Summary

Detecting cyber attacks on containerized applications using unsupervised graph-based ML algorithms. Built dataset with syscall traces and network traffic for 3 containerized applications across 3 scenarios (regular, cryptomining, backdoor). Uses graph translation, random forest classifier, and ensemble of isolation forests.