Container life cycle management with honeypot service
The life cycle of one or more containers related to one or more containerized applications is managed by determining that a predefined retention time for a first container of the plurality of containers has elapsed; in response to the determining, performing the following honeypot container creation steps: suspending new session traffic to the first container; maintaining the first container as a honeypot container; and identifying communications sent to the honeypot container as an anomalous communication. Alert notifications are optionally generated for the anomalous communication.
1. A method for managing a plurality of containers, comprising:
determining that a predefined retention time for a first container of the plurality of containers has elapsed;
in response to the determining that the predefined retention time for the first container of the plurality of containers has elapsed, performing the following honeypot container creation steps, using at least one processing device:
suspending new session traffic to the first container;
waiting for a predefined session dilution time before maintaining the first container as a honeypot container; and
identifying one or more communications sent to the honeypot container as anomalous communications for subsequent analysis.
2. The method of claim 1 , wherein said honeypot container creation steps further comprise the step of obtaining a new container to replace the first container using a golden container.
3. The method of claim 2 , wherein the first container is associated with a first Internet Protocol (IP) address and a first media access control (MAC) address, and wherein the new container is associated with at least one of a different IP address and a different MAC address.
4. The method of claim 2 , wherein the first container and the new container are associated with a same application type.
5. The method of claim 1 , wherein said honeypot container creation steps further comprise the step of generating an alert notification of the anomalous communication.
6. The method of claim 1 , wherein said step of suspending new session traffic to the first container is performed by a load balancer.
7. The method of claim 1 , wherein said honeypot container is maintained for a configurable period of time.
8. A system, comprising:
a memory; and
at least one processing device, coupled to the memory, operative to implement the following steps:
determining that a predefined retention time for a first container of the plurality of containers has elapsed;
in response to the determining that the predefined retention time for the first container of the plurality of containers has elapsed, performing the following honeypot container creation steps, using said at least one processing device:
suspending new session traffic to the first container;
waiting for a predefined session dilution time before maintaining the first container as a honeypot container; and
identifying one or more communications sent to the honeypot container as anomalous communications for subsequent analysis.
9. The system of claim 8 , wherein said honeypot container creation steps further comprise the step of obtaining a new container to replace the first container using a golden container.
10. The system of claim 9 , wherein the first container is associated with a first Internet Protocol (IP) address and a first media access control (MAC) address, and wherein the new container is associated with at least one of a different IP address and a different MAC address.
11. The system of claim 9 , wherein the first container and the new container are associated with a same application type.
12. The system of claim 8 , wherein said honeypot container creation steps further comprise the step of generating an alert notification of the anomalous communication.
13. The system of claim 8 , wherein said step of suspending new session traffic to the first container is performed by a load balancer.
14. The system of claim 8 , wherein said honeypot container is maintained for a configurable period of time.
15. A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
determining that a predefined retention time for a first container of the plurality of containers has elapsed;
in response to the determining that the predefined retention time for the first container of the plurality of containers has elapsed, performing the following honeypot container creation steps, using at least one processing device:
suspending new session traffic to the first container;
waiting for a predefined session dilution time before maintaining the first container as a honeypot container; and
identifying one or more communications sent to the honeypot container as anomalous communications for subsequent analysis.
16. The computer program product of claim 15 , wherein said honeypot container creation steps further comprise the step of obtaining a new container to replace the first container using a golden container, wherein the first container is associated with a first Internet Protocol (IP) address and a first media access control (MAC) address, and wherein the new container is associated with at least one of a different IP address and a different MAC address.
17. The computer program product of claim 15 , wherein said honeypot container creation steps further comprise the step of generating an alert notification of the anomalous communication.
18. The computer program product of claim 15 , wherein said honeypot container is maintained for a configurable period of time.
19. The computer program product of claim 15 , wherein said honeypot container creation steps further comprise the step of obtaining a new container to replace the first container using a golden container.
20. The computer program product of claim 15 , wherein said step of suspending new session traffic to the first container is performed by a load balancer.