Safeguarding the Host: a Security Approach for Malicious Container Threats in the Cloud

Abstract

This paper presents a measurable security framework for detecting and mitigating malicious container activity in a cloud-native environment. Infrastructure as Code, implemented in Terraform, is used to provision an Amazon Elastic Kubernetes Service (EKS) cluster, and a container compromise is emulated through the kubectl exec command to obtain interactive shell access to a vulnerable workload. The resulting Kubernetes control-plane audit records, delivered through Amazon CloudWatch Logs, are evaluated against a formally specified detection predicate that isolates interactive exec requests from unrelated application-programming-interface traffic. Once the event is confirmed, node isolation is initiated through the Kubernetes cordon and drain operations, evicting the affected workload and triggering rescheduling onto healthy nodes. A formal system model is developed for the detection, isolation and migration stages, and the resulting workflow is quantified using two derived metrics, namely the Migration Success Ratio and the Mean Time to Remediation. Across three controlled trials the framework attained a Migration Success Ratio of 1.00 and a mean remediation time of 77.67 s with a sample standard deviation of 7.23 s, of which detection, isolation and rescheduling contributed 15.88%, 36.48% and 47.64%, respectively. A comparative analysis against syscall-based intrusion detection, provenance-based escape detection, extended-Berkeley-Packet-Filter runtime monitors, sandboxed runtimes and proactive migration schemes indicates that the proposed workflow occupies a complementary position: it requires no additional in-cluster agent and is the only one of the compared approaches that carries a detected compromise through to verified workload continuity.