LLMSecConfig: An LLM-Based Approach for Fixing Software Container Misconfigurations

TL;DR

LLMSecConfig addresses the gap in automated remediation for security misconfigurations in container orchestrators by integrating static analysis with Large Language Models via Retrieval-Augmented Generation. The framework uses Checkov for detection, rich multi-source context (SAT outputs, policy source code, Prisma Cloud docs) through RAG, and iterative, validated repair generation with YAML parsing and security checks. Across 1,000 real-world Kubernetes configurations, the open-source Mistral Large 2 model achieves a 94.3% repair rate with perfect parse/validation and minimal introduced errors, outperforming GPT-4o-mini. The work delivers an end-to-end, open dataset and implementation, enabling researchers and practitioners to advance automated container security management and reduce manual remediation effort.

Abstract

Security misconfigurations in Container Orchestrators (COs) can pose serious threats to software systems. While Static Analysis Tools (SATs) can effectively detect these security vulnerabilities, the industry currently lacks automated solutions capable of fixing these misconfigurations. The emergence of Large Language Models (LLMs), with their proven capabilities in code understanding and generation, presents an opportunity to address this limitation. This study introduces LLMSecConfig, an innovative framework that bridges this gap by combining SATs with LLMs. Our approach leverages advanced prompting techniques and Retrieval-Augmented Generation (RAG) to automatically repair security misconfigurations while preserving operational functionality. Evaluation of 1,000 real-world Kubernetes configurations achieved a 94\% success rate while maintaining a low rate of introducing new misconfigurations. Our work makes a promising step towards automated container security management, reducing the manual effort required for configuration maintenance.

Figures (9)

• Figure 1: Comparison of misconfigured (left) versus properly configured (right) Kubernetes security contexts. The misconfigured configuration allows privilege escalation, enabling container processes to gain elevated privileges beyond their parent processes. In contrast, the secure configuration explicitly disables this capability.
• Figure 2: Architecture overview of the LLMSecConfig framework for automated Kubernetes security configuration repair. The pipeline comprises three main stages: (1) configuration analysis using SATs, (2) context retrieval through RAG, and (3 & 4) repair generation using Large Language Models (LLMs). The system iteratively processes configurations until all security issues are resolved or the maximum number of attempts is reached.
• Figure 3: Example output from the Checkov security scanner, indicating a detected privilege escalation vulnerability in a Kubernetes configuration.
• Figure 4: Python implementation of the Checkov security check for container privilege escalation.
• Figure 5: Prisma Cloud security policy documentation for CKV_K8S_20: Containers Run with AllowPrivilegeEscalation.