Fine-grained sandbox policy mining method for Linux container

Abstract

The present invention provides a fine-grained sandbox policy mining method for a Linux container, which automatically mines and generates a customized sandbox policy of a target container. The policycomplies with the principle of least privilege, and reduces the attack surface by limiting the system call type and parameters of the target container. The method comprises that: a container behaviormonitoring control module starts a Linux system monitoring tool, and monitors and records the system call behavior of the target container in real time; a container automation test module runs a testcase of the target container, and traverses the function of executing the target container; and a sandbox policy generation module extracts system call behavior characteristics of the target containerfrom the recorded monitoring data, and converts the system call behavior characteristics of the target container into a sandbox policy.

Description

technical field [0001] The invention patent belongs to the field of computer technology and relates to the direction of cloud computing security. More specifically, the patent of the present invention relates to a fine-grained sandbox strategy mining method for Linux containers. Background technique [0002] Linux container technology uses namespaces to isolate resources such as processes, files, and devices, providing users with an almost native performance experience and greatly reducing the additional overhead of virtualization. Docker container is one of the most representative Linux container technologies. [0003] The security issues of Linux containers have become an important factor limiting their widespread use. The main source of security problems is that the system call interface does not implement namespace isolation, and containers on the same host operating system share the system call interface. Attackers can use the system call interface to exploit kernel ...

AI Technical Summary

Problems solved by technology

Relevant research focuses on the specific implementation methods of sandbox technology and the security of system call interception. However, it is challenging to generate accurate and efficient sandbox policies for each Linux container.

Images