Improving container security with honeypot deployment

Abstract

The transformation of business in the digital era requires a transition to a microservices architecture, which involves creating applications as independent services. In this context, containerization is gaining increasing importance, and Kubernetes (K8s), due to its efficiency in container management, is becoming a critical tool. It provides ease of deployment, scaling, and management of applications, which allows companies to accelerate the process of digital transformation. Despite its advantages, Kubernetes is not completely protected from security threats. Along with traditional means of protection, it is important to study the tactics of attackers. Honeypots have become an integral part of the arsenal of means of protection against cyber threats. Developers are constantly working on creating new types of decoys to effectively resist hackers seeking to penetrate conventional and industrial networks. Honeypots are used to collect data about hackers by disguising themselves as a weak point in the system. Therefore, research into the role of honeypots in improving infrastructure security is quite important. The effectiveness of decoy systems in monitoring cyberattacks and intrusion attempts is proven, but their deployment on a scale sufficient to capture a significant number of incidents is difficult. In the context of increasing cyber threats, primarily aimed at critical infrastructure, there is a need to develop more effective methods for collecting information about suspicious traffic. The purpose of the work is to study the effectiveness of using decoy systems to detect intrusions in container cloud environments, in particular in the context of Kubernetes. In this study, we focus on the deployment and use of decoy systems to improve the security of the Kubernetes environment. The publication claims that ContainerSSH is the most successful solution for creating a honeypot in the Kubernetes environment, as it combines maturity, ease of use and broad compatibility. It is also emphasized that using a honeypot allows you to obtain important data about threats and features of cloud system protection.