Container anomaly detection using container profiles

1. A method, comprising:

obtaining at least one container and a corresponding container profile from a container registry, wherein the container profile characterizes an expected normal operation of at least one application executing in the at least one container and at least one metric indicating a resource usage of one or more of: (i) one or more processing resources, (ii) one or more memory resources, and (iii) one or more networking resources, wherein the at least one metric indicates resources expected to be employed by the at least one application executing in the at least one container during the expected normal operation;

comparing, using at least one processing device, a behavior of the at least one application executing in the at least one container to the expected normal operation in the corresponding container profile to determine if the at least one container exhibits anomalous behavior; and

providing, using said at least one processing device, a notification of the anomalous behavior when the at least one container exhibits the anomalous behavior.

2. The method of claim 1 , wherein the container profile is obtained by monitoring a behavior of one or more of (i) a plurality of versions of the at least one container, and (ii) the at least one application executing in the at least one container on a plurality of different container host devices.

3. The method of claim 1 , wherein the container profile characterizes one or more of system calls and ports expected to be employed by the at least one application executing in the at least one container during normal operation.

4. The method of claim 1 , wherein the container profile further characterizes file system metrics expected to be employed by the at least one application executing in the at least one container during normal operation.

5. The method of claim 1 , wherein the container profile characterizes one or more environment variables expected to be employed by the at least one application executing in the at least one container during normal operation.

6. The method of claim 1 , wherein the step of providing a notification of the anomalous behavior further comprises one or more steps of requesting a user to specify a next action, implementing a predefined user policy, and suspending further execution of the at least one container.

7. The method of claim 1 , wherein the comparing step is performed in response to the obtaining of the at least one container from the container registry.

8. The method of claim 1 , wherein a learning period of the at least one container extends for a predetermined number of lifecycles of the at least one container.

9. A system, comprising:

a memory; and

at least one processing device, coupled to the memory, operative to implement the following steps:

obtaining at least one container and a corresponding container profile from a container registry, wherein the container profile characterizes an expected normal operation of at least one application executing in the at least one container and at least one metric indicating a resource usage of one or more of: (i) one or more processing resources, (ii) one or more memory resources, and (iii) one or more networking resources, wherein the at least one metric indicates resources expected to be employed by the at least one application executing in the at least one container during the expected normal operation;

comparing, using at least one processing device, a behavior of the at least one application executing in the at least one container to the expected normal operation in the corresponding container profile to determine if the at least one container exhibits anomalous behavior; and

providing, using said at least one processing device, a notification of the anomalous behavior when the at least one container exhibits the anomalous behavior.

10. The system of claim 9 , wherein the container profile is obtained by monitoring a behavior of one or more of (i) a plurality of versions of the at least one container, and (ii) the at least one application executing in the at least one container on a plurality of different container host devices.

11. The system of claim 9 , wherein the container profile characterizes one or more of system calls and ports expected to be employed by the at least one application executing in the at least one container during normal operation.

12. The system of claim 9 , wherein the container profile further characterizes file system metrics expected to be employed by the at least one application executing in the at least one container during normal operation.

13. The system of claim 9 , wherein the container profile characterizes one or more environment variables expected to be employed by the at least one application executing in the at least one container during normal operation.

14. The system of claim 9 , wherein the step of providing a notification of the anomalous behavior further comprises one or more steps of requesting a user to specify a next action, implementing a predefined user policy, and suspending further execution of the at least one container.

15. The system of claim 9 , wherein the comparing step is performed in response to the obtaining of the at least one container from the container registry.

16. A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

obtaining at least one container and a corresponding container profile from a container registry, wherein the container profile characterizes an expected normal operation of at least one application executing in the at least one container and at least one metric indicating a resource usage of one or more of: (i) one or more processing resources, (ii) one or more memory resources, and (iii) one or more networking resources, wherein the at least one metric indicates resources expected to be employed by the at least one application executing in the at least one container during the expected normal operation;

comparing, using at least one processing device, a behavior of the at least one application executing in the at least one container to the expected normal operation in the corresponding container profile to determine if the at least one container exhibits anomalous behavior; and

providing, using said at least one processing device, a notification of the anomalous behavior when the at least one container exhibits the anomalous behavior.

17. The computer program product of claim 16 , wherein the container profile is obtained by monitoring a behavior of one or more of (i) a plurality of versions of the at least one container, and (ii) the at least one application executing in the at least one container on a plurality of different container host devices.

18. The computer program product of claim 16 , wherein the container profile characterizes one or more of system calls and ports expected to be employed by the at least one application executing in the at least one container during normal operation.

19. The computer program product of claim 16 , wherein the step of providing a notification of the anomalous behavior further comprises one or more steps of requesting a user to specify a next action, implementing a predefined user policy, and suspending further execution of the at least one container.

20. The computer program product of claim 16 , wherein the comparing step is performed in response to the obtaining of the at least one container from the container registry.