Cryptomining Detection in Container Clouds Using System Calls and Explainable Machine Learning

Rupesh Raj Karn, Prabhakar Kudva, Hai Huang, Sahil Suneja, Ibrahim M. Elfadel

Research output: Contribution to journalArticlepeer-review

57 Scopus citations


The use of containers in cloud computing has been steadily increasing. With the emergence of Kubernetes, the management of applications inside containers (or pods) is simplified. Kubernetes allows automated actions like self-healing, scaling, rolling back, and updates for the application management. At the same time, security threats have also evolved with attacks on pods to perform malicious actions. Out of several recent malware types, cryptomining has emerged as one of the most serious threats with its hijacking of server resources for cryptocurrency mining. During application deployment and execution in the pod, a cryptomining process, started by a hidden malware executable can be run in the background, and a method to detect malicious cryptomining software running inside Kubernetes pods is needed. One feasible strategy is to use machine learning (ML) to identify and classify pods based on whether or not they contain a running process of cryptomining. In addition to such detection, the system administrator will need an explanation as to the reason(s) of the ML's classification outcome. The explanation will justify and support disruptive administrative decisions such as pod removal or its restart with a new image. In this article, we describe the design and implementation of an ML-based detection system of anomalous pods in a Kubernetes cluster by monitoring Linux-kernel system calls (syscalls). Several types of cryptominers images are used as containers within an anomalous pod, and several ML models are built to detect such pods in the presence of numerous healthy cloud workloads. Explainability is provided using SHAP, LIME, and a novel auto-encoding-based scheme for LSTM models. Seven evaluation metrics are used to compare and contrast the explainable models of the proposed ML cryptomining detection engine.

Original languageBritish English
Article number9215018
Pages (from-to)674-691
Number of pages18
JournalIEEE Transactions on Parallel and Distributed Systems
Issue number3
StatePublished - 1 Mar 2021


  • anomaly
  • containers
  • Cryptomining
  • docker
  • explainability
  • kubernetes
  • machine learning
  • pod


Dive into the research topics of 'Cryptomining Detection in Container Clouds Using System Calls and Explainable Machine Learning'. Together they form a unique fingerprint.

Cite this