CONTAINER SECURITY IN A CLOUD ENVIRONMENT

1 . A non-transitory computer-readable medium comprising stored instructions that, when executed by a computing system, cause the computing system to perform operations including:

receiving behavior data describing activities of a deployed container, the deployed container having been created using a container image;

identifying test data describing activities of a test container, the test container having been created using the container image;

detecting, based on a comparison of the behavior data and the test data, an anomaly in the activities of the deployed container;

determining whether the detected anomaly is associated with a malicious activity; and

responsive to the determination of whether the detected anomaly is associated with the malicious activity, performing a security action.

2 . The non-transitory computer-readable medium of claim 1 , wherein the operations further include:

receiving, from a client device, the container image;

creating the test container in a sandbox environment using the container image;

running the test container in the sandbox environment to generate the test data;

verifying the container image using the test data; and

responsive to verifying the container image, adding the container image to a verified images store, wherein creating the deployed container included retrieving the container image from the verified images store.

3 . The non-transitory computer-readable medium of claim 2 , wherein verifying the container image comprises:

comparing the activities of the test container to a database of known malicious activities; and

verifying the container image responsive to the activities of the test container not corresponding to know malicious activities.

4 . The non-transitory computer-readable medium of claim 2 , wherein verifying the container image comprises:

analyzing the test data to determine whether any of the activities of the test container correspond to previously unknown malicious behavior; and

verifying the container image responsive to none of the of the activities of the test container corresponding to previously unknown malicious behavior.

5 . The non-transitory computer-readable medium of claim 1 , wherein the malicious activity comprises accessing a known malicious web address or accessing a restricted area of memory.

6 . The non-transitory computer readable medium of claim 1 , wherein the operations further comprise:

inputting the behavior data of the deployed container into a machine learning model, the machine learning model trained to identify security threats using additional behavior data of other deployed containers; and

receiving, as an output from the machine learning model, a warning that the deployed container is vulnerable to an attack.

7 . The non-transitory computer-readable medium of claim 1 , wherein determining whether the detected anomaly is associated with a malicious activity comprises:

determining a classification of the detected anomaly; and

determining that the detected anomaly is associated with the malicious activity based on the classification.

8 . The non-transitory computer-readable medium of claim 1 , wherein the detected anomaly includes one or more behavioral violations, and determining whether the detected anomaly is associated with a malicious activity comprises:

analyzing the behavioral violations to generate, for each behavioral violation, a corresponding likelihood that the behavioral violation is associated with the malicious activity;

combining the corresponding likelihoods of the one or more behavioral violations to obtain a combined score; and

determine, based on the combined score, whether the anomaly is associated with the malicious activity.

9 . The non-transitory computer-readable medium of claim 1 , wherein the security action includes one or more of deleting the deployed container, quarantining the deployed container, suspending operations of the deployed container, or providing a notification of the anomaly for display to a user.

10 . The non-transitory computer readable medium of claim 1 , wherein the operations further include:

analyzing the behavior data to detect non-compliance of the deployed container with a policy of a cloud environment in which the deployed container is running; and

generating, responsive to detecting non-compliance of the deployed container with the policy, a notification for display to a user associated with the cloud environment.

11 . A method comprising:

receiving behavior data describing activities of a deployed container, the deployed container having been created using a container image;

identifying test data describing activities of a test container, the test container having been created using the container image;

detecting, based on a comparison of the behavior data and the test data, an anomaly in the activities of the deployed container;

determining whether the detected anomaly is associated with a malicious activity; and

responsive to the determination of whether the detected anomaly is associated with the malicious activity, performing a security action.

12 . The method of claim 11 , further comprising:

receiving, from a client device, the container image;

creating the test container in a sandbox environment using the container image;

running the test container in the sandbox environment to generate the test data;

verifying the container image using the test data; and

responsive to verifying the container image, adding the container image to a verified images store, wherein creating the deployed container included retrieving the container image from the verfied images store.

13 . The method of claim 12 , wherein verifying the container image comprises:

comparing the activities of the test container to a database of known malicious activities; and

verifying the container image responsive to the activities of the test container not corresponding to know malicious activities.

14 . The method of claim 12 , wherein verifying the container image comprises:

analyzing the test data to determine whether any of the activities of the test container correspond to previously unknown malicious behavior; and

verifying the container image responsive to none of the of the activities of the test container corresponding to previously unknown malicious behavior.

15 . The method of claim 11 , further comprising:

inputting the behavior data of the deployed container into a machine learning model, the machine learning model trained to identify security threats using additional behavior data of other deployed containers; and

receiving, as an output from the machine learning model, a warning that the deployed container is vulnerable to an attack.

16 . The method of claim 11 , wherein determining whether the detected anomaly is associated with a malicious activity comprises:

determining a classification of the detected anomaly; and

determining that the detected anomaly is associated with the malicious activity based on the classification.

17 . The method of claim 11 , wherein the detected anomaly includes one or more behavioral violations, and determining whether the detected anomaly is associated with a malicious activity comprises:

analyzing the behavioral violations to generate, for each behavioral violation, a corresponding likelihood that the behavioral violation is associated with the malicious activity;

combining the corresponding likelihoods of the one or more behavioral violations to obtain a combined score; and

determine, based on the combined score, whether the anomaly is associated with the malicious activity.

18 . The method of claim 11 , wherein the security action includes one or more of deleting the deployed container, quarantining the deployed container, suspending operations of the deployed container, or providing a notification of the anomaly for display to a user.

19 . The method of claim 11 , further comprising:

analyzing the behavior data to detect non-compliance of the deployed container with a policy of a cloud environment in which the deployed container is running; and

generating, responsive to detecting non-compliance of the deployed container with the policy, a notification for display to a user associated with the cloud environment.

20 . A container security system comprising:

one or more processors;

a container image vulnerability management module that, using the one or more processors:

generates test data describing activities of a test container, the test container having been created using a container image; and

verifies the container image responsive to the activities of the test container not corresponding to know malicious activities; and

a cloud detection and response module that:

receives behavior data describing activities of a deployed container, the deployed container having been created using the container image;

detects, based on a comparison of the behavior data and the test data, an anomaly in the activities of the deployed container;

determines whether the detected anomaly is associated with a malicious activity; and

responsive to the determination of whether the detected anomaly is associated with the malicious activity, performs a security action.