Toward Performance-Based Detection of Attacks in Microservice Systems

This poster paper links performance engineering and cybersecurity by presenting an architecture for performance-based attack detection in microservice systems. We define a workflow based on service-level runtime behavior rather than network signatures or logs. The architecture integrates workload generation, attack injection, and continuous collection of CPU, memory, filesystem activity, and response-time metrics. In future work, we will evaluate this architecture on benchmarking applications that reflect realistic architectures reported by practitioners. The goal is to assess whether runtime performance behavior can support service-level attack detection.