Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →13 papers
Container Security in Cloud-Native Environments: Threat Modeling, Exploitation Techniques, and Defense Strategies in Docker and Kubernetes Ecosystems (2023)
TITLE: Container Security in Cloud-Native Environments: Threat Modeling, Exploitation Techniques, and Defense Strategies in Docker and Kubernetes Ecosystems (2023) ABSTRACT: The adoption of containers has profoundly transformed software engineering and operational security in cloud-native environments. Technologies such as Docker and Kubernetes have become the foundation of modern infrastructure, enabling portability, scalability, and large-scale automation. However, this new architecture also introduces a distinct attack surface, characterized by shared-kernel-based isolation, complex image dependencies, and potentially vulnerable software supply chains. This work presents an in-depth analysis of container security from both offensive and defensive perspectives, considering the state of the art up to 2023. Initially, we examine the technical foundations of the Linux container model, including namespaces, cgroups, and the OCI runtime. Next, we analyze recurrent attack vectors observed in real incidents, such as container escape, runtime exploitation, build chain compromise, and attacks against Kubernetes clusters. We propose a formal threat model that captures relationships among workload, runtime, host, and control plane, enabling risk quantification based on exploitation probability and operational impact. The methodology presented combines static image analysis, behavioral monitoring based on eBPF, and isolation policies reinforced by seccomp, AppArmor, and Pod Security Standards. The experimental implementation was carried out in a Kubernetes cluster instrumented with widely used tools in 2023, including Falco, Trivy, and kube-bench. The results demonstrate a significant reduction in exposure to known vulnerabilities and improved detection of anomalous behavior in near real time. We also present a case study based on cryptomining campaigns observed in compromised Kubernetes clusters. The discussion explores practical limitations, governance challenges, and implications of container supply chain security. We conclude by highlighting future directions, including integration with Zero Trust models, eBPF-based observability, and automated incident response in cloud-native environments. This study provides an operational and technical perspective for security professionals, infrastructure architects, and researchers interested in defending container ecosystems.
Read paper →ContainersFormal and Operational Architecture for Threat Detection and Containment in Kubernetes-Based Containerized Environments
TITLE: Formal and Operational Architecture for Threat Detection and Containment in Kubernetes-Based Containerized Environments ABSTRACT: The adoption of container-based cloud-native architectures has profoundly transformed the way distributed applications are designed, deployed, and scaled. Kubernetes has established itself as the leading orchestration system for managing containerized workloads, offering declarative abstractions for scaling, fault tolerance, and operational automation. However, this additional abstraction layer introduces new attack vectors and broadens the exposure surface, particularly in environments with high densities of ephemeral containers and complex image supply chains. Exploitation of vulnerabilities in container runtimes, insecure orchestration API configurations, and automated cryptomining campaigns in misconfigured clusters demonstrate that traditional security mechanisms are insufficient to handle the dynamic nature of these environments. In this work, we propose a formal and operational architecture for threat detection and containment in Kubernetes clusters, combining mathematical modeling of system states with practical observability mechanisms and automated response. We formalize the containerized environment as a labeled transition system LTS = (S, A, →), enabling the expression of integrity and non-interference properties related to the interaction among containers, cluster nodes, and the control plane. On this theoretical basis, we implement a multi-layer security pipeline composed of static image analysis (Trivy and YARA), declarative admission policies using Open Policy Agent/Gatekeeper, kernel-level behavioral monitoring with eBPF via Falco, and automated isolation mechanisms using NetworkPolicies and Kubernetes administrative controls. The architecture was experimentally evaluated in a cluster with 120 nodes and 2,400 active pods, where different attack scenarios were simulated, including container escape attempts, execution of cryptocurrency miners, and lateral movement via compromised credentials. The results indicate an average detection rate of 96.3% with a false positive rate of 3.8%, in addition to significant reductions in the operational indicators MTTD and MTTR. These results demonstrate that the integration of theoretical formalization and low-level eBPF-based telemetry constitutes an effective approach to strengthening the operational security of cloud-native platforms at scale.
