Deceptive strategies to reduce data volumes in a Kubernetes SOC - a quantitative comparison
Taming data volumes with hkoney
Securing cloud-native systems requires comprehensive data over long timespans, often overwhelming operations with data volume, noise, and cost. We present an open-source K8s Security Operations Center, composed of eBPF projects (CNCF Kubescape, Pixie, Tetragon and Koney) and show how detection strategies compare in their signal-to-noise ratio relative to data volume.
Our goal is finding the ideal balance between detection quality and data volume; thus we collect statistics for 3 approaches: static, adaptive and adaptive-deceptive. We critically compare definitions and demonstrate how relying on strong indicators of compromise such as honeytokens improves detection. Along a concrete attack tree, we reason on the strategic placement and role of deception in our anomaly detection framework. Architects, SREs, and security professionals can leverage our analysis to choose effective data capturing strategies and how to build cost-efficient SOCs using existing open-source eBPF projects.
Meet our OpenSource Friends
Today, we will be using open-source tooling and Constanze expressely thanks the maintainers of those projects.
Lets introduce our ♥️ friends ( more academically speaking: the instrumentation abstractions that will give us orthogonal data and/or controls)
Adding another musketeer, we re starting to run low on them
Pixie, Kubescape, Tetragon
In order of appearance, they are
Kubescape as The Scout : scans everything
- finds vulnerabilities and misconfigurations
- can learn baselines of applications
- alerts on anomaly
🤝 You ll meet it when: wedefine anomaliesas first class citizens
Pixie as The Tracer : understands (almost) all protocols
- real time debugger
- introspects protocols (SQL, DNS, HTTP, KAFKA, REDIS...) in real time
- 100% souvereign -> collects data into analysis cockpit without data ever being stored your DC
- manages real time distributed deployment of on-demand eBPF traces
🤝 You ll meet it when: wezoom in to sniff trafficsto triage anomalies
Tetragon as The Sniper: ultra specific targeting of identified objectives (in the kernel)
- abstracts eBPF into yaml
- useful if you know what you are looking for
- provides guarantees against rate-limiting
🤝 You ll meet it when: wespecifically monitor ongoing threatsto create evidence
Koney as The Deceiver: places traps for us to identify the attackers faster
- places honeytokens
- handles the alerts
🤝 You ll meet it when: weplace tokens in the attackers pathto further collapse degenerate threat-models
About the Author
Writes about
Frequently covers
More tutorials you might like
Papercompanion for APL Center of Geospace Storms
OpenScience Demo content: How to capture a massive piece of high-performance compute (HPC) code named Kaiju and Gamera in a Container
Native SSH Access with Pomerium
Pomerium can be used as a native SSH reverse proxy, adding OAuth authentication and flexible Pomerium policy enforcement to standard SSH connections, without the need for tunnels, or custom clients or servers.
Native SSH Reverse Tunneling with Pomerium
Use Pomerium's native SSH support to publish a local service through a standard reverse SSH tunnel, with OpenID Connect (OIDC) authentication and continuous authorization on every request. Reach services behind Network Address Translation (NAT) without firewall holes or custom agents, and control both who can use the service and who can open the tunnel. Application traffic stays on infrastructure you control.
Secure Machine-to-Machine Access with mTLS and Pomerium
Run a GitHub Actions-compatible continuous integration (CI) job on a private runner and protect its internal API call with mutual TLS (mTLS) and Pomerium. Build separate server and client trust chains, authorize one machine certificate by fingerprint, then revoke, restore, and rotate its credentials through live policy changes.
Learn by doing, not just by reading or watching
Sign up for a free account to start a VM playground right on this page, track your progress, and get notified about new learning materials.