PerfSPEC Learning Phase

Based in PrefSPEC: Performance Profiling-based Proactive Security Policy Enforcement for Containers document presented in [1], thir repository contains source files used to generate and process data.

PrefSPEC document

Presentación in Spanish

PerfSPEC has three phases:

• Ranking
• Learning
• Runtime

This repository is focused in Learning phase with attention on:

• Event logs info load and process
• Predictive learning model

Note: It is considered that event data collection in raw-audit-logs.log.gz are realistic and representative to simulate administrative operations.

Files

• raw-audit-logs.log contains raw Kubernetes audit logs collected using the audit-policy.yaml audit policy.

Tools are distributed in directories:

• Collect
• Process
• Learning

As some tasks can be used in Python or Rust there are directories for each programming languge inside directories tasks.

Each task/programming-language may have a data directory where processing output files is generated.

Collect data

If you wish to collect your own dataset, there are several source files that might help:

• collect/collect.py is a script to trigger the installation and uninstallation of public Helm repositories.
• collect/helm-charts.json is a backup of Helm charts used at the time of the collection.

Process data

Learning

Reference

[1]: H. Kermabon-Bobinnec et al., "PerfSPEC: Performance Profiling-based Proactive Security Policy Enforcement for Containers," in IEEE Transactions on Dependable and Secure Computing, doi: 10.1109/TDSC.2024.3420712.