Read paper →ContainersFormal Architecture and Empirical Evaluation of a Defense-in-Depth Model for Kubernetes-Based Container Environments under Advanced Persistent Threats
TITLE: Formal Architecture and Empirical Evaluation of a Defense-in-Depth Model for Kubernetes-Based Container Environments under Advanced Persistent Threats ABSTRACT: The adoption of architectures based on containers orchestrated by Kubernetes has become predominant in cloud-native infrastructures due to their elasticity, portability, and operational automation capabilities. However, the increasing complexity of these environments introduces an expanded attack surface that can be exploited by sophisticated adversaries, including campaigns of Advanced Persistent Threats (APTs). In particular, vectors such as image supply chain compromise, exploitation of shared kernel vulnerabilities, abuse of control plane permissions, and lateral movement between pods represent critical challenges for security teams. In this work, we present a formal defense-in-depth architecture for Kubernetes clusters, integrating preventive control mechanisms, behavioral detection, and automated response. We model the defense system as a security state graph G=(V,E), in which vertices represent cluster security configurations and edges represent transitions induced by adversarial actions or mitigation mechanisms. The proposed architecture combines declarative security policies (Open Policy Agent/Gatekeeper and Kyverno), eBPF-based system call inspection (Falco), network segmentation with layer 7 policies (Cilium), image vulnerability analysis (Trivy), and observable telemetry integrated into the cloud-native security ecosystem. We conducted an empirical evaluation in an experimental environment containing multiple Kubernetes nodes and representative workloads of distributed applications. The experimental scenario reproduced techniques documented in the MITRE ATT&CK framework for containers, including privilege escalation, container escape, and data exfiltration. The results indicate that the defense-in-depth approach significantly reduces the observable attack surface and improves the Mean Time To Detect (MTTD). We observed that the integration of admission policies, static image analysis, and real-time eBPF-based monitoring enables the detection of malicious behavioral patterns with greater precision, reducing false positives when compared to isolated approaches. We conclude that the formalization of security policies combined with observable kernel instrumentation constitutes a promising path to strengthen the resilience of Kubernetes platforms against persistent adversaries. The work contributes an analytical model, a reference architecture, and experimental results that can guide the development of security strategies for large-scale cloud-native environments.
Read paper →ContainersCONTAINERSHIELD: A Formal and Empirical Framework for Threat Detection and Mitigation in Container Environments Based on Multilayer Telemetry
TITLE: CONTAINERSHIELD: A Formal and Empirical Framework for Threat Detection and Mitigation in Container Environments Based on Multilayer Telemetry ABSTRACT: The massive adoption of containers, driven by platforms such as Docker and Kubernetes, has transformed distributed system architecture, but it has introduced a complex and highly dynamic attack surface. Vulnerabilities in images, inadequate namespace and kernel capability configurations, as well as escape and lateral movement attacks, have been systematically exploited, as evidenced by recent CVEs (e.g., CVE-2019-5736, CVE-2022-0492). In this work, we propose CONTAINERSHIELD, a formal and empirical framework for threat detection and mitigation in container environments, based on the correlation of multilayer telemetry (kernel, runtime, and orchestrator). We formally model the environment as a labeled transition system and define security properties expressed in terms of isolation, integrity, and capability confinement. We developed two core algorithms: (i) a detection mechanism based on probabilistic behavior modeling via variable-order Markov chains and (ii) a policy verification module that applies dynamic Linux capability restrictions and seccomp profiles. We implemented the system on Kubernetes 1.28 with eBPF and evaluated it in a 48-node cluster (768 vCPUs). Using real workloads and 27 attack scenarios mapped to MITRE ATT&CK for Containers, we achieved a detection rate of 96.4% (±1.8%), with a false positive rate of 2.1% and an average CPU overhead of 3.7%. Compared to tools such as Falco and Aqua Security in their default configuration, our method reduced false positives by 38% and improved mean detection time by 24%. We demonstrate that the formal integration of threat modeling and real-time telemetry provides more robust guarantees of operational security. CONTAINERSHIELD contributes to the rigorous systematization of container security, offering a scalable and verifiable path for protection in cloud-native environments.
