Microservice architectures offer scalability and flexibility, but due to their distributed nature and complex service structures, raise new security challenges, particularly in detecting DoS attacks. Although addressing these challenges calls for innovative attack detection approaches, developing effective solutions requires large-scale experiments and data collection to create representative datasets. This paper proposes a comprehensive framework to support research on the cybersecurity of microservice applications and the development of different methods to detect cyberattacks. The framework comprises two modules: (i) a data generation module that contains the components necessary to create datasets that reflect the behavior of microservices under attack and (ii) a model development and evaluation module suitable for different methods for detecting attacks on microservices. The framework is illustrated and validated by generating realistic high- and low-volume DoS attack data and developing models using supervised and unsupervised Machine Learning (ML) algorithms and a method based on Logic Scoring of Preference (LSP). The results indicate that supervised ML models have the best classification performance, especially with the XGBoost algorithm. Even though unsupervised ML and LSP models have worse performance, they can be used when the attack data are not available or are costly to generate.

Microservice architectures allow the development of highly scalable, flexible, and manageable systems. However, such architectures raise new security problems and exacerbate the challenge of monitoring applications at runtime due to their high service granularity and distributed nature. Developing effective monitoring and security strategies is thus crucial to effectively detect potential attacks. This paper explores the applicability of Logic Scoring of Preference (LSP), a multi-criteria decision-making method to compute a score based on a set of preferences, for attack detection in microservice applications. We present an extensive experimental study and define a model based on LSP and application-level metrics to characterize the impact of DoS attacks. The output of the model is a unique score used to determine whether a microservice is under a DoS attack. The results of the experimental study show precision, recall, and f1-score rates of more than 80%, indicating that LSP could effectively characterize the application under attack, opening several possibilities for future work.