Contact

University of Oldenburg Faculty II - Department of Computer Science Department Safety-Security-Interaction 26111 Oldenburg

Secretariat

Ingrid Ahlhorn

A03 2-208

+49 (0) 441 - 798 2426

Safety-Security-Interaction

Welcome to the Safety-Security-Interaction Group!

The Safety-Security-Interaction group is concerned with the development of theoretically sound technologies for maintaining the security of IT systems in the context of safety-critical systems and the Internet of Things. The focus is on the development of security solutions that are tailored to the context-specific conditions and that take into account various types of user-interaction as well as the functional safety of the to-be-protected systems.

News

Article at top conference NDSS 2024

Our paper „ReplicaWatcher: Training-less Anomaly Detection in Containerized Microservices” got accepted at the top conference NDSS 2024!

Our paper „ReplicaWatcher: Training-less Anomaly Detection in Containerized Microservices” got accepted at the top conference NDSS 2024!

Short summary:

Despite its detection capabilities against previously unseen threats, anomaly detection suffers from critical limitations, which often prevent its deployment in real-world settings. In fact, anomaly-based intrusion detection systems rely on comprehensive pre-established baselines for effectively identifying suspicious activities. Unfortunately, prior research showed that these baselines age and gradually lose their effectiveness over time, especially in dynamic deployments such as microservices-based environments, where the concept of "normality" is frequently redefined due to shifting operational conditions. This scenario reinforces the need for periodic retraining to uphold optimal performance --- a process that proves challenging, particularly in the context of security applications.

We propose a novel, training-less approach to monitoring microservices-based environments. Our system, ReplicaWatcher, observes the behavior of identical container instances (i.e., replicas) and detects anomalies without requiring prior training. Our key insight is that replicas, adopted for fault tolerance or scalability reasons, execute analogous tasks and exhibit similar behavioral patterns, which allow anomalous containers to stand out as a notable deviation from their corresponding replicas, thereby serving as a crucial indicator of security threats. The results of our experimental evaluation show that our approach is resilient against normality shifts and maintains its effectiveness without the necessity for retraining. Besides, despite not relying on a training phase, ReplicaWatcher performs comparably to state-of-the-art, training-based solutions, achieving an average precision of 91.08% and recall of 98.35%.

» Publications

Webmaster (Changed: 20 Aug 2024)  | 
Zum Seitananfang scrollen Scroll to the top of the page