In-container process abnormal behavior detection method and system

Abstract

The invention discloses an in-container process abnormal behavior detection method and system. A host machine user layer is provided; behaviors such as creation, operation and extinction of all processes in the container are perceived in real time in an agent-free monitoring mode; therefore, the system call behavior data of the full life cycle of the process is transparently acquired; semantic features of the sequence data is acquired by using an LSTM recurrent neural network; according to the method, a normal process behavior contour is described, and finally, two exception judgment methods are provided by adopting a mode of accumulating deviation in a local window, so that the regularity of process system calling behaviors can be expressed more stably, and the false alarm rate is effectively reduced while the detection rate is improved. Besides, in the modeling stage, the number of training samples is reduced on year-on-year basis according to the short sequence frequency called by mapping the same system, and the training speed of the model is increased, and the short sequence probability threshold value in the detection stage is self-defined in the mode of testing training data, and the workload of manual participation is reduced.

Description

technical field [0001] The invention relates to the technical field of virtualization security, in particular to a method and system for detecting abnormal behavior of a process in a container. Background technique [0002] With the rapid development of cloud computing technology, the security of cloud platforms has also received extensive attention from the industry. Different from the traditional virtualization technology that virtualizes hardware resources, container technology, as an emerging virtualization method, provides a more lightweight and efficient operating system-level virtual host environment. However, while the virtualization platform is widely used, the malicious process in the container can attack through the vulnerability of the container or the host kernel. It can escape to the host machine to obtain super user privileges and threaten the security of the entire cloud platform. [0003] Intrusion detection schemes based on system calls in traditional hos...

AI Technical Summary

Problems solved by technology

(4) When measuring the abnormality of the current behavior of the process, the method of comparing the probability threshold and the occurrence probability of short sequences is often used, but it is difficult to uniformly determine this threshold in the actual application process, resulting in false positives or missed negatives

Images