Read paper →ContainersFormal Architecture and Operational Methodology for Threat Detection and Response in Docker- and Kubernetes-Based Container Environments
TITLE: Formal Architecture and Operational Methodology for Threat Detection and Response in Docker- and Kubernetes-Based Container Environments ABSTRACT: The massive adoption of containers has transformed the attack surface of modern infrastructures, especially in Docker- and Kubernetes-based environments. Although containers provide lightweight isolation through Linux kernel namespaces and cgroups, multiple recent incidents—including container escapes associated with CVE-2019-5736 (runc) and cryptojacking campaigns exploiting exposed Kubernetes APIs—demonstrate that the security of these environments remains insufficiently understood and operationalized. In this work, we propose a formal architecture and an operational methodology for threat detection and response in container environments, integrating formal threat modeling, eBPF-based instrumentation, MITRE ATT&CK-oriented behavioral analysis, and automated response. Our methodology combines three layers: (i) formal modeling of the container system as a directed graph of entities and flows; (ii) hybrid detection based on rules (Sigma/YARA) and anomalies with statistical learning; and (iii) automated response orchestration via Kubernetes Admission Controllers and OPA/Gatekeeper policies. We evaluated our approach in a Kubernetes cluster with 48 nodes, running 1,200 pods under synthetic load and real attacks reproduced from documented TTPs (T1610, T1611, T1525). The results indicate an average detection rate of 96.4% with a false positive rate of 3.1%, average detection latency of 420 ms, and CPU overhead below 4.8%. We contribute: (C1) a mathematical formalization of the container security problem; (C2) a replicable operational pipeline integrating widely adopted tools (Falco, Suricata, Trivy, kube-bench, Volatility); and (C3) quantitative empirical evidence of effectiveness and performance at realistic scale. We demonstrate that the coherent integration of kernel instrumentation, orchestrator telemetry, and threat intelligence substantially reduces mean time to detect (MTTD) and mean time to respond (MTTR), establishing practical guidelines for offensive and defensive security teams.
Read paper →ContainersA Formally Grounded Architecture for Detection and Containment of Compromises in Container Environments Based on Multi-Layer Telemetry
TITLE: A Formally Grounded Architecture for Detection and Containment of Compromises in Container Environments Based on Multi-Layer Telemetry ABSTRACT: The massive adoption of containers as the primary unit of packaging and deployment in cloud-native environments has introduced an attack surface substantially different from that observed in traditional virtual machines. Vulnerabilities in base images, improper namespace configurations, cgroup isolation failures, and exploitation of runtimes such as runc (e.g., CVE-2019-5736) have been actively exploited by adversaries. In this work, we propose a formally grounded architecture for detection and containment of compromises in container environments, based on correlation of multi-layer telemetry (kernel, runtime, and orchestrator). Our methodology integrates probabilistic behavioral modeling, process dependency graph analysis, and adaptive isolation policies. We developed a formal model of the containerized system as a labeled directed graph G = (V, E, λ), in which vertices represent execution entities and edges encode observable interactions. We define security properties based on isolation and information flow invariants, and propose two main algorithms: (i) detection based on multivariate statistical deviation with adaptive threshold; and (ii) automatic containment mechanism via dynamic reconfiguration of access control and network policies. We implemented a functional prototype on Kubernetes 1.29, using eBPF for kernel instrumentation and Open Policy Agent (OPA) for enforcement. We evaluated the system on a 48-node cluster (Intel Xeon Gold, 256 GB RAM), with 1,200 containers and 17 representative attack scenarios (MITRE ATT&CK for Containers). We obtained an average detection rate of 96.8% (±1.7%), with a false positive rate of 2.3%, and CPU overhead below 4.9%. Compared to solutions based exclusively on signatures or static policies, our method reduced mean containment time by 63%. The results demonstrate that the integration of multi-layer telemetry with formal modeling and automated containment constitutes a significant advance for the security of large-scale containerized environments.
