Container anomaly detection method and system

Abstract

The invention discloses a container anomaly detection method and system, and belongs to the technical field of cloud computing security. The method comprises the steps: firstly collecting log data, filtering, simplifying and complementing the log data, and innovatively proposing to obtain new log data according to column numbering; then, respectively calculating the support degree of each column of elements in the new log data, removing the elements with the support degree smaller than the minimum support degree in each column, independently storing the remaining elements in each column, and adding zero elements to the ends of the remaining elements; sequentially and randomly selecting one element according to columns, combining the elements, and judging the support degree of the combination to find out all element combinations of which the support degree is greater than or equal to the minimum support degree and the length is equal to the log entry field number; and finally, feeding back the selected part of element combinations with the maximum weights to a system administrator so as to carry out container anomaly detection. Therefore, the method can help a system administrator to quickly and accurately position the abnormity, and reduces the burden of system maintenance personnel.

Description

technical field [0001] The invention belongs to the technical field of cloud computing security, and more specifically, relates to a container abnormality detection method and system. Background technique [0002] As a new service model different from the traditional service model, cloud computing can enable users to access high-quality, high-security infrastructure services at a lower price. Nowadays, more and more people prefer to use cloud computing technology for some large-scale data calculations. Cloud technology is the foundation of virtualization, and the resource management and development of virtualization are inseparable from the support of cloud computing. However, due to the problems of virtualization technology such as long startup time, low utilization of system resources and differences in stack environments between virtual machines, Docker container technology was born as an alternative. [0003] Docker is an operating environment designed for system admin...

AI Technical Summary

Problems solved by technology

Some abnormalities may directly generate corresponding error messages to help maintenance personnel locate the cause of the abnormality, but some malicious attacks only generate normal logs as in normal operation. Finding "abnormal" logs in these normal logs only depends on manual analysis Difficult to complete

Images