A Docker image scanning method based on static analysis

Abstract

The present invention discloses a Docker image scanning method based on static analysis. The method extracts features from a large number of Docker image construction history records through a manual analysis method and establishes a security feature library. Feature matching is performed on the image to be tested based on the security feature library, and security issues of the image are detected based on the feature information and a whitelist mechanism. At the same time, the number of software vulnerabilities in the image is detected through an image scanning tool, and a function is fitted according to a scatter plot of time distribution to establish a vulnerability prediction model. Finally, the security issues of the Docker image are comprehensively analyzed based on the information of the two, and the image scanning results are fed back. The method combines the image scanning tool and the custom scanning method to analyze the image software vulnerabilities. The image scanning tool analyzes the image software vulnerabilities, and a function is fitted according to the scatter plot of the vulnerability number distribution to establish an image vulnerability prediction model.

Description

Technical Field

[0001] The present invention relates to a Docker image security detection technology, and in particular to a Docker image scanning method based on static analysis. Background Art

[0002] Currently, the number of images in the Docker Hub image repository has reached over 8 million and is growing rapidly, including a large number of images with security issues. To detect vulnerabilities in images, image scanning tools are currently the primary tool used. While these tools can identify existing vulnerabilities in existing images, they lack visibility into unknown information, hinder the development trends of vulnerabilities in images, and provide a development-oriented scanning analysis. Furthermore, current image scanning tools primarily rely on scanning the entire image file, performing detection based on the software management information within the image, and then matching against a remote vulnerability database to detect vulnerability information within the image. Conventional detection methods lack coverage for software introduced into the image during the build process, and detection requires access to the entire image file, limiting the ability to perform large-scale scanning. Summary of the Invention

[0003] The purpose of this invention is to address the serious security issues in Docker image repositories, use image scanning tools to scan and analyze the vulnerability development trends of images, and use the image construction history scanning method to achieve rapid and large-scale image security detection. In response to the above two aspects of research, a Docker image scanning method based on static analysis is provided. The present invention is achieved through the following technical solutions:

[0004] The present invention discloses a Docker image scanning method based on static analysis. The method extracts features from a large number of Docker image construction history records through manual analysis and establishes a security feature library. Feature matching is performed on the image to be tested according to the security feature library, and security issues of the image are detected based on the feature information and a whitelist mechanism. At the same time, the number of software vulnerabilities in the image is detected through an image scanning tool, and a function is fitted according to a scatter plot of time distribution to establish a vulnerability prediction model. Finally, the information of the two is used to comprehensively analyze the security issues of the Docker image, and the image scanning results are fed back.

[0005] As a further improvement, the feature extraction described in the present invention is to perform text matching on the Docker image build history according to the system commands and file names, analyze the operations or files known to have security issues, extract the security-related operations or settings involved, and incorporate them into the security feature library.

[0006] As a further improvement, the feature matching described in the present invention uses a text matching method to detect the construction history of the image to be tested, and matches it with the characteristic information in the security feature library to detect security issues in the image.

[0007] As a further improvement, the characteristic information described in the present invention is one or more pieces of information in the image construction history record. All of the information acts on the same object in the image and has a before-and-after correlation, acting together on the object and causing security issues.

[0008] As a further improvement, the feature information described in the present invention includes four parts. The first part is to detect the startup permissions and startup execution settings in the startup default settings; the second part is to detect the file permission settings; the third part is to detect the username, password information and ssh key information in the sensitive information; the fourth part is to detect the mining program. Through the detection of the four parts, matching and comprehensive analysis are carried out with the feature library to output the final security detection results.

[0009] As a further improvement, the first part of the present invention is used to detect the startup permissions and startup execution settings in the default startup settings, determine whether the user permissions of the default startup of the image are ordinary users or super users (root), determine what type of files or commands are executed by the default startup of the image, and extract the characteristics of the detection content for subsequent comprehensive analysis; the second part is used to determine whether writable, executable permissions and setuid permissions exist, determine whether there are files with both writable and executable permissions, and then extract the permission operation parameters and objects; the third part is used to detect according to the username and password input format and SSH key usage method, and extract the existing username and password information and SSH key usage characteristics; the fourth part performs correlation matching based on the mining program source website, extracts the operation behavior characteristics of the suspicious mining program, and further confirms the characteristic behavior of the mining program.