Read paper →ContainersFormal Modeling and Adaptive Monitoring Architecture for Container Security in Cloud-Native Environments
TITLE: Formal Modeling and Adaptive Monitoring Architecture for Container Security in Cloud-Native Environments ABSTRACT: The massive adoption of containers and orchestrators such as Docker and Kubernetes has transformed software engineering and the operation of critical infrastructures, but it has also introduced an expanded and dynamic attack surface. Vulnerabilities such as CVE-2019-5736 (runc) and CVE-2022-0492 (cgroups) highlight the fragility of namespace-based isolation and Linux kernel mechanisms when misconfigured or exploited by adversaries with initial access to the container. In this work, we propose a formally grounded architecture for adaptive monitoring and threat containment in container environments, combining mathematical modeling of attack surfaces, behavioral detection based on system call graphs, and dynamic application of mitigation policies. We define a threat model aligned with MITRE ATT&CK for Containers and formalize security properties such as strong isolation, runtime integrity, and non-interference between workloads. We developed two main algorithms: (i) an incremental inference mechanism for legitimate behavior profiles with O(n log n) complexity, and (ii) an adaptive containment module with risk analysis based on Bayesian scoring. We implemented a prototype integrated with Kubernetes using eBPF, Falco, and custom admission controllers. We evaluated the solution in a cluster with 120 nodes and 3,500 pods, using real workloads and controlled injection of attacks mapped to MITRE ATT&CK techniques T1610, T1611, and T1525. The results demonstrate a detection rate of 96.4% with an average false positive rate of 2.1%, overhead below 4.8% CPU, and average additional latency of 3.7 ms per monitored event. We conclude that the proposed approach significantly raises the operational security level in cloud-native environments while maintaining practical viability and scalability.
Read paper →ContainersContainerShield++: A Formal Framework and Scalable System for Threat Detection and Mitigation in Linux-Based Container Environments
TITLE: ContainerShield++: A Formal Framework and Scalable System for Threat Detection and Mitigation in Linux-Based Container Environments ABSTRACT: Lightweight virtualization based on containers has become the dominant infrastructure for cloud-native applications, especially in Kubernetes-orchestrated environments. However, the sharing of the operating system kernel among multiple workloads expands the attack surface, requiring rigorous mechanisms for isolation, integrity verification, and behavioral detection. In this work, we present ContainerShield++, a formal framework and scalable system for threat detection and mitigation in Linux container environments, integrating mathematical modeling of confinement properties, static image verification, declarative enforcement via admission controllers, and dynamic monitoring with eBPF. We formalize isolation as non-interference properties over a graph of capabilities and namespaces, defining verifiable criteria for strong confinement under a threat model in which the adversary executes arbitrary code inside a compromised container. We propose algorithms for static risk assessment and dynamic detection based on divergence in system call distributions, using D_{KL} as a metric of behavioral deviation. We implemented the system in a Kubernetes v1.29 cluster with CRI-O, integrating OPA/Gatekeeper policies and eBPF profiles validated by the kernel verifier. We experimentally evaluated the system across 120 nodes and 3,600 containers, considering MITRE ATT&CK for Containers techniques and realistic exploitation scenarios, including CVE-2019-5736 and CVE-2022-0492. We achieved an average detection rate of 98.7% with an overhead below 4% CPU and an average additional latency of 4.3 μs per syscall. We demonstrate superiority over signature-only approaches, such as Falco, and discuss extensions for software supply chain security, Sigstore signatures, post-quantum cryptography for artifact protection, and integration with CNAPP platforms. The work contributes formal foundations, large-scale empirical validation, and practical guidelines for container security at the state of the art in 2025.
Read paper →ContainersA Formally Grounded Architecture for Container Monitoring and Hardening Based on Behavioral Modeling and Runtime Integrity Verification
TITLE: A Formally Grounded Architecture for Container Monitoring and Hardening Based on Behavioral Modeling and Runtime Integrity Verification ABSTRACT: The massive adoption of containers as the primary unit of packaging and execution in cloud-native environments has profoundly transformed the attack surface of modern distributed systems. In 2025, infrastructures based on Kubernetes, CNAPP (Cloud-Native Application Protection Platforms), eBPF, and digitally signed supply chains constitute the state of practice. However, most industrial approaches remain fragmented between static image verification and rule-based reactive monitoring, lacking a unified formal foundation. In this work, we propose a formally specified architecture that integrates (i) cryptographic verification of structural integrity through Merkle trees and signatures compatible with secure supply chains, and (ii) probabilistic modeling of runtime behavior based on discrete Markov chains over sequences of system events collected via eBPF. We formalize containers as processes confined by namespaces and cgroups, modeling the global state as a dynamic system S(t) and defining properties of integrity, confinement, and non-interference. Anomaly detection is formulated as a hypothesis test over the log-likelihood of observed trajectories, with threshold θ statistically calibrated. We demonstrate that the orthogonal composition between cryptographic invariants and probabilistic properties reduces evasion and improves robustness against techniques documented in MITRE ATT&CK for Containers. We implemented a prototype in Kubernetes 1.29 with per-node agents and evaluated it in a 40-node cluster running 120 heterogeneous workloads, including AI-related workloads. The results indicate an average detection rate of 96.7% (95% CI), false positives of 2.3%, and CPU overhead below 5%, while preserving scalability. We also provide a formal complexity analysis, a discussion on online learning convergence, and integration with remote attestation based on TPM 2.0. The proposed architecture establishes a theoretically sound and operationally viable foundation for container hardening in contemporary cloud-native environments.
