Detecting microservice security attacks based on metric sensitive dependencies
A process includes aggregating a time sequence of samples. Each sample has a plurality of dimensions that correspond to respective metrics that are associated with a microservice. Each sample includes, for each dimension, a measurement of the metric that corresponds to the dimension. The process includes identifying a given sample of the time sequence of samples based on measurements of first samples of the time sequence of samples and determining a sensitivity dependency of the metrics based on the measurements of the given sample. The process includes determining whether the microservice has been subjected to a security attack based on the sensitive dependency.
1 . A non-transitory machine-readable storage medium that stores machine-readable instructions that, when executed by a hardware processor, cause a peripheral of a computer platform to:
detect whether a microservice executing on a host of the computer platform has been subjected to a security attack based on an analysis of metric data associated with the microservice, wherein detecting the security attack comprises the peripheral:
accessing, by a service mesh, measurements of metrics associated with the microservice, wherein the metrics are associated with respective dimensions of a plurality of dimensions;
time sampling the measurements to provide a time sequence of samples, wherein each sample of the time sequence of samples has the plurality of dimensions, and each sample of the time sequence of samples comprises, for each dimension of the plurality of dimensions, a measurement of the metric that corresponds to the dimension;
determining statistics of the measurements of first samples of the time sequence of samples;
based on the statistics, determining that a given sample of the time sequence of samples corresponds to a microburst event;
determining coefficients of variation for respective measurements of the given sample;
determining a sensitive dependency based on a range of the coefficients of variation;
determining that the microservice has been subjected to the security attack based on the sensitive dependency; and
initiate a responsive action responsive to determining that the microservice has been subjected to the security attack.
2 . The storage medium of claim 1 , wherein:
the statistics comprises means and standard deviations of the first samples;
the instructions, when executed by the hardware processor, further cause the peripheral to:
determine expected ranges for respective measurements of the given sample; and
responsive to determining that at least one measurement of the respective measurements is outside of the respective range, identifying the given sample as corresponding to the microburst event.
3 . The storage medium of claim 1 , wherein the instructions, when executed by the hardware processor, further cause the peripheral to:
for each dimension of the plurality of dimensions, determine a mean and a standard deviation of the measurements of the first samples corresponding to the dimension;
based on the means and standard deviations, determine an expected measurement range corresponding to each dimension of the plurality of dimensions;
for each dimension of the plurality of dimensions, compare the measurement of the given sample associated with the dimension to the measurement range corresponding to the dimension to determine a given result; and
based on the given result, determine that the given sample corresponds to the microburst event.
4 . The storage medium of claim 3 , wherein the instructions, when executed by the hardware processor, further cause the peripheral to, for a given expected measurement range of the expected measurement ranges:
determine a predicted coefficient of variation for the measurement corresponding to the given expected measurement range based on a first mean of the means and a first standard deviation of the standard deviations; and
determine the expected measurement range based on the first mean and the predicted coefficient of variation.
5 . The storage medium of claim 3 , wherein the instructions, when executed by the hardware processor, further cause the peripheral to modulate boundaries defining the expected measurement range based on a tuning parameter.
6 . The storage medium of claim 1 , wherein the instructions, when executed by the hardware processor, further cause the peripheral to, responsive to a determination of the security attack, initiate inspection of a binary image associated with the microservice.
7 . The storage medium of claim 6 , wherein the instructions, when executed by the hardware processor, further cause the peripheral to:
modulate boundaries defining an expected measurement range based on a tuning parameter;
initiate the inspection of the binary image; and
responsive to the inspection determining that the binary image is valid, adjust the tuning parameter.
8 . The storage medium of claim 1 , wherein the metrics comprise at least one of a CPU utilization of the microservice, an ephemeral storage utilization of the microservice, a memory utilization of the microservice, or a network utilization of the microservice.
9 . A computer platform comprising:
a host processor to execute instructions associated with an application operating environment, and execute instructions to provide a microservice associated with the application operating environment; and
a smart input/output (I/O) peripheral to provide an I/O service and detect whether the microservice has been subjected to a security attack based on an analysis of metric data associated with the microservice, wherein the smart I/O peripheral comprises:
a service mesh interface to access measurements of metrics associated with the microservice, wherein the metrics are associated with respective dimensions of a plurality of dimensions; and
an observation engine to:
aggregate a time series of measurement vectors, wherein each measurement vector of the time series of measurement vectors has the plurality of dimensions, and each measurement vector of the time sequence of vectors comprises, for each dimension of the plurality of dimensions, a measurement of the associated metric corresponding to the dimension;
identify a given measurement vector of the time series of measurement vectors based on statistics derived from other measurement vectors of the time series of measurement vectors;
determine coefficients of variation of the measurements of the given measurement vector;
determine a sensitive dependency among the metrics based on the coefficients of variation; and
detect the security attack based on the sensitive dependency.
10 . The computer platform of claim 9 , wherein the observation engine to determine a maximum of the coefficients of variation, determine a minimum of the coefficients of variation, and determine the sensitive dependency based on the maximum and the minimum.
11 . The computer platform of claim 9 , wherein the observation engine to further:
determine expected ranges for the measurements of the given measurement vector based on statistics determined for other measurement vectors of the time sequence of measurement vectors;
for each dimension of the plurality of dimensions, compare the measurement of the given measurement vector associated with the dimension to an expected range of the expected ranges to determine a given result; and
identify the given measurement vector based on the given result results.
12 . The computer platform of claim 11 , wherein:
the time series of measurement vectors has an associated time sampling rate;
the observation engine modulates the expected ranges based on a behavior variation tolerance;
the observation engine determines whether to initiate an action to verify an integrity of the microservice based on a comparison of the sensitive dependency to a sensitivity dependency threshold;
the observation engine initiates the action of verify the integrity of the microservice; and
responsive to the action confirming the integrity of the microservice, the observation engine to modify at least one of the time sampling rate, the behavior variation tolerance or the sensitivity dependency threshold.