Seungsoo Lee

Containerization has become a dominant paradigm in cloud-native software delivery, with orchestration platforms such as Kubernetes managing workloads that share a common host kernel across heterogeneous environments. This shared-kernel architecture exposes a critical gap: existing runtime security tools differ substantially in when and where enforcement decisions are made, in the resource types they govern, and in the policy models they support, yet no systematic framework exists for comparing these mechanisms against formal security correctness criteria. Prior surveys address container security broadly or catalog vulnerabilities, but none evaluates enforcement mechanisms against the reference monitor requirements of complete mediation, tamper resistance, and verifiability. This paper presents (i) a five-axis multi-dimensional classification framework applied to 15 representative systems that identifies five natural enforcement clusters, and (ii) a systematic evaluation of each cluster against reference monitor requirements and mandatory access control principles. The evaluation finds that synchronous kernel-level enforcement via LSM and BPF-LSM hooks achieves the highest complete mediation and tamper resistance; that verifiability remains universally immature across all clusters; and that a layered combination of syscall surface reduction, synchronous kernel enforcement, and observability-oriented detection constitutes the most robust production deployment pattern, with six open research challenges identified as prerequisites for broad adoption.

Kubernetes-based microservice architectures are central to modern cloud-native environments, offering flexibility, scalability, and diverse use cases. Given their large-scale and complex deployments, auditing is crucial for detecting potential threats. To address this need, various eBPF (extended Berkeley Packet Filter)-based security tools (ESSTs) have been developed, leveraging eBPF to monitor process and network activities in Kubernetes environments, log suspicious events, and enforce security policies. However, administrators often face challenges in selecting the most suitable ESST due to a lack of comprehensive comparative analyses. In this paper, we conduct an in-depth evaluation of four widely used ESSTs—KubeArmor, Falco, Tetragon, and Tracee—focusing on their internal architectures, auditing capabilities, overall performance, and real-world case studies in practice. Based on our findings, we provide key insights to guide administrators in selecting the appropriate ESST for their specific needs. We believe our research enhances the understanding of ESSTs, contributing to the development of more secure and high-performance cloud-native environments.

Serverless environments are rapidly emerging as the new paradigm for cloud computing due to their automatic scalability, cost efficiency, and ease of operation. However, IAM-based privilege management and event-driven execution mechanisms can introduce security vulnerabilities. In particular, complex inter-functional call relationships expose systems to attacks such as privilege abuse and event call condition exploitation. These attacks often occur dynamically at runtime, making them difficult to address with static defenses. Existing static analysis methods attempt to mitigate these risks, but are inherently limited in capturing dynamic attacks that occur at runtime. In this paper, we propose Bambda, a dynamic security framework for serverless environments that prevents privilege abuse and chained function call attacks. Bambda performs real-time function call verification through centralized logging and automated code injection based on application-specific log groups. Specifically, we introduce a multi-step verification process that distinguishes between direct calls, event-driven calls, and API calls, effectively preventing unauthorized attacks without requiring additional security configurations from developers. Experiments conducted in AWS Lambda environments demonstrate that Bambda effectively defends against privilege abuse and chained function call attacks, achieving practical deployment with minimal performance overhead of 8.12% under warm start conditions.

Container Network Interfaces (CNIs) are critical for securing containerized environments, yet their various security features and performance remain under-analyzed. This study presents an in-depth analysis of major CNI plugins (Cilium, Calico, WeaveNet, Kube-router, and Antrea) in Kubernetes environments. We first analyze their architectural characteristics and basic security features (encryption, multi-tenancy, etc.), and then perform a detailed examination of their network policy enforcement mechanisms. To understand the performance implications of policy enforcement, we evaluate Layer 3/4 policy processing, policy complexity scaling, pod scalability, and Layer 7 policy processing. Our results show clear patterns: eBPF-based Cilium maintains 8.9K Mbps throughput under complex L3/4 policies, but drops to 94 Mbps with L7 processing, while Antrea achieves 6.6K Mbps at L7 through HTTP filtering, although performance degrades as policy complexity increases. Under high concurrent pod loads, iptables-based CNIs show a 60-70% reduction in throughput, while Cilium maintains performance within 10% of baseline. These results highlight the trade-offs between architectural choices and security capabilities, and provide actionable insights for optimizing CNI selection based on cloud-native use cases.

