Container environment safety protection method and device based on CVE

Abstract

The invention relates to a container environment safety protection method and device based on CVE, and the method comprises the steps: building an App service and an Agent service, and separating front and rear end management; constructing a CVE library, and according to the CVE library, performing security scanning on the container mirror image through an App service and an Agent service; monitoring the environment in the container in real time through the Agent service monitoring container; according to the CVE library, performing baseline compliance scanning on the Docker and Kubernetes components through an App service and an Agent service; the security scanning result, the real-time monitoring result and the baseline compliance scanning result are sent to Kafka; and processing the container environment according to the data in the Kafka, and storing the processed data into a CVE library for subsequent analysis and query. Compared with the prior art, the safety protection of the container environment is realized by constructing the own CVE library, and the distributed processing of the scanning tasks is realized by allocating the scanning tasks to different services, so that the cost is reduced while the overall scanning efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of container environment security protection, and in particular to a container environment security protection method and device based on CVE (Common Vulnerabilities And Exposures). Background Art

[0002] With the development of cloud computing technology, the form of cloud is constantly evolving. Container technology has been widely used in various systems due to its outstanding advantages. According to statistics, by 2022, more than 50% of enterprise applications will run in containerized cloud data centers. Although container technology is widely used in many fields, the security issues behind it cannot be ignored. A large number of container cloud security issues have occurred one after another. How to protect container clouds and ensure the security of the application operating environment has gradually received widespread attention and attention.

[0003] The existing security protection system is mainly EDR (Endpoint Detection and Response) system. EDR system mainly provides security protection for traditional operating systems and application services, providing a capability to analyze / retrieve more detailed / real-time / historical device data, thereby discovering traces of malicious activities, allowing users to pay attention to high-risk data and respond in a timely manner.

[0004] The core technologies of container cloud mainly include container orchestration, containerized packaging, and containerized operation. Therefore, the security issues of container cloud are concentrated on container infrastructure security, container image security, and container operation protection. However, traditional security protection systems have technical blind spots and cannot provide effective security protection for container cloud platforms.

[0005] Disadvantages of existing technology:

[0006] 1. Unable to perform image security scan

[0007] The image is the basis for container operation. The image is a file system package consisting of a layered file system and metadata describing the image. It contains the system, environment, configuration and application itself required by the application, and is a layered storage file system. Traditional protection tools cannot scan the content in the image.

[0008] 2. Unable to monitor and protect the internal environment of the container

[0009] Containers are essentially a virtualization technology at the operating system level. Container technology shares the host operating system kernel, uses the Linux Kernel's Namespaces technology for resource isolation and Cgroups technology for resource restriction, and implements lightweight resource virtualization and isolation. Since containers are a virtualization technology between infrastructure and platform, traditional security protection tools for infrastructure virtualization cannot completely solve the aforementioned security issues.

[0010] 3. Unable to monitor the basic environment outside the container

[0011] The various technology stack software and their configurations that make up the container cloud platform are also security protection points that cannot be ignored. Currently, commonly used container orchestration engines such as Kubernetes, Mesos, Swarm, and container engine Docker have more or less security risks, and traditional security protection tools cannot perform special security scans on them.

[0012] The prior art also provides technologies for image security scanning, monitoring and protecting the internal environment of containers, and monitoring the basic environment outside containers, but these technologies are basically based on single service for container security protection. When image security scanning, monitoring and protecting the internal environment of containers, or monitoring the basic environment outside containers are performed at the same time, in the face of the gradually expanding system scale and the gradually increasing scanning requirements, the resources, time and maintenance costs required for the operation will gradually increase, and when it is desired to increase the container security protection performance according to the expanded system scale, the scalability is also poor. Summary of the invention

[0013] The purpose of the present invention is to provide a container environment security protection method and device based on CVE. By building its own CVE (Common Vulnerabilities And Exposures) library, visual management capabilities are provided to achieve security protection for the container environment. At the same time, by allocating scanning tasks to different services, distributed processing of scanning tasks is achieved, which improves the overall scanning efficiency while reducing costs.

[0014] The purpose of the present invention can be achieved by the following technical solutions:

[0015] A container environment security protection method based on CVE, the method comprising:

[0016] Establish App services and Agent services to separate front-end and back-end management;

[0017] Build a CVE library and perform security scans on container images through App and Agent services based on the CVE library.

[0018] Monitor the environment in the container in real time through the Agent service monitoring container;

[0019] Based on the CVE library, perform baseline compliance scans on Docker and Kubernetes components through App services and Agent services;

[0020] Send security scan results, real-time monitoring results, and baseline compliance scan results to Kafka;

[0021] Based on the data in Kafka, the container environment is processed and the processed data is stored in the CVE library for subsequent analysis and query.

[0022] Furthermore, the construction process of the CVE library includes:

[0023] Collect vulnerability information from historical vulnerability records, vulnerability databases, security research institutions, vulnerability reporting platforms, and software vendor channels. Vulnerability information includes vulnerability description, impact scope, vulnerability type, vulnerability level, and repair suggestions;

[0024] Clean the collected vulnerability information, remove duplicate, invalid or erroneous information, and organize it into a standardized format;

[0025] Map vulnerability information to software, hardware, or system components to establish associations between vulnerabilities and affected objects;

[0026] The cleaned, organized and mapped vulnerability information is stored in the CVE library.

