Eviden's R&D Spain team has produced a new video for disseminating one of the most promising outcomes within the 6GDAWN project, which has demonstrated strong innovation in decentralized intrusion detection in microservices management platforms that underpin future 6G network provisioning and slice management.
Container-based microservices management platforms, such as Kubernetes, offer highly dynamic and automated creation and management of compute clusters. They also enable the coexistence and operation of multiple compute clusters, and the flexible networking of all modules to enable the final business logic.
As the dynamics and complexity of today's computing clusters increase, so does the attack vector and the opportunity for malicious activity to occur undetected. The challenge is to identify bad behaviour within them and monitor all components of the environment to ensure the health of the entire cluster.
To address this, 6GDAWN has developed a decentralised anomaly-based network intrusion detection system for Kubernetes clusters.
This system allows to:
- Detect intrusions on any working node in a computing cluster, across different clusters, and even across name spaces within clusters.
- Make decisions about the health status of entities in a cluster, be they pods, services or nodes, based on monitoring deviations from normal baseline behaviour.
The anomaly detection is based on an unsupervised deep learning algorithm that models patterns of benign traffic during training and identifies unusual behaviour based on deviations from the normal baseline.
This demonstration highlights successful technology advances and results:
- Full-scale network monitoring and visibility of computing clusters.
- Zero-touch automated deployment, configuration and training of deep learning models.
- Extended network telemetry for greater behavioural insight and anomaly detection.
- Modular architecture scalable to different deployment and data processing needs.
- Successful integration with mitigation mechanisms to ensure availability and continuity of 6G network delivery in case of cyber-attacks, such as blackholing and network DoS.