[0010] As a further improvement, the whitelist mechanism described in the present invention manually analyzes the detection results, screens out false positives, and establishes a whitelist of false positive features for comprehensive analysis.

[0011] As a further improvement, the function fitting described in the present invention is to detect the number of software vulnerabilities in the image based on the image scanning tool, scan and count all time versions of the same image, draw a time distribution scatter plot of the number of vulnerabilities according to the time distribution, and perform function fitting based on the image scatter distribution to obtain a fitting function.

[0012] As a further improvement, the function fitting described in the present invention is to detect the number of software vulnerabilities in the image according to the image scanning tool, scan and count all time versions of the same image, draw a time distribution scatter plot of the number of vulnerabilities according to the time distribution, perform function fitting according to the image scatter distribution, and obtain a fitting function. At the same time, the image release date is used as the origin of the time axis, the relative value of the vulnerability discovery time and the image release time is taken as the horizontal axis, and the proportion of the number of vulnerabilities at this time to the total number of vulnerabilities is used as the vertical axis, and then function fitting is performed according to the image scatter distribution.

[0013] As a further improvement, the vulnerability prediction model described in the present invention is to scan and count a large number of image samples, take the average value, and then obtain a function expression through function fitting to establish a function model for vulnerability prediction.

[0014] The beneficial effects of the present invention are as follows:

[0015] The present invention discloses a Docker image security scanning method based on static analysis. The method combines an image scanning tool and a custom scanning method to analyze image software vulnerabilities. The image scanning tool analyzes the image software vulnerabilities, performs function fitting based on a scatter plot of the number of vulnerabilities, and establishes an image vulnerability prediction model. At the same time, a feature analysis method is used to perform custom detection on the Docker image build history record. The matched feature information is used to determine whether there are security issues in the image build, and malicious images are detected based on the security feature information. The method can effectively obtain image vulnerability information and vulnerability development trends. At the same time, based on the Docker image build information, it does not need to scan and detect the entire image file, and can quickly obtain, detect, and discover security issues in the image. Practice has proved that the method can effectively scan Docker images and comprehensively reflect the security status of the image.

[0016] This invention detects Docker image default settings, permission manipulation, sensitive information, and mining programs. It uses static analysis to achieve fast and efficient detection, addressing the gaps in detection and scanning in conventional image scanning tools. It also facilitates large-scale, rapid scanning, effectively improving scanning speed and detection coverage. Furthermore, it can understand and grasp the vulnerability trends in images, facilitating their repair, update, and other aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flowchart of the steps for implementing Docker image scanning based on static analysis methods. DETAILED DESCRIPTION

[0018] This paper discloses a Docker image scanning method based on static analysis, proposing a method for scanning Docker images and their build history based on static analysis. Image scanning tools are used to obtain existing vulnerability information for the image, and a predictive model is established and analyzed for software vulnerability trends. Feature extraction and feature matching methods are then used to scan the image build history and analyze security issues within the image. By combining these two aspects of scanning and detection, software vulnerability prediction results for the Docker image and image security scan results are obtained.

[0019] The present invention is based on scanning a large number of images and uses a static analysis method to extract security features of security issues in the image, thereby establishing a security feature database, and then using the established feature database to perform security detection on the image to be tested. The matching feature information includes four parts: the first is to detect the startup permissions and startup execution settings in the default startup settings, determine whether the user permissions of the image startup by default are ordinary users or super users (root), determine what type of files or commands are executed by the default startup of the image, and extract and analyze the features of the detected content, thereby reflecting whether there are security issues after the default startup of the image. The second is to detect the file permission settings, determine whether there are writable, executable permissions and setuid permissions, and determine whether there are files with both writable and executable permissions, and then extract the permission operation parameters and objects, thereby reflecting the security issues existing in the permission settings in the image. The third is to detect the username, password and SSH key information in the sensitive information, detect according to the username and password input format and SSH key usage method, extract the existing username and password information and SSH key usage features, thereby reflecting the leakage of sensitive information in the image. Fourth, we detect mining programs. We match them against their source websites and extract behavioral characteristics of suspicious mining programs to further verify their authenticity and determine whether they exist within the image. Combining these four aspects of detection, we match them against a signature database and conduct comprehensive analysis to produce the final security detection results.

