用随机森林动态调参，防攻击时自动稳住K8s扩容
Automatic Adjustment of HPA Parameters and Attack Prevention in Kubernetes Using Random Forests
- 用HTTP状态码做指标，随机森林判断攻击并调整HPA最大副本数
- 攻击流量被重定向至蜜罐，5xx错误率显著降低
- 适合云原生安全运维人员，可抵御高负载下的恶意扩容
本文以HTTP状态码作为自定义指标，在HPA中构建实验场景。通过集成机器学习中的随机森林分类算法，对攻击行为进行评估与预测，并动态调整HPA的最大副本数以应对攻击流量。该方法在靶向攻击场景下，利用机器学习脚本实现参数自适应调节，有效管理攻击流量。所有来自攻击IP的访问均被重定向至蜜罐Pod，从而在高负载条件下显著降低5XX类错误发生率。该策略还确保了攻击流量的有效隔离，防止因攻击导致的HPA过度扩展。实验表明，合理设置HPA调整阈值至关重要。
原文摘要 · Abstract (English)
In this paper, HTTP status codes are used as custom metrics within the HPA as the experimental scenario. By integrating the Random Forest classification algorithm from machine learning, attacks are assessed and predicted, dynamically adjusting the maximum pod parameter in the HPA to manage attack traffic. This approach enables the adjustment of HPA parameters using machine learning scripts in targeted attack scenarios while effectively managing attack traffic. All access from attacking IPs is redirected to honeypot pods, achieving a lower incidence of 5XX status codes through HPA pod adjustments under high load conditions. This method also ensures effective isolation of attack traffic, preventing excessive HPA expansion due to attacks. Additionally, experiments conducted under various conditions demonstrate the importance of setting appropriate thresholds for HPA adjustments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。