paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Dynamic Application Security Testing for Kubernetes Deployment: An Experience Report from Industry

Kubernetes 部署的动态应用安全测试：一份来自工业界的经验报告
FSE Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering2025匹配度 1/10 · 该论文是Kubernetes部署中DAST工具检测安全配置违规的工业经验报告，与用户关注的PL与AI交叉、静态分析、浮点程序分析和贝叶斯程序分析均无直接关联。虽然属于工业落地案例，但研究主题是安全配置测试而非程序语言或LLM辅助分析。引用 4 inbox
Shazibul Islam Shamim, Hanyang Hu, Akond Rahman
安全与隐私测试、调试与修复
crossref: 2026-09-12dblp: 2026-09-12

AI 速览

一句话：工业经验报告：用三种 DAST 工具检测 Kubernetes 部署的安全配置违规，并比较工具支持度。

本文是工业界经验报告，研究如何用动态应用安全测试（DAST）保障 Kubernetes 部署安全。Kubernetes 支持快速部署与容器编排，但其部署基础设施安全令人担忧，业界缺乏对动态分析效果的系统理解。作者在 Company-Z 的 Kubernetes 部署上用三种 DAST 工具进行实证研究。结果显示，该部署存在 3,442 项推荐安全配置违规；三种工具中，Kubescape 与 Kubebench 对 14 类推荐安全配置的检测支持最好。作者建议从业者采用 DAST 工具，并呼吁研究者探索动态检测配置违规的方法。

问题
Kubernetes 部署基础设施的安全性受到工业界关注，但业界缺乏对动态分析如何帮助保障 Kubernetes 部署安全的系统理解。
方法
在一家名为 Company-Z 的公司所使用的 Kubernetes 部署上，运行三种动态应用安全测试（DAST）工具，实证考察推荐安全配置的违反情况与工具检测能力。
评估
发现该部署存在 3,442 项推荐安全配置违规；三种工具中 Kubescape 与 Kubebench 对 14 类推荐安全配置的检测支持最高，据此给出实践与研究建议。
原文摘要（Abstract）

While Kubernetes enables practitioners to rapidly deploy their software and perform container orchestration efficiently, security of the Kubernetes-based deployment infrastructure is a concern for industry practitioners. A systematic understanding of how dynamic analysis can be used for securing Kubernetes deployments can aid practitioners in securing their Kubernetes deployments. We present an experience report, where we describe empirical findings from three dynamic application security testing (DAST) tools on a Kubernetes deployment used by 'Company-Z'. From our empirical study, we find (i) 3,442 recommended security configurations are violated in 'Company-Z's' Kubernetes deployment; and (ii) of the three studied DAST tools, Kubescape and Kubebench provide the highest support with respect to detecting 14 types of recommended security configurations. Based on our findings, we recommend practitioners to apply DAST tools for their Kubernetes deployments, and security researchers to investigate how to detect configuration violations dynamically in the Kubernetes deployment.

链接与引用

DOI 原文 · DBLP

BibTeX 
@inproceedings{ShamimHR25,
  title = {Dynamic Application Security Testing for Kubernetes Deployment: An Experience Report from Industry},
  author = {Shazibul Islam Shamim and Hanyang Hu and Akond Rahman},
  booktitle = {FSE},
  year = {2025},
  doi = {10.1145/3696630.3728573}
}