A Novel System-Call Dataset for AI-Driven Host-Based Intrusion Detection in Containerized Cloud Environments

In the modern digital world, applications often run inside "containers," which are like lightweight, portable boxes that hold everything a program needs to operate. These boxes are popular because they make it easy to move software from one computer to another. However, unlike a fully isolated room, all these containers share the same underlying operating system of the host computer. This shared foundation creates a vulnerability: if a container is compromised, an attacker might be able to slip out of their box and take control of the entire host system. To stop this, security experts use host-based intrusion detection systems. These systems act as vigilant observers, watching the fundamental requests that programs make to the computer's core. These requests, known as system calls, are the basic instructions a program uses to do things like open a file, connect to a network, or use memory. By analyzing the pattern of these requests, security software can spot when a program is behaving strangely, such as when it tries to perform actions it was never meant to do.

The challenge has been that existing records of these system calls were often too simple or outdated to catch the sophisticated tricks used against modern containerized environments. They lacked the detailed context needed to understand not just what a program was doing, but how it was doing it, when it happened, and what resources it was using. To solve this, researchers Ammar Moustafa, Ali Younes, and Balsam Eid created a new, highly detailed dataset called CHASE. This collection contains nearly 5,000 distinct records of computer activity, capturing both normal operations and specific, harmful attacks. The dataset was built in a controlled laboratory setting that mimics real-world cloud environments, ensuring that the data reflects the complexity of modern computing. It includes traces from 4,482 normal sessions and 498 harmful ones, covering a wide range of scenarios from container escapes to attacks on artificial intelligence resources.

What makes CHASE different is the depth of information it records for every single event. Instead of just listing the commands a program issued, the dataset captures the time each command took, the specific process and thread that issued it, and the state of the computer's resources like memory and network usage at that exact moment. It also includes metadata about the container itself, providing a full picture of the environment in which the activity occurred. The harmful traces were carefully constructed to represent twenty-two specific attack scenarios based on known security flaws and nine different families of attacks, such as command injection and resource hijacking. Crucially, the normal activity in the dataset was not just empty background noise; it included real, complex workloads involving web servers, databases, and artificial intelligence tasks. This ensures that the security systems being tested have to distinguish between dangerous behavior and the messy, varied reality of legitimate computer use.

The researchers tested this new dataset by feeding it into several different types of artificial intelligence models designed to spot anomalies. They used rigorous methods to ensure the results were reliable, such as testing the models on attack types they had never seen before and checking if the models could still work when the data came from a different computer environment. The results showed that the dataset was highly effective. A model called Random Forest, which uses a collection of decision trees to make predictions, achieved a very high score in distinguishing between normal and harmful activity. More importantly, when the researchers tested the model's ability to generalize, it performed exceptionally well across most unseen attack families. In a test where the model was trained on all attack types except one, it achieved near-perfect accuracy for several families, such as Network Interception and Command Injection, though performance varied for others, with the Web Injection family scoring lower at 0.8204. This suggests that the dataset captures the underlying behavioral patterns of attacks so well that a security system can learn to recognize new threats without having seen them before, although detection effectiveness can depend on the specific attack type.

The study also examined which parts of the data were most important for detection. By removing different groups of information, such as the timing details or the structural details of the commands, the researchers found that the behavioral features were the most critical for identifying attacks. While the timing of events helped, the core actions and the way the program interacted with the system were the primary indicators of danger. The dataset also proved its value by helping to show the limitations of unsupervised learning, where a system tries to find bad actors without being told what they look like. In these tests, the models struggled significantly, highlighting that for this specific type of security problem, having labeled examples of attacks is essential for success.

Ultimately, the CHASE dataset provides a robust foundation for developing and testing the next generation of security tools for containerized clouds. It moves beyond simple lists of commands to offer a rich, contextual view of computer behavior, allowing researchers to build systems that are better equipped to handle the complex, evolving landscape of cyber threats. The work demonstrates that with the right kind of data, it is possible to create detection systems that are not only accurate but also adaptable to new and unseen dangers. This advancement is a significant step toward securing the infrastructure that powers much of the modern internet, ensuring that the shared nature of container technology does not become a weakness for the systems that rely on it.