A Kubernetes dataset for misuse detection

Abstract

Container security involves a broad spectrum of concerns, including the security of the operating system, auditing the supply chain and the application security of the running containers. This wide attack surface will also include the security of the container orchestration system and its components once a container orchestration system is introduced to manage the fleet of containers in an environment. In order to advance the research in this field, prior work should be comparable and reproducible. However, we identified a research gap for this aspect; publicly available datasets for container security is sparse and reproducibility of the research output so far is arduous. In this study, we share a dataset consisting of network flows, collected from a Kubernetes cluster. Furthermore, we performed a preliminary analysis on the data as a sanity check to evaluate its quality. By sharing this dataset publicly, we hope to help further studies and establish benchmarks in the field of container networking security.