Container technology improves the efficiency of application distribution and deployment with its features of lightness

flexibility and rapid deployment. However

the characteristics of low resource isolation and shared kernel introduce new security risks to containers and cloud platforms. This paper proposes an anomaly detection scheme of processes behavior in container based on system call sequences and long short-term memory (LSTM) neural network

the scheme collects the system call sequence data of the whole life cycle of processes through the agentless monitoring mode

and uses LSTM to capture the semantic features of sequences. At the same time

two methods of abnormal decision are proposed by means of cumulative deviation in local window. Furthermore

in order to optimize the training efficiency of the model

an algorithm for removing duplicate short sequence samples with the same ratio is designed. The experimental results on the public dataset and real attack scenarios show that the scheme can effectively detect the abnormal behavior of processes in container

and the detection performance is better than other similar methods.