Federated abnormal process detection for kubernetes clusters

A non-transitory computer-readable medium in a Kubernetes node agent on a data communication network, for federated abnormal process detection in Kubernetes clusters, the method comprising:

• requesting a baseline of behavior for a set of containers utilized by a Kubernetes manager server from a cluster agent;
• monitoring processes running on the set containers and network traffic generated by the set of containers, to identify anomalous behavior relative to the baseline;
• configuring container updates received from the Kubernetes manager server that registers containers for distribution to a plurality Kubernetes managers concerning a new version of the set of containers;
• subsequent to the container updates, and responsive to detecting the anomalous behavior exceeds a threshold for a specific container, sending anomalous data to the cluster agent including an identification and version of the specific container and a description of abnormal behavior, wherein the cluster agent determines a new rule is necessary to define the new behavior and distributes the new rule to the plurality of Kubernetes managers that are affected;
• receiving the new rule and implementing the new rule with respect to the container updates while running processes;
• and
• taking action based on analysis.

A Kubernetes node agent on a data communication network, for federated abnormal process detection in Kubernetes clusters, the Kubernetes node agent comprising:

• a processor;
• a network interface communicatively coupled to the processor and to a data communication network;
• and
• a memory, communicatively coupled to the processor and storing:
• a baseline module to receive a baseline of behavior for a set of containers utilized by a Kubernetes manager server from a cluster agent;
• monitoring processes running on the set containers and network traffic generated by the set of containers, to identify anomalous behavior relative to the baseline;
• configuring container updates received from the Kubernetes manager server that that registers containers for distribution to a plurality Kubernetes managers concerning a new version of the set of containers;
• subsequent to the container updates, and responsive to detecting the anomalous behavior exceeds a threshold for a specific container, sending anomalous data to the cluster agent including an identification and version of the specific container and a description of abnormal behavior, wherein the cluster agent determines a new rule is necessary to define the new behavior and distributes the new rule to the plurality of Kubernetes managers that are affected;
• receiving the new rule and implementing the new rule with respect to the container updates while running processes;
• and
• taking action based on analysis.