Kubernetes is a popular containerized application orchestration platform that is widely adopted for the development of large-scale service-oriented systems. Such a system often involves the integration of third-party applications, which may introduce security risks, such as excessive permission configurations and privilege escalations, resulting in the leakage of sensitive resources and unauthorized operations. Existing risk detection techniques mainly examine the permission configurations with some predefined rules, which may not be adaptive and precise due to the dynamic nature of Kubernetes environments. To overcome the limitations, we propose a systematic permission-oriented risk detection approach called KubeGuard. First, KubeGuard identifies a minimal permission set and uses it to check whether the existence of excessive permissions in the permission configurations. Second, KubeGuard detects various privilege escalation risks through dynamic rule-based auditing. Third, KubeGuard prevents sensitive resource leakages by monitoring the messages transferred between pods in Kubernetes and alerting in case sensitive resources are involved through the keyword matching. We further developed a supporting prototype called Kube-Guarder. Experiments were conducted on a suite of open-source Kubernetes applications and simulated scenarios to evaluate the effectiveness of KubeGuard. Experimental results have shown that KubeGuard can detect excessive permissions more effectively and precisely compared with the static rule-based baseline technique, and in the meanwhile, KubeGuard can detect various types of privilege escalation and sensitive resource leakage. As a result, this study delivered a promising technique for improving the security of Kubernetes applications.

Microservice architecture (MSA) has been widely adopted to develop various large-scale distributed systems. Microservice-based systems (MBSs) comprise a number of independently deployed microservices fulfilling the specific functionalities. Unique characteristics of microservices, such as independent and parallel development, rapid iteration, and distributed deployment, result in low observability and reliability of MBSs. A typical solution is to regulate system behavior in specifications of MBSs, and then develop and test MBSs based on these specifications. However, current microservice specifications focus on describing the APIs of microservices without describing the behavior expectation for an MBS. In this article, we propose an annotation-assisted and scenario-oriented approach, called MSA_Sighter, to detect behavior inconsistencies in MBSs. In MSA_Sighter, the details of an MBS are captured in a description model (MSDM), which can be extracted automatically from the functional services through annotation-assisted runtime component instance analysis and static program analysis. Given a specific business scenario, inconsistency detection is conducted by analyzing the actual behavior's conformance to the expected behavior, where the former is collected through distributed tracing while the latter is derived from the MSDM. We have developed a supporting tool called ConsChecker and evaluated MSA_Sighter's effectiveness on three open-source MBSs in GitHub. The experimental results have shown that MSA_Sighter can effectively detect inconsistencies in MBSs during system development and evolution.

This paper proposes a method for head pose estimation from a single image. We employ a multi-stage regression strategy. To overcome the discontinuity of Euler angles and quaternions and avoid the additional constraints required to directly regress the rotation matrix, we apply a continuous 6D representation to the head pose estimation problem. Each stage of the network regresses two 1 × 3 vectors, which are then transformed into a 3 × 3 rotation matrix by this continuous 6D representation. To better perceive the difference in rotation angles, we adopt the Riemann distance to measure the closeness between the network-estimated rotation matrix and the ground truth rotation matrix corresponding to the head pose. Experiments show that our method achieves the state-of-the-art on BIWI dataset and performs favorably on AFLW2000 dataset.