[0020] The present invention uses an image scanning tool to scan an image, performs scanning statistics on all time versions of the same image, and draws a time distribution scatter plot of the number of vulnerabilities according to the time distribution. At the same time, with the image release date as the time axis origin, the relative value of the vulnerability discovery time and the image release time is taken as the horizontal axis, and the proportion of the number of vulnerabilities at this time to the total number of vulnerabilities is taken as the vertical axis. Then, function fitting is performed according to the image scatter distribution to obtain the time distribution and cumulative distribution function of the vulnerabilities. Further, a large number of images are scanned and statistically analyzed, and the average value is taken to establish a software vulnerability prediction model for the image. The model can be used to derive the vulnerability development trend in the image, which is convenient for the use of the image in repairing, updating, etc.

[0021] The overall structure of the present invention is described below with reference to the accompanying drawings. Figure 1 The present invention is a flowchart of steps for implementing Docker image scanning based on a static analysis method. The static analysis method of the present invention scans Docker images and build history records. The method specifically includes the following steps:

[0022] Step 1: Manually analyze known security issues and a large number of images to extract behavioral features from four aspects: default settings, permission operations, sensitive information, and mining programs.

[0023] Step 2: Perform correlation analysis on the extracted behavioral features, and combine the behavioral features of each part of the security issue to form the security feature behavior of the security issue, and then establish a security feature database for subsequent detection.

[0024] Step 3: Detect the image to be tested and extract behavioral features from four aspects: default settings, permission operations, sensitive information, and mining programs. Determine whether the default user permissions for the image startup are regular users or superusers, what type of files or commands are executed by default, whether writable, executable, and setuid permissions are present, whether files with both writable and executable permissions exist, whether usernames, passwords, and SSH keys are present, and whether mining-related behaviors exist. The extracted behavioral features are then matched with features in the feature database. If a match is successful, the security issue is identified; if a match fails, the security issue is not identified.

[0025] Step 4: To prevent false positives, a whitelist mechanism is added to manually analyze and confirm the test results, and manually confirmed false positives are excluded for subsequent analysis.

[0026] Step 5: Use the Grype image scanning tool to scan the image, obtain the temporal distribution of the number of software vulnerabilities in the image, and draw a scatter plot. Use the image release date as the origin of the time axis, take the relative value of the vulnerability discovery time and the image release time as the horizontal axis, and take the ratio of the number of vulnerabilities at that time to the total number of vulnerabilities as the vertical axis. Use the function fitting method to model the vulnerability distribution and obtain the function expression of the vulnerability time distribution.

[0027] Step 6: Repeat step 5 for a large number of images. Use the average value of the final results to build a vulnerability function model, and derive the time distribution and cumulative distribution model of the vulnerability for subsequent analysis.

[0028] Step 7: Use an image scanning tool to scan the image to be tested for software vulnerabilities and obtain information about existing software vulnerabilities for subsequent comprehensive analysis.

[0029] Step 8: Comprehensively analyze the detection results of the four aspects of default settings, permission operations, sensitive information, and mining programs, as well as the software vulnerabilities obtained from the scan. Use the whitelist mechanism and vulnerability prediction model to analyze, screen out false positives, and predict vulnerability development trends. Summarize and output the detection results, provide prompts for existing security issues, and provide feedback on improvement measures. Report software vulnerabilities in the image and feedback on future vulnerability growth trends.

