Storage system based threat detection and remediation for containers
A storage system, associated with a container system, may be configured to perform a method that includes: providing, by a storage system, storage services to a container system; determining, by the storage system and based on the providing the storage services to the container system, a potential security threat; and performing, by the storage system, a remedial action based on the potential security threat.
1. A method comprising:
providing, by a storage system, a container image stored within a layer of a volume to a container system;
identifying, by the storage system, an anomalous pattern of storage operations associated with a container instance of the container image, wherein the container instance is deployed at the container system;
determining, by the storage system and based on the anomalous pattern of storage operations, a potential security threat for the container instance of the container image; and
performing, by the storage system, a remedial action for the container system based on the potential security threat.
2. The method of claim 1 , wherein the providing the container image comprises:
providing storage to a container, wherein the volume comprises the storage.
3. The method of claim 1 , wherein the determining the potential security threat comprises:
determining, based on one or more threat signatures, that storage data associated with the providing the container image comprises the potential security threat, wherein the potential security threat comprises ransomware.
4. The method of claim 3 , wherein the performing the remedial action comprises:
initiating one or more remedial operations directed at storage data comprising the ransomware.
5. The method of claim 1 , wherein the determining the potential security threat comprises:
determining, using a machine learning model, that one or more storage operations are indicative of the potential security threat, wherein the one or more storage operations are associated with the volume.
6. The method of claim 1 , wherein the performing the remedial action comprises:
providing a notification to a container orchestrator, wherein the notification indicates the potential security threat, and wherein the container orchestrator operates within the container system.
7. The method of claim 1 , wherein the determining the potential security threat comprises identifying an anomalous pattern of storage operations associated with the volume.
8. A system comprising:
one or more memories storing computer-executable instructions; and
one or more processors to execute the computer-executable instructions to:
provide, by a storage system, a container image stored within a layer of a volume to a container system;
identify, by the storage system, an anomalous pattern of storage operations associated with a container instance of the container image, wherein the container instance is deployed at the container system;
determine, by the storage system and based on the anomalous pattern of storage operations, a potential security threat for the container instance of the container image; and
perform, by the storage system, a remedial action for the container system based on the potential security threat.
9. The system of claim 8 , wherein, to provide the container image, the one or more processors further execute the computer-executable instructions to:
provide storage to a container, wherein the volume comprises the storage.
10. The system of claim 9 , wherein, to determine the potential security threat, the one or more processors further execute the computer-executable instructions to:
determine, based on one or more threat signatures, that storage data associated with the providing the container image to the container system comprises the potential security threat, wherein the potential security threat comprises ransomware.
11. The system of claim 10 , wherein the one or more processors further execute the computer-executable instructions to:
initiate one or more remedial operations directed at storage data comprising the ransomware.
12. The system of claim 8 , wherein, to determine the potential security threat, the one or more processors further execute the computer-executable instructions to:
determine, using a machine learning model, that one or more storage operations are indicative of the potential security threat, wherein the one or more storage operations are associated with the volume.
13. The system of claim 8 , wherein, to perform the remedial action, the one or more processors further execute the computer-executable instructions to:
provide a notification to a container orchestrator, wherein the notification indicates the potential security threat, and wherein the container orchestrator operates within the container system.
14. The system of claim 8 , wherein, to determine the potential security threat, the one or more processors further execute the computer-executable instructions to identify an anomalous pattern of storage operations associated with the volume.
15. A non-transitory, computer-readable medium storing computer-executable instructions that, when executed, direct one or more processors of one or more computing devices to:
provide, by a storage system, a container image stored within a layer of a volume to a container system;
identify, by the storage system, an anomalous pattern of storage operations associated with a container instance of the container image, wherein the container instance is deployed at the container system;
determine, by the storage system and based on the anomalous pattern of storage operations, a potential security threat for the container instance of the container image; and
perform, by the storage system, a remedial action for the container system based on the potential security threat.
16. The non-transitory, computer-readable medium of claim 15 , wherein, to provide the container image, the one or more processors further execute the computer instructions to:
provide storage to a container, wherein the volume comprises the storage.
17. The non-transitory, computer-readable medium of claim 16 , wherein, to determine the potential security threat, the one or more processors further execute the computer-executable instructions to:
determine, based on one or more threat signatures, that storage data associated with the providing the container image to the container system comprises the potential security threat, wherein the potential security threat comprises ransomware.
18. The non-transitory, computer-readable medium of claim 17 , wherein the one or more processors further execute the computer-executable instructions to:
initiate one or more remedial operations directed at storage data comprising the ransomware.
19. The non-transitory, computer-readable medium of claim 15 , wherein, to determine the potential security threat, the one or more processors further execute the computer-executable instructions to:
determine, using a machine learning model, that one or more storage operations are indicative of the potential security threat, wherein the one or more storage operations are associated with the volume.
20. The non-transitory, computer-readable medium of claim 15 , wherein, to determine the potential security threat, the one or more processors further execute the computer-executable instructions to identify an anomalous pattern of storage operations associated with the volume.