Recently, containers have become the standard for cloud-native service delivery, ensuring scalability and reliability. However, they are also prime targets for various security attacks that exploit vulnerabilities. In particular, deploying security policies in dynamic cloud-native environments presents significant challenges, such as misconfigurations arising from the heterogeneity of different security policies. Despite numerous attempts to address these challenges, existing solutions often lack a unified framework for consistently managing and enforcing heterogeneous security policies across network, system, and cluster layers. Current approaches typically focus on isolated aspects of security rather than providing a comprehensive policy management solution. This fragmentation leads to inconsistencies, inefficiencies, and potential security gaps. To address these challenges, in this paper, we propose KUBEAEGIS, an advanced and unified policy management framework designed to manage the integration, verification, and enforcement of heterogeneous security policies at the network, system, and cluster levels. Our framework enables centralized management of security policies, simplifying the integration of new security tools through an adapter-based approach and API recommendation mechanisms. We also incorporate a pre-validation process to detect potential misconfigurations before policy enforcement and to enable real-time tracking of policies applied to containers. Our evaluation demonstrates the effectiveness of KUBEAEGIS in integrating and managing network, system, and cluster security policies in real cloud-native environments, providing extensive coverage and achieving a minimal translation delay of approximately 17ms.

With the rapid adoption of cloud environments, container technology has become crucial for the efficient operation of large-scale applications. Although container technology offers high efficiency and scalability through low-level isolation via shared host operating systems, it also introduces security vulnerabilities, such as container escape and privilege escalation attacks through system call exploitation. Seccomp-BPF, one of the most widely used system call filtering mechanisms, supports container environments but cannot update system call policies while containers are running. To address these limitations, we propose KUBEROSY, a system call filtering framework that allows dynamic modification of system call policies without downtime, even during container runtime. KUBEROSY leverages eBPF and LSM hooks to support fine-grained system call policies while ensuring compatibility with existing Seccomp-BPF environments. This approach enables the application of customized, granular system call policies tailored to container environments, thereby reducing the attack surface. Our evaluation shows that KUBEROSY incurs an additional overhead of only 722 ns compared to traditional Seccomp-BPF, which is negligible. Furthermore, KUBEROSY allows for dynamic policy modification without container downtime and provides precise argument-based filtering, demonstrating its practicality and efficiency.

The scale of botnet attacks is on the rise, yet traditional network security systems are inadequate to effectively respond to these threats, primarily due to high false positive rates and the extensive manpower required for analysis. In contrast, the cutting-edge method of intrusion detection, known as provenance-based analysis, offers a novel paradigm by establishing causality between host events for meticulous examination. Nonetheless, this method faces challenges in analyzing the payload of network packets, which contains critical attack information resides, due to performance efficiency constraints from packet inspection. To address these challenges, we introduce BotFence , a pioneering approach that integrates payload inspection of network packets with provenance-based analysis to enhance botnet intrusion detection and response. Notably, our system leverages SmartNICs to minimize the impact on network performance. Our system initially gathers and analyzes events within the host system, representing them as Tactics, Techniques, and Procedures (TTP). Concurrently, it collects and scrutinizes the network packets associated with these events, integrating the relationships between these TTPs and the collected network data into a Network-enhanced Threat Provenance Graph (NTPG) model that we devised. Consequently, our system provides a comprehensive security analysis of the network with minimal overhead. Demonstrations with complex attack scenarios show that BotFence successfully identifies and mitigates automated botnet infection in real time, analyzing more than 99. 9% host events in 1 ms, without degrading network performance.