Detection of Cyber Attacks on Cloud Based Microservices with Distributed Features
摘要
The microservice architecture applications are highly scalable fitting to Containerized cloud computing system. When deep learning models are employed and trained to detect anomalous behaviors in microservices, the traditional approach to collect features in a single point is not sufficient due to scalable and distributed architecture of the microservices. In this work, we propose and show that training deep learning models with features from distributed microservices works better than ones with features from a single point such as front-end service in accuracy and false rates. To apply in real world applications and systems, we deployed a microservice benchmark application in Amazon Web Services clusters using Kubernetes and Elastic Container Services. Finally, we performed two real world attacks to the microservice applications to collect data in Kubernetes pod and services using Amazon Insight and CloudWatch services. In this experiment, when we incorporate the features from distributed services, we obtained an increase of 3.7 to 9.2% for accuracies, decrease of 1.2 to 3.5% and 1.8 to 4.3% for false positive and false negative rates respectively.