \bigcup_{(u,v) \in E} \mathcal{I}(u,v) \right) $$
The detection function is:
$$ f : E_{obs} \rightarrow {0,1} $$
Maximizing:
$$ \text{TPR} = \frac{|E_a \cap E_{mal}|}{|E_{mal}|} $$
Minimizing:
$$ \text{FPR} = \frac{|E_a \setminus E_{mal}|}{|E_{ben}|} $$
Subject to $\delta < 0{,}05$ overhead.
- Methodology
4.1 Architecture
The architecture has three modules: Static Analyzer, Compositional Modeler, and Dynamic Monitor based on eBPF.
4.2 Graph Construction
Construction algorithm complexity: $O(|C_t| + |E_t|)$.
4.3 Invariant Modeling
Let $S = {s_1,\dots,s_n}$. We construct graph $G_S$ with matrix $A_S$.
Spectral divergence:
$$ D(G_S, M) = | \lambda(A_S) - \lambda(A_M) |_2 $$
Algorithm:
1. Construir G_S
2. Calcular autovalores de A_S
3. Se D > θ então alerta
Spectral decomposition complexity: $O(k^3)$.
Theorem 1 (Conditional Completeness).
Under the hypothesis that any attack alters at least one transition outside the transitive closure of the legitimate model, the spectral divergence–based detector with threshold $\theta$ detects the attack with probability 1 in the deterministic model.
Proof sketch. The structural alteration implies modification of the adjacency matrix. Since the spectrum is a global structural invariant, any non-isospectral perturbation produces $\lambda(A_S) \neq \lambda(A_M)$, implying $D>0$.
- Implementation
Prototype in Go integrated with Kubernetes 1.29. Monitoring via eBPF/libbpf (LIBBPF, 2023).
Storage in Neo4j; metrics via Prometheus.
Average overhead:
| Metric | Value |
|---|---|
| CPU | 3,8% |
| Memory | 2,1% |
| Latency | +1,6 ms |
- Experimental Evaluation
Cluster: 64 nodes (Intel Xeon Gold 6230, 128 GB RAM), 1,200 containers.
Results:
| Scenario | Detection | σ |
|---|---|---|
| T1611 | 96,4% | 1,2 |
| Lateral movement | 94,1% | 1,8 |
| FPR | 2,3% | — |
Comparison with Falco:
| System | TPR | FPR |
|---|---|---|
| Proposed | 95,2% | 2,3% |
| Falco | 89,7% | 5,6% |
- Discussion
Compositional modeling captures emergent properties of multi-stage attacks. The spectral approach provides an objective mathematical criterion, reducing exclusive dependence on heuristic rules.
Limitations include evasion through isospectral attacks and dependence on a representative baseline. Future integration with CNAPP platforms may expand multi-layer visibility.
- Conclusion
We present a formal architecture for detecting and containing attacks in containerized environments, combining rigorous mathematical modeling and efficient monitoring via eBPF. Empirical results indicate a high detection rate with low overhead, demonstrating practical feasibility in large-scale clusters.
References
ANCHORE. Container vulnerability scanning. 2023. Available at: https://anchore.com/. Accessed on: 13 Apr. 2025.
BURNS, B.; BEDA, J.; HIGHTOWER, K. Kubernetes: up and running. Sebastopol: O’Reilly, 2019.
CNCF. Cloud native survey 2023. 2023. Available at: https://www.cncf.io/reports/. Accessed on: 13 Apr. 2025.
CLAIR. Open source vulnerability scanner. 2023. Available at: https://github.com/quay/clair. Accessed on: 13 Apr. 2025.
FALCO. Runtime security. 2023. Available at: https://falco.org/. Accessed on: 13 Apr. 2025.
GOOGLE. gVisor documentation. 2023. Available at: https://gvisor.dev/. Accessed on: 13 Apr. 2025.
LIBBPF. eBPF library documentation. 2023. Available at: https://libbpf.readthedocs.io/. Accessed on: 13 Apr. 2025.
MERKEL, D. Docker: lightweight Linux containers for consistent development and deployment. Linux Journal, 2014. Available at: https://www.linuxjournal.com/content/docker-lightweight-linux-containers-consistent-development-and-deployment. Accessed on: 13 Apr. 2025.
MITRE. ATT&CK for containers. 2023. Available at: https://attack.mitre.org/matrices/enterprise/containers/. Accessed on: 13 Apr. 2025.
NIST. Application container security guide (SP 800-190). 2017. Available at: https://csrc.nist.gov/publications/detail/sp/800-190/final. Accessed on: 13 Apr. 2025.
NVD. CVE-2019-5736. 2019. Available at: https://nvd.nist.gov/vuln/detail/CVE-2019-5736. Accessed on: 13 Apr. 2025.
NVD. CVE-2022-0185. 2022. Available at: https://nvd.nist.gov/vuln/detail/CVE-2022-0185. Accessed on: 13 Apr. 2025.
OPEN CONTAINER INITIATIVE. Runtime specification. 2022. Available at: https://github.com/opencontainers/runtime-spec. Accessed on: 13 Apr. 2025.
PROMETHEUS. Monitoring system and time series database. 2023. Available at: https://prometheus.io/. Accessed on: 13 Apr. 2025.
SHU, R. et al. Understanding security vulnerabilities in Docker images. In: ACM CCS, 2017. Available at: https://dl.acm.org/doi/10.1145/3133956.3134014. Accessed on: 13 Apr. 2025.
SYSDIG. 2023 cloud-native security report. 2023. Available at: https://sysdig.com/resources/reports/. Accessed on: 13 Apr. 2025.
VERIZON. Data breach investigations report 2023. 2023. Available at: https://www.verizon.com/business/resources/reports/dbir/. Accessed on: 13 Apr. 2025.
ZHANG, Y. et al. Containers and the cloud: systematic study of security issues. In: USENIX Security Symposium, 2018. Available at: https://www.usenix.org/conference/usenixsecurity18. Accessed on: 13 Apr. 2025.