Runtime detection of attacks and misconfigurations in cloud-native Kubernetes environments using eBPF network telemetry

Abstract

Kubernetes misconfigurations can create runtime pathways for lateral movement, unauthorized service access, and privilege escalation, yet reliable detection remains difficult because cloud-native telemetry is highly imbalanced and may vary across datapath observation points. This study evaluated Hubble/eBPF network telemetry in a controlled four-node kind-based Kubernetes testbed containing absent NetworkPolicies, excessive RBAC permissions, and privileged container execution. Four attack scenarios were executed, and a four-stage ground-truth procedure produced 3,180,125 labeled flows, including 456 attack-origin records. A behavioral rule system and a Random Forest classifier were examined using precision–recall analysis, blocked time-window validation, feature importance, and partial destination-context ablation. Across three attack-bearing folds, the Random Forest achieved mean precision of 0.558, recall of 0.833, F1-score of 0.552, and a false positive rate of 0.000223. Destination-related features accounted for 0.642 of total model importance, compared with 0.229 for source-related features, while removing destination namespace and pod encodings reduced AUPRC from 0.2843 to 0.2629. The rule-based outputs provided interpretable evidence of suspicious cross-namespace communication patterns within the testbed. The findings show that Hubble telemetry can support detection of the represented network-visible behaviors when observation-point differences and infrastructure traffic are handled carefully. Broader validation is required across larger clusters, unseen workloads, and additional attack categories.