The DTA scanning process includes these steps:

  1. The DTA service pulls an image to Aqua servers.
  2. The service spins up a VM.
  3. The service runs the image as a container on the VM for several minutes.
  4. The service records and monitors network and disk activity, memory utilization, system calls, and more.
  5. The service classifies these activities in the form of behaviors and saves the scan result.
  6. The VM is tear down and the image is deleted from Aqua servers.