Strengthening Kubernetes Workload Security Through eBPF Monitoring and Real-Time Runtime Threat Detection Mechanisms

Abstract

Kubernetes has become a fundamental platform for deploying scalable, containerized applications across cloud-native and distributed enterprise environments. However, its dynamic architecture, distributed workloads, and complex communication patterns introduce significant security challenges, particularly in detecting runtime threats and unauthorized workload activities. Traditional security mechanisms often depend on predefined rules, periodic vulnerability assessments, and network-level monitoring, which may fail to identify sophisticated attacks occurring during application execution. This research proposes an enhanced Kubernetes workload security framework that integrates Extended Berkeley Packet Filter (eBPF) monitoring with real-time runtime threat detection mechanisms. The proposed framework collects kernel-level telemetry, including system calls, process execution events, network connections, and file access activities, to identify suspicious behavior across containerized workloads. A layered detection architecture combines behavioral baselines, rule-based threat identification, contextual event correlation, and anomaly detection to improve threat visibility and response efficiency. Kubernetes metadata is incorporated to associate observed events with specific pods, namespaces, containers, and workloads. The methodology evaluates detection accuracy, false-positive rates, event-processing latency, resource overhead, and scalability under representative workload and attack scenarios. Automated response mechanisms, including alert generation, workload isolation, and policy enforcement, are considered to support rapid incident containment. The proposed framework aims to strengthen runtime visibility, reduce threat detection delays, and improve operational resilience while maintaining acceptable performance in production-oriented Kubernetes environments