[0030] Those skilled in the art will understand that the above description is merely a single example of the invention and is not intended to limit the invention. Although the invention has been described in detail with reference to the aforementioned examples, those skilled in the art will still be able to modify the technical solutions described in the aforementioned examples or replace some of the technical features therein with equivalents. Any modifications, equivalents, etc. made within the spirit and principles of the invention shall be included in the scope of protection of the invention.

Claims

1. A Docker image scanning method based on static analysis, characterized in that: Through manual analysis, a large number of Docker image build history records are extracted and a security feature library is established. Feature matching is performed on the images to be tested based on the security feature library, and security issues of the images are detected based on the feature information and whitelist mechanism. At the same time, the number of software vulnerabilities in the images is detected through image scanning tools, and a function is fitted according to the scatter plot of time distribution to establish a vulnerability prediction model. Finally, the information of both is used to comprehensively analyze the security issues of Docker images and feedback the image scanning results. The feature information includes four parts: the first part is to detect the startup permissions and startup execution settings in the startup default settings; the second part is to detect the file permission settings; The third part detects the username, password and SSH key information in the sensitive information; the fourth part detects the mining program, matches the four parts with the feature library and conducts comprehensive analysis to output the final security detection results; the first part is used to detect the startup permissions and startup execution settings in the default startup settings, determine whether the user permissions of the image startup by default are ordinary users or super users (root), determine what type of files or commands are executed by the image startup by default, and extract the characteristics of the detection content for subsequent comprehensive analysis; the second part is used to determine whether there are writable, executable and setuid permissions, and whether there are files with both writable and executable permissions, and then extract the permission operation parameters and objects; the third part is used to detect according to the username and password input format and SSH key usage method, and extract the existing username and password information and SSH key usage characteristics; The fourth part performs correlation matching based on the source website of the mining program, extracts the operational behavior characteristics of the suspicious mining program, and further confirms the characteristic behavior of the mining program.

2. The Docker image scanning method based on static analysis according to claim 1, characterized in that The feature extraction is to perform text matching on the Docker image build history according to the system commands and file names, analyze the operations or files known to have security issues, extract the security-related operations or settings involved, and incorporate them into the security feature library.

3. The Docker image scanning method based on static analysis according to claim 1, characterized in that The feature matching described is to use text matching to detect the build history of the image to be tested, and match it with the characteristic information in the security feature library to detect security issues in the image.

4. The Docker image scanning method based on static analysis according to claim 1, characterized in that The characteristic information is one or more pieces of information in the image building history. All of the information acts on the same object in the image and has a before-and-after correlation, acting together on the object and causing security issues.

5. The Docker image scanning method based on static analysis according to claim 1, characterized in that: The whitelist mechanism is to manually analyze the detection results, screen out false positives, and create a whitelist of false positive features for comprehensive analysis.

6. The Docker image scanning method based on static analysis according to claim 5, characterized in that: The function fitting is to detect the number of software vulnerabilities in the image according to the image scanning tool, perform scanning statistics on all time versions of the same image, draw a time distribution scatter plot of the number of vulnerabilities according to the time distribution, and perform function fitting according to the image scatter distribution to obtain a fitting function.

7. The Docker image scanning method based on static analysis according to claim 6, characterized in that: The function fitting is to detect the number of software vulnerabilities in the image using an image scanning tool, perform scanning statistics on all time versions of the same image, draw a time distribution scatter plot of the number of vulnerabilities according to the time distribution, perform function fitting based on the image scatter distribution, and obtain a fitting function. At the same time, the image release date is used as the origin of the time axis, the relative value of the vulnerability discovery time and the image release time is taken as the horizontal axis, and the proportion of the number of vulnerabilities at that time to the total number of vulnerabilities is taken as the vertical axis, and then the function fitting is performed based on the image scatter distribution.

8. The Docker image scanning method based on static analysis according to claim 1 or 2 or 3 or 4 or 6 or 7, characterized in that: The vulnerability prediction model is a function model that establishes a vulnerability prediction function by scanning and counting a large number of image samples and taking the average value. Then, a function expression is obtained through function fitting.

Images