Work

DeSFAM: An Adaptive eBPF and AI-Driven Framework for Securing Cloud Containers in Real Time

Year: 2025

Type: article

Abstract: Containerized applications offer lightweight and scalable deployment but remain exposed to security risks due to a shared kernel. We present DeSFAM (Dynamic eBPF-driven Syscall Filtering and Anomaly Mitigation), a real-time security framework that enforces least-privilege syscall usage and detects behavioral anomalies. DeSFAM integrates: (i) hybrid syscall profiling through static analysis and dynamic eBPF tracing; (ii) SyscallAD (System call Anomaly Detection), a low-latency anomaly detector combining Variational Autoencoder (VAE) and Isolation Forest (iForest); (iii) contextual risk scoring based on MITRE ATT&CK mappings and CVE correlations; and (iv) adaptive syscall enforcement using eBPF maps and LSM hooks. Evaluations using the DongTing dataset and real-world CVE attack scenarios show DeSFAM achieves 94% precision, 90% recall, sub-millisecond enforcement latency, and less than 1% performance overhead. DeSFAM effectively blocks privilege escalation, container escape attempts, and syscall injection attacks in modern container environments.

Source: IEEE Access

DOI: 10.1109/access.2025.3592192

Authors: Sehar Zehra, Hassan Jamil Syed, Fahad Samad, Ummay Faseeha

Institutions: National University of Computer and Emerging Sciences, Asia Pacific University of Technology & Innovation

Language: English

Topic: Security and Verification in Computing

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,075

Funder: Asia Pacific University of Technology and Innovation