A Unified Xgboost-Based Framework for Detecting Full-Lifecycle Attacks in Containerized Cluster Environments

Abstract

The approval of containerized applications in cloud-native environments has significantly improved application scalability, portability, and resource efficiency. However, this development has also introduced complex security challenges across all stages of the application lifecycle, from build-time, deployment-time, and runtime phases. Traditional security solutions are often based on isolated phases of the container lifecycle, but their solutions work on single-source monitoring and, which limits their ability to detect sophisticated multi-stage attacks. This study developed a Unified XGBoost-Based framework for detecting Full-lifecycle attacks in Containerized Cluster Environments. The framework integrated heterogeneous security data from multiple sources, including audit logs of Kubernetes, events in Docker, and Falco runtime alerts, to provide comprehensive reflectivity across the application lifecycle. Collected logs were preprocessed and transformed into structured feature vectors using feature extraction and engineering techniques. The extracted features were used to train an XGBoost classifier for multi-class attack detection, categorizing events into build-time attacks, deployment-time attacks, runtime attacks, and normal behavior. Experimental evaluation indicated strong performance, achieving an average precision of 96.9%, recall of 97.0%, and F1-Score of 96.9%, with runtime attacks recording the highest detection rate due to the rich behavioral indicators available in runtime logs. Comparative analysis further identified that the developed XGBoost-based model outperformed baseline machine learning algorithms, which are Logistic Regression, Decision Tree, Random Forest, and LightGBM. The findings confirm that integrating multi-source logs significantly improves full-lifecycle attack detection in a containerized cluster environment. This research contributes to the field of cybersecurity and containerized applications by providing a scalable and effective machine learning-based structure for comprehensive intrusion detection and threat monitoring.