U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge Clouds
Container technology is currently one of the mainstream technologies in the field of cloud computing, yet its adoption in resource-constrained, latency-sensitive edge environments introduces unique security challenges. While existing system call-based anomaly-detection methods partially address thes...
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2025-05-01
|
| Series: | Future Internet |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1999-5903/17/5/218 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1849711169529446400 |
|---|---|
| author | Jiawei Ye Ming Yan Shenglin Wu Jingxuan Tan Jie Wu |
| author_facet | Jiawei Ye Ming Yan Shenglin Wu Jingxuan Tan Jie Wu |
| author_sort | Jiawei Ye |
| collection | DOAJ |
| description | Container technology is currently one of the mainstream technologies in the field of cloud computing, yet its adoption in resource-constrained, latency-sensitive edge environments introduces unique security challenges. While existing system call-based anomaly-detection methods partially address these issues, they suffer from high false positive rates and excessive computational overhead. To achieve security and observability in edge-native containerized environments and lower the cost of computing resources, we propose an unsupervised anomaly-detection method based on system calls. This method filters out unnecessary system call data through automatic rule generation and an unsupervised classification model. To increase the accuracy of anomaly detection and reduce the false positive rates, this method embeds system calls into sequences using the proposed Syscall2vec and processes the remain sequences in favor of the anomaly detection model’s analysis. We conduct experiments using our method with a background based on modern containerized cloud microservices. The results show that the detection part of our method improves the F1 score by 23.88% and 41.31%, respectively, as compared to HIDS and LSTM-VAE. Moreover, our method can effectively reduce the original processing data to 13%, which means that it significantly lowers the cost of computing resources. |
| format | Article |
| id | doaj-art-fd06508b6fe74f07bf02cd6963aa8608 |
| institution | DOAJ |
| issn | 1999-5903 |
| language | English |
| publishDate | 2025-05-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Future Internet |
| spelling | doaj-art-fd06508b6fe74f07bf02cd6963aa86082025-08-20T03:14:41ZengMDPI AGFuture Internet1999-59032025-05-0117521810.3390/fi17050218U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge CloudsJiawei Ye0Ming Yan1Shenglin Wu2Jingxuan Tan3Jie Wu4School of Computer Science, Fudan University, Shanghai 200438, ChinaSchool of Computer Science, Fudan University, Shanghai 200438, ChinaSchool of Computer Science, Fudan University, Shanghai 200438, ChinaSchool of Computer Science, Fudan University, Shanghai 200438, ChinaSchool of Computer Science, Fudan University, Shanghai 200438, ChinaContainer technology is currently one of the mainstream technologies in the field of cloud computing, yet its adoption in resource-constrained, latency-sensitive edge environments introduces unique security challenges. While existing system call-based anomaly-detection methods partially address these issues, they suffer from high false positive rates and excessive computational overhead. To achieve security and observability in edge-native containerized environments and lower the cost of computing resources, we propose an unsupervised anomaly-detection method based on system calls. This method filters out unnecessary system call data through automatic rule generation and an unsupervised classification model. To increase the accuracy of anomaly detection and reduce the false positive rates, this method embeds system calls into sequences using the proposed Syscall2vec and processes the remain sequences in favor of the anomaly detection model’s analysis. We conduct experiments using our method with a background based on modern containerized cloud microservices. The results show that the detection part of our method improves the F1 score by 23.88% and 41.31%, respectively, as compared to HIDS and LSTM-VAE. Moreover, our method can effectively reduce the original processing data to 13%, which means that it significantly lowers the cost of computing resources.https://www.mdpi.com/1999-5903/17/5/218anomaly detectioncontainer securitysystem callsedge computing |
| spellingShingle | Jiawei Ye Ming Yan Shenglin Wu Jingxuan Tan Jie Wu U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge Clouds Future Internet anomaly detection container security system calls edge computing |
| title | U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge Clouds |
| title_full | U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge Clouds |
| title_fullStr | U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge Clouds |
| title_full_unstemmed | U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge Clouds |
| title_short | U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge Clouds |
| title_sort | u scad an unsupervised method of system call driven anomaly detection for containerized edge clouds |
| topic | anomaly detection container security system calls edge computing |
| url | https://www.mdpi.com/1999-5903/17/5/218 |
| work_keys_str_mv | AT jiaweiye uscadanunsupervisedmethodofsystemcalldrivenanomalydetectionforcontainerizededgeclouds AT mingyan uscadanunsupervisedmethodofsystemcalldrivenanomalydetectionforcontainerizededgeclouds AT shenglinwu uscadanunsupervisedmethodofsystemcalldrivenanomalydetectionforcontainerizededgeclouds AT jingxuantan uscadanunsupervisedmethodofsystemcalldrivenanomalydetectionforcontainerizededgeclouds AT jiewu uscadanunsupervisedmethodofsystemcalldrivenanomalydetectionforcontainerizededgeclouds |