Citation :

Karthik Rao, 2026. "Detecting Excessive Service Permissions in Containerized Applications through Runtime Behaviour Analysis" ESP International Journal of Advancements in Science & Technology (ESP-IJAST)  Volume 4, Issue 3: 48-64.

Abstract :

Containerized applications are now a core component of today's cloud native infrastructure due to their benefits of portability, scalability, flexibility in deployment and efficient use of resources. As a result, there has been an explosion of container technology; however, this growth has also led to many security concerns. One of the main areas where these concerns lie is in regard to too many permissions being given to services and unauthorized access to system resources. Many times applications will have more permissions than they actually need to run properly. This creates greater opportunities for potential damage caused by compromised services, malicious actions or privilege escalation attacks. Most traditional methods for evaluating service permissions rely on evaluating the configuration of the service (static analysis). This method does not allow for evaluation of how the service executes. Therefore, the static method cannot determine if there are security risks that occur at runtime. This paper proposes a method for identifying excessive service permissions in containerized applications using runtime behavior analysis. The proposed method evaluates how the application executes, the types of system calls made, what resources are accessed, how processes interact with each other and how permissions are utilized at the service level to create a behavioural profile of the application. Once a behavioural profile is created it can be compared to the configured permissions and expected operational requirements of the application to determine if the application is using unnecessary permissions, attempting unauthorized access or executing in a dangerous manner. The proposed method includes continuous monitoring of the application's behavior, mapping of permissions to behaviors, identification of anomalies in behavior and assessment of risk to provide continuous evaluation of the application's security posture. By associating the observed behavior of the application at runtime with the permissions assigned to the application, the proposed model seeks to increase visibility into permissions used by the application, decrease unnecessary access rights and increase isolation among containers.

References :

[1] Abed, A.S., Clancy, T.C. and Levy, D.S. (2015) ‘Applying moving target defines to cloud security’, Proceedings of the IEEE International Conference on Cloud Computing, pp. 72–79.

[2] Casalicchio, E. and Iannucci, S. (2020) ‘The state-of-the-art in container technologies: Application, orchestration and security’, Concurrency and Computation: Practice and Experience, 32(17), e5668.

[3] Lasagnes, C., Trestioreanu, L.A., Jolly, C. et al. (2020) ‘The rise of ebb for non-intrusive performance monitoring’, 2020 IEEE/IFIP Network Operations and Management Symposium (NOMS). Doi: 10.1109/NOMS47738.2020.9110434.

[4] Coombe, T., Martin, A. and Di Petro, R. (2016) ‘To Dockers or not to Dockers: A security perspective’, IEEE Cloud Computing, 3(5), pp. 54–62.

[5] Fournier, G., Afghani, S. and Bureau, S. (2021) ‘Runtime security monitoring with ebb’, SSTIC 2021 Proceedings.

[6] Gawk, S., Doan, T.-P. and Jung, S. (2023) ‘Container instrumentation and enforcement system for runtime security of Cabernets platform with ebb’, Intelligent Automation & Soft Computing, 37(2), pp. 1773–1786. Doi: 10.32604/iasc.2023.039565.

[7] Parkas, O., Koi, R., Dong, N. and Mahmud, R. (2025) ‘A container security survey: Exploits, attacks, and defences’, ACM Computing Surveys, 57(7), Article 170, pp. 1–36. Doi: 10.1145/3715001.

[8] Kithara, H., Gahanna, K. and Watanabe, Y. (2020) ‘Highly-scalable container integrity monitoring for large-scale Cabernets cluster’, Proceedings of the IEEE International Conference on Big Data.

[9] Merkel, D. (2014) ‘Dockers: Lightweight Linux containers for consistent development and deployment’, Linux Journal, 2014(239), Article 2.

[10] Moabite, R., Allman, J. and Koru, M. (2015) ‘Hypervisors vs. lightweight virtualization: A performance comparison’, 2015 IEEE International Conference on Cloud Engineering, pp. 386–393.

[11] National Institute of Standards and Technology (2017) Application Container Security Guide. NIST Special Publication 800-190. Gaithersburg, MD: NIST.

[12] Pal, C. (2015) ‘Containerization and the Papas cloud’, IEEE Cloud Computing, 2(3), pp. 24–31.

[13] Pal, C., Brogan, A., Solana, J. and Jamshidi, P. (2019) ‘Cloud container technologies: A state-of-the-art review’, IEEE Transactions on Cloud Computing, 7(3), pp. 677–692.

[14] Rostamipoor, M., Gravamina, S. and Polychromies, M. (2023) ‘Confine: Fine-grained system call filtering for container attack surface reduction’, Computers & Security, 132, Article 103325. Doi: 10.1016/j.cose.2023.103325.

[15] Souppaya, M., Morella, J. and Scarf one, K. (2017) Application Container Security Guide. NIST Special Publication 800-190. Gaithersburg, MD: National Institute of Standards and Technology. Doi: 10.6028/NIST.SP.800-190.

[16] Sultan, S., Ahmad, I. and Demetrious, T. (2019) ‘Container security: Issues, challenges, and the road ahead’, IEEE Access, 7, pp. 52976–52996.

[17] Yang, S., Kang, B.B. and Nam, J. (2024) ‘Optimums: Association-based dynamic system call filtering for container attack surface reduction’, Journal of Cloud Computing, 13, Article 71. Doi: 10.1186/s13677-024-00639-3.

[18] Balaji, R. (2024) ‘Threat-Model-Driven Zero-Trust Authorization for Microservice APIs in Kubernetes-Based Cloud-Native Applications’, ESP Journal of Engineering & Technology Advancements, 4(4), pp. 223–234. doi: 10.56472/25832646/JETA-V4I4P128.

[19] Xavier, M.G., Naves, M.V., Rossi, F.D., Ferret, T.C., Lange, T. and De Rose, C.A.F. (2013) ‘Performance evaluation of container-based virtualization for high performance computing environments’, 2013 21st Euro micro International Conference on Parallel, Distributed, and Network-Based Processing, pp. 233–240.

[20] Linux Kernel Organization (2026) Control Group v2. Available at: Linux kernel documentation (Accessed: 30 October 2026).

[21] Linux Kernel Organization (2026) Extended Berkeley Packet Filter (ebb) Documentation. Available at: Linux ebb documentation (Accessed: 30 October 2026).

[22] Linux man-pages project (2026) Capabilities (7): Overview of Linux capabilities. Available at: Linux capabilities manual (Accessed: 30 October 2026).

Keywords :

Container Security, Runtime Behavior Analysis, Excessive Permissions, Least Privilege, Containerized Applications, System Call Monitoring, Privilege Escalation, Anomaly Detection, Cloud Native Security, Access Control