A Study on Early & Non-Intrusive Security Assessment for Container Images

Mubin Haque, Mubin Haque, Muhammad Ali Babar, Muhammad Ali Babar, Muhammad Ali Babar

2023

Abstract

The ubiquitous adoption of container images to virtualize the software contents bring significant attention in its security configuration due to intricate and evolving security issues. Early security assessment of container images can prevent and mitigate security attacks on containers, and enabling practitioners to realize the secured configuration. Using security tools, which operate in intrusive manner in the early assessment, raise critical concern in its applicability where the container image contents are considered as highly sensitive. Moreover, the sequential steps and manual intervention required for using the security tools negatively impact the development and deployment of container images. In this regard, we aim to empirically investigate the effectiveness of Open Container Initiative (OCI) properties with the Machine Learning (ML) models to assess the security without peeking inside the container images. We extracted OCI properties from 1,137 real-world container images and investigated six traditional ML models with different OCI properties to identify the optimal ML model and its generalizability. Our empirical results show that the ensemble ML models provide the optimal performance to assess the container image security when the model is built with all the OCI properties. Our empirical evidence will guide practitioners in the early security assessment of container images in non-intrusive way as well as reducing the manual intervention required for using security tools to assess the security of container images.

Paper Citation

in Harvard Style

Haque M. and Ali Babar M. (2023). A Study on Early & Non-Intrusive Security Assessment for Container Images. In Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE, ISBN 978-989-758-647-7, SciTePress, pages 640-647. DOI: 10.5220/0011987900003464

in Bibtex Style

@conference{enase23,
author={Mubin Haque and Muhammad Ali Babar},
title={A Study on Early & Non-Intrusive Security Assessment for Container Images},
booktitle={Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE,},
year={2023},
pages={640-647},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011987900003464},
isbn={978-989-758-647-7},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE,
TI - A Study on Early & Non-Intrusive Security Assessment for Container Images
SN - 978-989-758-647-7
AU - Haque M.
AU - Ali Babar M.
PY - 2023
SP - 640
EP - 647
DO - 10.5220/0011987900003464
PB - SciTePress