System and method for container assessment using sandboxing

A computing device comprising:

• memory;
• and
• a processor operatively connected to the memory, the processor configured to:
• instantiate the following in a sandbox of a computing device:
• an operating system, a Berkeley Packet Filter (BPF) virtual machine within a kernel of the operating system, and a software container, the sandbox corresponding to a virtual machine that is different from the BPF virtual machine;
• monitor runtime behavior events of the software container, wherein to monitor the runtime behavior events, the processor is configured to:
• monitor at least one first type of behavior of the software container by the BPF virtual machine;
• and
• monitor, by the kernel but outside of the BPF virtual machine, a second type of behavior of the software container that is different from the at least one first type of behavior;
• assign, based on the monitoring of the at least one first type of behavior and the second type of behavior of the software container, a respective risk score to each of the runtime behavior events that is potentially malicious, each risk score indicating a likelihood that a corresponding behavior event is malicious;
• and
• assign an overall risk score to the software container that indicates a likelihood that the software container is malicious based on a highest severity risk score of the respective risk scores.