Fine-Grained Behavioral Analysis for Malware Detection in Containerized Environments

Purpose: Containerized environments have become foundational to modern software development due to their portability, scalability, and efficient resource utilization. However, their shared-kernel architecture introduces distinct security challenges, particularly in malware detection. This study presents a historical analysis of fine-grained, behavior-based malware detection techniques within containerized systems. Materials and Methods: We examine early machine learning approaches, including Decision Trees, Hidden Markov Models, and LSTM networks trained with limited datasets alongside system call tracing and process behavior profiling. Findings: While these techniques are now outdated, they marked critical early steps beyond static and signature-based detection in dynamic, containerized infrastructures. We analyse behavioural features such as syscall sequences, memory anomalies, and DNS irregularities, assessing their detection performance and limitations in orchestrated environments. The paper further contextualizes these legacy methods in light of modern advancements, including eBPF-based monitoring and context-aware deep learning models. Unique Contribution to Theory, Practice and Policy: Key recommendations include leveraging eBPF for efficient runtime monitoring, incorporating orchestration metadata for context-aware detection, and enabling cross-container correlation for identifying lateral movement. This retrospective establishes a comparative framework that informs the development of adaptive, real-time security solutions, such as graph neural networks and behavioural baselining, thereby guiding future research in runtime container security.