Удосконалення моделі проактивного реагування на інциденти в Kubernetes-кластерах шляхом кореляції подій та автоматизованої ізоляції

Abstract

This paper addresses the problem of delayed incident response in highly dynamic Kubernetes container orchestration environments. It is established that traditional monitoring systems (SIEM, IDS) are often unable to provide timely threat localization due to the high volume of events and their rapid development. An improved proactive response model is proposed, based on the correlation of heterogeneous events (Kubernetes Audit Logs, system logs, network flows) to calculate an integral risk score for each container. Based on this score, the model activates an automated isolation algorithm that instantly restricts network access (via NetworkPolicy) and resources of the compromised element, preventing the lateral spread of the attack.