
This paper proposes a hybrid detection framework that utilizes extended Berkeley Packet Filter (eBPF) to detect malicious containers at runtime. The framework combines flow-based network metadata and host-based system call traces collected with low overhead via eBPF. By integrating multiple data sources, it resolves classification ambiguities inherent in single-source approaches and improves detection reliability by accurately distinguishing between malicious and benign containers using machine learning.
The cover image was created with AI-generated content via Google Gemini 3, and it contains no copyrighted elements or misleading representations.
View this paper