Kubernetes (K8s) has become a core technology for cloud-native applications. However, a design flaw of the external IP in K8s leads to the service-oriented man-in-the-middle attack. Existing solutions (e.g., script monitor) attempt to address it passively, which allows attackers enough analysis time to bypass these static rule reviews. Differently, we propose a mutation-enabled proactive defense mechanism, aiming to change the asymmetry between attackers and defenders. It involves the address mutation (i.e., network identification) module and the connection ID (i.e., communication identification) mutation module. In the former module, we analyze mutation constraints and prove the corresponding mutation grouping problem to be NP-hard. Then, a maximally coloring-driven mutation grouping algorithm is developed. Since the address allocation time grows linearly with the service size, we design a prefetched address allocation algorithm. After designing the interaction flow between modules, we present a randomized algorithm in the latter module. Thus our mechanism does not affect methods oriented to other attacks. Eventually, it can continuously interrupt the attack and keep the service connection by incrementally updating K8s and the transport layer protocol. Experiments in the Alibaba cloud demonstrate that it can effectively defend against the attack with an acceptable performance loss.

Intel software guard extensions (SGX) technology allows cloud vendors to provide customers with an independent and trusted execution environment (TEE). It protects critical data confidentiality and integrity from malicious software. However, more and more SGX side-channel attacks have appeared, which seriously undermine the confidence of tenants in cloud security. The related research focuses on system hardware and SGX compiler solutions for specific attacks, which also has difficulties in deployment. Differently, we propose an intelligent-driven proactive defense strategy, which is based on live migration. To the best of our knowledge, this is the first proactive defense against SGX side-channel attacks. We adopt the Markov decision process to solve the migration programming problem. The innovative deep reinforcement learning (DRL) solves problems of the unknown state transition probability and large machine load states, which is called self-checking proximal policy optimization (SPPO). It changes the reward pattern, improving the convergence speed and stability of DRL. In prototype experiments, we deploy the strategy in the OpenStack platform agilely to prove the defense performance and low virtual machine costs.