Runtime detection of vulnerabilities in software containers

A non-transitory computer readable medium having stored thereon instructions for causing a processing system to execute a process for detecting vulnerabilities in software containers during runtime at runtime, the process comprising:

• intercepting a request to instantiate a new software container in a first execution environment;
• creating a second execution environment, wherein the second execution environment is separated from the first execution environment, wherein the second execution environment includes a dummy software container and a detector software container, wherein the dummy software container is configured to trap an attempt to infect other software containers with a malicious code generated by the new software container;
• migrating the new software container from the first execution environment to the second execution environment for execution therein;
• intercepting, by the detector software, communications between the new software container and the dummy software container in the second execution environment;
• monitoring the operation of the new software container in the second execution environment to detect at least one unauthorized action, wherein the monitoring further comprises determining that the at least one unauthorized action has been attempted based on the intercepted communications between the new software container and the dummy container in the second execution environment;
• and
• upon detection of the at least one unauthorized action, generating a detection event identifying at least a type of vulnerability associated with the detected unauthorized action.

A host device for detecting vulnerabilities in software containers at runtime, comprising:

• a processing system;
• and
• a memory, the memory containing instructions that, when executed by the processing system, configure the host device to:
• intercept a request to instantiate a new software container in a first execution environment;
• create a second execution environment, wherein the second execution environment is separated from the first execution environment, wherein the second execution environment includes a dummy software container and a detector software container, wherein the dummy software container is configured to trap an attempt to infect other software containers with a malicious code generated by the new software container;
• migrate the new software container from the first execution environment to the second execution environment for execution therein;
• intercept, by the detector software, communications between the new software container and the dummy software container in the second execution environment;
• monitor the operation of the new software container in the second execution environment to detect at least one unauthorized action, wherein the monitoring includes determining that the at least one unauthorized action has been attempted based on the communications between the new software container and the dummy software container in the second execution environment;
• and
• upon detection of the at least one unauthorized action, generate a detection event identifying at least a type of vulnerability associated with the detected unauthorized action.