Read paper →ContainersA Formal Architecture for Attack Detection and Containment in Container Environments Based on Compositional Attack Surface Modeling
TITLE: A Formal Architecture for Attack Detection and Containment in Container Environments Based on Compositional Attack Surface Modeling ABSTRACT: The massive adoption of containers and orchestrators such as Kubernetes has consolidated the cloud-native paradigm as the predominant infrastructure in corporate environments by 2025. Although the lightweight virtualization model provides operational efficiency and elasticity, kernel sharing and the dynamic nature of clusters significantly expand the attack surface. Recent incidents involving container escape, exploitation of Linux kernel vulnerabilities, and intra-cluster lateral movement demonstrate the need for detection and containment mechanisms with formal grounding and explicit guarantees. In this work, we propose a formal architecture for attack detection and containment in container environments based on compositional attack surface modeling. We formalize the environment as an annotated directed graph that integrates containers, infrastructure nodes, and interaction channels, defining the attack surface as a compositional operator over vertices and edges. We introduce a detection method based on structural deviations in system call graphs, using spectral divergence between observed adjacency matrices and reference models learned during a baseline phase. We demonstrate formal properties under explicit hypotheses, including a conditional completeness theorem. We implemented a prototype integrated with Kubernetes 1.29 with monitoring via eBPF/libbpf and evaluated the system in a 64-node cluster running 1,200 containers. The results indicate an average detection rate above 95% for scenarios aligned with MITRE ATT&CK for Containers, with a false positive rate below 3% and an average CPU overhead of 3.8%. We discuss implications for integration with CNAPP platforms and security governance mechanisms, as well as limitations and evasion vectors. We conclude that formal compositional modeling, combined with efficient kernel-level monitoring, provides a rigorous and scalable basis for protecting large-scale containerized environments.
Read paper →ContainersA Formal Architecture for Detection and Containment of Attacks in Container Environments Based on Compositional Modeling of the Attack Surface
TITLE: A Formal Architecture for Detection and Containment of Attacks in Container Environments Based on Compositional Modeling of the Attack Surface ABSTRACT: The massive adoption of containers and orchestrators such as Kubernetes has consolidated the cloud-native paradigm as the predominant infrastructure in corporate environments by 2025. Although the lightweight virtualization model provides operational efficiency and elasticity, kernel sharing and the dynamic nature of clusters significantly expand the attack surface. Recent incidents involving container escape, exploitation of vulnerabilities in the Linux kernel, and intra-cluster lateral movement demonstrate the need for detection and containment mechanisms with formal grounding and explicit guarantees. In this work, we propose a formal architecture for the detection and containment of attacks in container environments based on compositional modeling of the attack surface. We formalize the environment as an annotated directed graph that integrates containers, infrastructure nodes, and interaction channels, defining the attack surface as a compositional operator over vertices and edges. We introduce a detection method based on structural deviations in system call graphs, using spectral divergence between observed adjacency matrices and reference models learned during a baseline phase. We demonstrate formal properties under explicit hypotheses, including a conditional completeness theorem. We implemented a prototype integrated with Kubernetes 1.29 with monitoring via eBPF/libbpf and evaluated the system on a 64-node cluster running 1,200 containers. The results indicate an average detection rate above 95% for scenarios aligned with MITRE ATT&CK for Containers, with a false positive rate below 3% and an average CPU overhead of 3.8%. We discuss implications for integration with CNAPP platforms and security governance mechanisms, as well as limitations and evasion vectors. We conclude that formal compositional modeling, combined with efficient kernel-level monitoring, provides a rigorous and scalable foundation for protecting large-scale containerized environments.
