Container life cycle management with retention rate adjustment based on detected anomalies

1. A method for managing a plurality of containers, comprising:

monitoring an execution of one or more containers;

determining that a given one of the one or more containers exhibits anomalous behavior; and

in response to the determining, adjusting a retention time specifying a configured lifespan of the given container exhibiting anomalous behavior to an interval between deployment of the given container and the time of the determining, using at least one processing device, wherein the retention time of the given container exhibiting anomalous behavior determines when the given container is one or more of terminated and changes role to a honeypot container.

2. The method of claim 1 , wherein the anomalous behavior comprises the given container exhibiting behavior that is different than a learned baseline model of the given container.

3. The method of claim 2 , wherein the baseline model of the behavior of the given container is learned by monitoring the execution of the given container during a learning mode.

4. The method of claim 1 , wherein the step of adjusting the retention time of the given container comprises adjusting the retention time of the given container by a predefined amount.

5. The method of claim 1 , wherein the step of adjusting the retention time of the given container comprises adjusting the retention time of the given container based on a risk assessment associated with the anomalous behavior.

6. The method of claim 1 , further comprising the step of generating an alert notification of the anomalous behavior.

7. The method of claim 1 , further comprising the step of obtaining a new container to replace the given container, wherein the given container is associated with a first Internet Protocol (IP) address and a first media access control (MAC) address, and wherein the new container is associated with at least one of a different IP address and a different MAC address.

8. The method of claim 1 , wherein the step of adjusting the retention time of the given container comprises adjusting the retention time of the given container based on a risk assessment associated with the anomalous behavior.

9. A system, comprising:

a memory; and

at least one processing device, coupled to the memory, operative to implement the following steps:

monitoring an execution of one or more containers;

determining that a given one of the one or more containers exhibits anomalous behavior; and

in response to the determining, adjusting a retention time specifying a configured lifespan of the given container exhibiting anomalous behavior to an interval between deployment of the given container and the time of the determining, using at least one processing device, wherein the retention time of the given container exhibiting anomalous behavior determines when the given container is one or more of terminated and changes role to a honeypot container.

10. The system of claim 9 , wherein the anomalous behavior comprises the given container exhibiting behavior that is different than a learned baseline model of the given container.

11. The system of claim 10 , wherein the baseline model of the behavior of the given container is learned by monitoring the execution of the given container during a learning mode.

12. The system of claim 9 , wherein the step of adjusting the retention time of the given container comprises adjusting the retention time of the given container by a predefined amount.

13. The system of claim 9 , wherein the step of adjusting the retention time of the given container comprises adjusting the retention time of the given container based on a risk assessment associated with the anomalous behavior.

14. The system of claim 9 , further comprising the step of generating an alert notification of the anomalous behavior.

15. The system of claim 9 , further comprising the step of obtaining a new container to replace the given container, wherein the given container is associated with a first Internet Protocol (IP) address and a first media access control (MAC) address, and wherein the new container is associated with at least one of a different IP address and a different MAC address.

16. A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

monitoring an execution of one or more containers;

determining that a given one of the one or more containers exhibits anomalous behavior; and

in response to the determining, adjusting a retention time specifying a configured lifespan of the given container exhibiting anomalous behavior to an interval between deployment of the given container and the time of the determining, using at least one processing device, wherein the retention time of the given container exhibiting anomalous behavior determines when the given container is one or more of terminated and changes role to a honeypot container.

17. The computer program product of claim 16 , wherein the anomalous behavior comprises the given container exhibiting behavior that is different than a learned baseline model of the given container.

18. The computer program product of claim 17 , wherein the baseline model of the behavior of the given container is learned by monitoring the execution of the given container during a learning mode.

19. The computer program product of claim 16 , wherein the step of adjusting the retention time of the given container comprises adjusting the retention time of the given container by a predefined amount.

20. The computer program product of claim 16 , further comprising the step of obtaining a new container to replace the given container, wherein the given container is associated with a first Internet Protocol (IP) address and a first media access control (MAC) address, and wherein the new container is associated with at least one of a different IP address and a different MAC address.