KubeShield: A Kubernetes Attack Path Visualiser Using Graph-Based Security Analysis

Author

Ramesh Manjappa Yatnalli, Rihan Shahnawaz Solkar, Tharun Gowda K, VinayKumar E, Mrs. Supriya M Kerakkanavar


Abstract

 Kubernetes clusters contain many interconnected resources, including pods, service accounts, secrets, roles, role bindings and network policies, and their misconfigurations are often reported as isolated alerts. This paper presents KubeShield, a prototype Kubernetes attack path visualiser that models security-relevant relationships between cluster resources as a directed graph and applies graph algorithms to examine how individual weaknesses may combine into multi-step attack paths. A local scan agent inspects an approved Kubernetes context through the Kubernetes Python client; a graph extractor builds a JSON security graph; and a FastAPI backend validates the graph and stores it as a snapshot in MongoDB. A graph analysis engine applies Dijkstra’s algorithm for weighted shortest-path analysis, Breadth-First Search (BFS) for blast-radius analysis, Depth-First Search (DFS) for directed-cycle detection, and critical-node analysis, and the results are explored through a React dashboard built on Cytoscape.js. On a mock cluster graph of 41 nodes and 48 edges, the prototype reported 18 attack paths (11 classified as critical), 4 CVE mappings and one directed cycle, and its critical-node analysis indicated that removing a single over-privileged node (web-frontend) would eliminate about 74% of the modelled paths. These outputs are structural indicators that help prioritise review; they are not proof that a path is exploitable.


Keywords

Kubernetes security; attack path analysis; attack graph; Dijkstra’s algorithm; blast radius; RBAC; critical-node analysis; graph visualisation



Full Text:

Download Paper PDF


References


Research Papers:

  1. S. Shamim, F. A. Bhuiyan, and A. Rahman, “Ten Security Commandments for Kubernetes,” in IEEE Secure Development Conference, 2020.
  2. National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA), “Kubernetes Hardening Guidance,” Technical Report, 2022.
  3. Pecka et al., “Privilege Escalation in Kubernetes,” Central European Cybersecurity Conference (CECC), 2022.
  4. Microsoft, “Threat Matrix for Kubernetes,” Microsoft Security Blog, Redmond, WA, USA, Apr. 2021.
  5. Red Hat Inc., “State of Kubernetes Security Report,” Technical Report, Red Hat, Raleigh, NC, USA, 2023.
  6. Fairwinds Inc., “Kubernetes Benchmark Report,” Technical Report, Fairwinds, Boston, MA, USA, 2024.
  7. National Institute of Standards and Technology (NIST), “National Vulnerability Database (NVD),” Gaithersburg, MD, USA, 2023. [Online]. Available: https://nvd.nist.gov
  8. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms, 3rd ed. Cambridge, MA, USA: MIT Press, 2009.
  9. MITRE Corporation, “MITRE ATT&CK for Containers Framework,” McLean, VA, USA, 2022. [Online]. Available: https://attack.mitre.org/matrices/enterprise/containers
  10. The Kubernetes Authors, “Kubernetes Documentation,” The Kubernetes Community, ongoing.

 

 

Share your valuable work from Social Media Buttons