Read paper →ContainersA Formal Architecture for Detection and Mitigation of Container Escapes Based on Probabilistic Behavioral Profiles and Kernel-Level Policy Verification
TITLE: A Formal Architecture for Detection and Mitigation of Container Escapes Based on Probabilistic Behavioral Profiles and Kernel-Level Policy Verification ABSTRACT: Container-based virtualization has become a cornerstone of cloud-native infrastructure, but its reliance on a shared kernel imposes structural security challenges. Container escapes remain critical compromise vectors, especially in large-scale Kubernetes environments, where vulnerabilities in the runtime, the cgroups subsystem, or the kernel itself may result in isolation breaches. In this work, we propose a formal architecture for detecting and mitigating container escapes based on probabilistic modeling of system call sequences and automatic synthesis of kernel-level security policies. We model the legitimate behavior of applications as a probabilistic language over the syscall alphabet, instantiated by variable-order Markov chains with Bayesian smoothing. We derive formal bounds of correctness and completeness under $(\epsilon, \delta)$ parameters and introduce a decision criterion based on accumulated log-likelihood. From the observed empirical support, we automatically synthesize minimal seccomp profiles and policies compatible with modern LSMs (AppArmor or SELinux), quantifiably reducing the attack surface. We implement the architecture using eBPF coupled to Linux 6.x kernel tracepoints, integrating it into a Kubernetes 1.28 cluster with containerd 1.7. In an experimental evaluation involving 120 nodes and 1,800 containers, we obtained an average reduction of 72.4% in the set of permitted syscalls, a detection rate of 96.1%, and an average CPU overhead of 3.7%. We further demonstrate that the approach outperforms mechanisms based exclusively on heuristic rules while maintaining scalability and low latency. We conclude that the combination of formal probabilistic modeling, efficient kernel-level verification, and automatic policy synthesis constitutes a robust strategy for the dynamic hardening of containerized environments in 2025.
Read paper →ContainersA Formal Architecture for Detecting and Mitigating Container Escapes Based on Probabilistic Behavioral Profiles and Kernel Policy Verification
TITLE: A Formal Architecture for Detecting and Mitigating Container Escapes Based on Probabilistic Behavioral Profiles and Kernel Policy Verification ABSTRACT: Container-based virtualization has become a foundation of cloud-native infrastructure, but its reliance on a shared kernel imposes structural security challenges. Container escapes remain critical compromise vectors, especially in large-scale Kubernetes environments, where vulnerabilities in the runtime, the cgroups subsystem, or the kernel itself can result in isolation breaches. In this work, we propose a formal architecture for detecting and mitigating container escapes based on probabilistic modeling of system call sequences and automatic synthesis of security policies at the kernel level. We model legitimate application behavior as a probabilistic language over the syscall alphabet, instantiated by variable-order Markov chains with Bayesian smoothing. We derive formal bounds for correctness and completeness under $(\epsilon, \delta)$ parameters and introduce a decision criterion based on cumulative log-likelihood. From the empirical support observed, we automatically synthesize minimal seccomp profiles and policies compatible with modern LSMs (AppArmor or SELinux), quantitatively reducing the attack surface. We implemented the architecture with eBPF coupled to Linux 6.x kernel tracepoints, integrating it into a Kubernetes 1.28 cluster with containerd 1.7. In an experimental evaluation involving 120 nodes and 1,800 containers, we achieved an average reduction of 72.4% in the set of permitted syscalls, a detection rate of 96.1%, and an average CPU overhead of 3.7%. We further demonstrate that the approach outperforms mechanisms based exclusively on heuristic rules, while maintaining scalability and low latency. We conclude that the combination of formal probabilistic modeling, efficient kernel-level verification, and automatic policy synthesis constitutes a robust strategy for dynamic hardening of containerized environments in 2025.
Read paper →