Anomaly detection on system audit events

Sammanfattning

The modern world is filled with cybersecurity risks. Current technologies like Kubernetes require extensive know-how and expertise to set up and manage in a secure manner. This has sprung up many ways to secure such environments. The Bifrost Securitys solution is one way of securing these clusters and uses AppArmor to lock down an application to the minimal needed permissions, and hence making attacks much harder. Current solutions however lacks ways to detect potential misconfigurations of unexpected behavior patterns (that may indicate an attack) during the auditing phase of determining what permissions AppArmor should allow. This thesis develops a proof-of-concept anomaly detection model using Isolation Forest, trained using behavior data from Bifrost Security together with self generated synthetic data containing attacks. The model in this thesis shows promising results for known environments and is able to with an accuracy of around 95% classify both normal and abnormal behavior, and achieved an overall F1-score of 97%. Although good performance for known environments, the model show performance issues with environments with large environmental differences. This indicates that further work is needed to create a generalized model. The findings in this thesis suggests that anomaly detection on system audit events is a promising approach to enhance the security of Kubernetes clusters.