نهج هجين استباقي لتأمين أنظمة الحاويات يدمج مراقبة النواة العميقة مع تصنيف التعلم الآلي ثنائي المراحل

الملخص

With the rapid evolution of container technologies in modern cloud computing architectures, container breakouts constitute a serious threat, as they exploit security vulnerabilities in shared isolation at the operating system kernel level. Traditional detection systems often lack kernel-level visibility, requiring operating system kernel monitoring for real-time analysis. This paper presents a hybrid protection framework that combines operating system kernel monitoring (eBPF) with accelerated cloud processing via Google Colab. The proposed system employs a multilayer detection mechanism, a lightweight behavioral rule layer for initial filtering, followed by a two-stage machine learning process. This latter stage includes an autoencoder model for anomaly detection and a random forest model for final classification. The experimental results achieved a classification accuracy of 96.8% and an F1-score of 96.3%, indicating a promising balance between precision and recall. The system also achieved an overall response time of 19.32 ms, with CPU resource consumption of less than 4.2%. These results indicate the effectiveness of the architectural separation between a low-level monitoring layer and a cloud-based analytics layer, providing a practical model for proactive defense systems in high-density container environments.