Malware Detection in Docker Containers: An Image is Worth a Thousand Logs
It addresses security threats from malicious software injection in containers, which is a domain-specific problem, but the method is incremental as it adapts existing CNN architectures to a new data format.
The paper tackles malware detection in Docker containers by converting container file systems into RGB images and applying convolutional neural networks, achieving higher F1 and Recall scores than VirusTotal engines on a new dataset of 3364 images.
Malware detection is increasingly challenged by evolving techniques like obfuscation and polymorphism, limiting the effectiveness of traditional methods. Meanwhile, the widespread adoption of software containers has introduced new security challenges, including the growing threat of malicious software injection, where a container, once compromised, can serve as entry point for further cyberattacks. In this work, we address these security issues by introducing a method to identify compromised containers through machine learning analysis of their file systems. We cast the entire software containers into large RGB images via their tarball representations, and propose to use established Convolutional Neural Network architectures on a streaming, patch-based manner. To support our experiments, we release the COSOCO dataset--the first of its kind--containing 3364 large-scale RGB images of benign and compromised software containers at https://huggingface.co/datasets/k3ylabs/cosoco-image-dataset. Our method detects more malware and achieves higher F1 and Recall scores than all individual and ensembles of VirusTotal engines, demonstrating its effectiveness and setting a new standard for identifying malware-compromised software containers.