U-SCAD: An Unsupervised Method of System Call-Driven Anomaly Detection for Containerized Edge Clouds

Jiawei Ye, Ming Yan (), Shenglin Wu, Jingxuan Tan and Jie Wu ()
Additional contact information
Jiawei Ye: School of Computer Science, Fudan University, Shanghai 200438, China
Ming Yan: School of Computer Science, Fudan University, Shanghai 200438, China
Shenglin Wu: School of Computer Science, Fudan University, Shanghai 200438, China
Jingxuan Tan: School of Computer Science, Fudan University, Shanghai 200438, China
Jie Wu: School of Computer Science, Fudan University, Shanghai 200438, China

Future Internet, 2025, vol. 17, issue 5, 1-23

Abstract: Container technology is currently one of the mainstream technologies in the field of cloud computing, yet its adoption in resource-constrained, latency-sensitive edge environments introduces unique security challenges. While existing system call-based anomaly-detection methods partially address these issues, they suffer from high false positive rates and excessive computational overhead. To achieve security and observability in edge-native containerized environments and lower the cost of computing resources, we propose an unsupervised anomaly-detection method based on system calls. This method filters out unnecessary system call data through automatic rule generation and an unsupervised classification model. To increase the accuracy of anomaly detection and reduce the false positive rates, this method embeds system calls into sequences using the proposed Syscall2vec and processes the remain sequences in favor of the anomaly detection model’s analysis. We conduct experiments using our method with a background based on modern containerized cloud microservices. The results show that the detection part of our method improves the F1 score by 23.88% and 41.31%, respectively, as compared to HIDS and LSTM-VAE. Moreover, our method can effectively reduce the original processing data to 13%, which means that it significantly lowers the cost of computing resources.

Keywords: anomaly detection; container security; system calls; edge computing (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/17/5/218/pdf (application/pdf)
https://www.mdpi.com/1999-5903/17/5/218/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:17:y:2025:i:5:p:218-:d:1655398

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().