Communication Dans Un Congrès Année : 2025

Helm-ET: Reducing Exposure to Lateral Movement in Kubernetes Artifacts

Résumé

Modern cloud applications consist of containerized microservices deployed to a virtual computing environment, such as a Kubernetes cluster. Policies are needed to block unintended and potentially harmful interactions between the microservices, which attackers could exploit for discovery and lateral movement. However, it is challenging for cluster administrators to define strict network policies because the interactions between the components are not clearly defined. Enabling them often requires manual inspection of the declarative configuration and the source code of the applications. This paper proposes a novel approach to creating Kubernetes network policies that restricts access between microservices within a cluster. Based on the principles of modularity and information hiding, we identify service composition patterns in cloud applications and use them to create network policies. The policy generation is implemented as an open-source tool, Helm-ET, which we evaluate on 451 Helm charts across three datasets. The results show that the proposed approach can significantly reduce the internal attack surface in the Kubernetes cluster (92.71% less allowed connections), achieving comparable results to state-of-the-art tools. However, compared to other solutions, Helm-ET is faster (<100ms vs 79 seconds) and applies the policies before the application deployment.

Fichier principal
Vignette du fichier
main.pdf (428.57 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-05231853 , version 1 (31-08-2025)

Licence

Identifiants

Citer

Jacopo Bufalino, Jose Luis Martin Navarro, Aleksi Peltonen, Tuomas Aura. Helm-ET: Reducing Exposure to Lateral Movement in Kubernetes Artifacts. 2025 IEEE 18th International Conference on Cloud Computing (CLOUD), Jul 2025, Helsinki, Finland. pp.109-120, ⟨10.1109/CLOUD67622.2025.00021⟩. ⟨hal-05231853⟩
36 Consultations
76 Téléchargements

Altmetric

Partager

  • More