In this paper we introduce TIMELOOPS a novel technique for automatically learning system call filtering policies for containerized microservices applications. At run-time, TIMELOOPS automatically learns which system calls a program should be allowed to invoke while rejecting attempts to call spurious system calls. Further, TIMELOOPS addresses many of the shortcomings of state-of-the-art static analysis-based techniques, such as the ability to generate tight filters for programs written in interpreted languages such as PHP, Python, and JavaScript. TIMELOOPS has a simple and robust implementation because it is mainly built out of commodity, and proven, technologies such as seccomp-BPF, systemd, and Podman containers, with fewer than 500 lines of code. We demonstrate the utility of TIMELOOPS by learning system calls for individual services and two microservices benchmark applications, which utilize popular technologies like Python Flask, Nginx (with PHP and Lua modules), Apache Thrift, Memcached, Redis, and MongoDB. Further, the amortized performance of TIMELOOPS is similar to that of an unhardened system while producing a smaller system call filter than state-of-the-art static analysis-based techniques.

翻译：在本文中,我们引入了TERLOPS, 这是一种用于集装箱化微服务应用自动学习系统叫过滤政策的新型技术。在运行时,TERLOPS自动学习一个系统叫的程序应该被允许引用,而拒绝称为虚假系统呼号的尝试。此外,TERLOPS解决了最先进的静态分析技术的许多缺陷,例如能够为以PHP、Python和JavaScript等翻译语言编写的程序生成紧密过滤器。TyloOPS有一个简单而有力的实施方法,因为它主要是由商品制造的,并且已经证明,Selcomp-BPF、系统化和波德曼集装箱等技术,其代码小于500行。我们通过学习系统呼吁个别服务和两个微观服务基准应用程序,展示了TERLOPS的效用,这些技术使用流行技术,如Python Flask、Nginx(PHP和La模块)、Apati Thrift、Memcashed、Redis和MongDB。此外,TROOPS的摊分化性性性性性性性工作与非硬化分析系统类似,同时制作非硬化系统。