[0027] Furthermore, the security scanning of the container image through the App service and the Agent service specifically includes: initiating a security scan of the image in the Registry through the App service and initiating a security scan of the image on the host through the Agent service.

[0028] Furthermore, the security scanning process includes:

[0029] Parse the manifest file in the image, obtain the address of all layer layers of the image and find the content of the current layer file;

[0030] Parse the image file content of the current layer file to get the file list;

[0031] Identify the operating system type in the image by parsing the / etc / os-release and / usr / lib / os-release files in the file list, and view the software information installed in the image;

[0032] Compare the software version in the current image with the software version in the CVE library to identify whether there are related vulnerabilities and complete the image scan.

[0033] Furthermore, the real-time monitoring of the environment within the container includes: rebound monitoring, local privilege escalation monitoring and malicious command monitoring.

[0034] Furthermore, the rebound monitoring includes real-time monitoring of all reverse connection behaviors using Shell in the container and setting a connection whitelist for devices that are allowed to make reverse connections. The connection whitelist is set in the order of source host, process name, target host and target port;

[0035] The local privilege escalation monitoring includes real-time monitoring whether there is any behavior of escalating privileges from a low-privilege user process to a high-privilege user process in the container;

[0036] The malicious command monitoring includes real-time monitoring of the processes in the malicious command list in the protection container and setting a command whitelist for the processes allowed to run. The malicious command list and the command whitelist are set in the order of execution process, execution command line, host IP and container name.

[0037] Furthermore, the baseline compliance scan is divided into a baseline compliance scan of the Kubernetes control node initiated by the App service and a baseline compliance scan of the Kubernetes computing node initiated by the Agent service.

[0038] Furthermore, the baseline compliance scanning process includes:

[0039] Get the versions of Docker and Kubernetes nodes, and detect vulnerabilities in the current version by associating the version numbers with CVE data;

[0040] Query process information and obtain all configuration files and startup parameters;

[0041] Check the user and user group ownership and file permissions of the configuration files;

[0042] Parse the startup parameters to generate a parameter list, cyclically match the baseline rules, and check whether the baseline meets the security standards.

[0043] Furthermore, the processing of the container environment includes:

[0044] If the security scan result shows that there is a security vulnerability, repair the vulnerability or make repair suggestions based on the CVE library;

[0045] If the real-time monitoring result shows that there is a behavior of using Shell to make a reverse connection, elevating the privilege from a low-privileged user process to a high-privileged user process, or running a process in the malicious command list, an alarm will be issued and the operation of the behavior in the container will be stopped;

[0046] If the baseline compliance scan result shows that the baseline does not meet the security standards, repair or make repair suggestions for the baseline that does not meet the security standards based on the CVE library;

[0047] Comprehensive security scan results, real-time monitoring results, and baseline compliance scan results are used to make visual statistics on the security level of the container environment.

[0048] A container environment security protection device based on CVE, the method comprising:

[0049] The Dashboard module centrally displays the total number of images, the number of defective images, the pass rate of baseline compliance checks for all hosts and clusters, statistics on abnormal behavior events that occurred in containers in the current month, and the total number of hosts and containers, as well as the number of online and offline hosts and containers.

[0050] Vulnerability library management module, builds and manages CVE library;

[0051] The image scanning module performs security scans on container images through the App service and Agent service according to the CVE library, and sends the results to Kafka;

[0052] The container monitoring module monitors the environment in the container in real time through the Agent service monitoring container and sends the results to Kafka;

[0053] The baseline scanning module performs baseline compliance scanning on Docker and Kubernetes components through the App service and Agent service according to the CVE library, and sends the results to Kafka;

[0054] The processing module processes the container environment according to the data in Kafka and stores the processed data in the database for subsequent analysis and query.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] 1. The present invention establishes its own CVE library to perform image security scanning, baseline scanning and container protection on the container environment, thereby realizing comprehensive monitoring and security protection of the asset information of the container cloud platform; at the same time, by allocating scanning tasks to different services, distributed processing of scanning tasks is realized, multiple scanning tasks can be performed in parallel, improving the overall scanning efficiency, and making the security protection system easier to expand and maintain. App services and Agent services can reasonably allocate scanning tasks according to the resource conditions of their respective nodes, improve resource utilization, achieve load balancing, and avoid performance degradation or failure caused by overload of a single service;

[0057] 2. For image scanning in the image warehouse, the present invention initiates the scanning by the App service and downloads the image layer file from the Registry, which can reduce unnecessary data transmission overhead; for image scanning on the host, the Agent service directly scans the image file, which can avoid data transmission delay and bandwidth occupation;

[0058] 3. The present invention integrates security scanning results, real-time monitoring results and baseline compliance scanning results to make visual statistics on the security level of the container environment, and stores the processing results in a closed loop in the CVE library, thereby realizing self-optimization of the library. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 is a flow chart of the method of the present invention;

[0060] Figure 2 It is a logical architecture diagram of the present invention;

[0061] Figure 3 This is a flow chart of image security scanning of the present invention;

[0062] Figure 4 It is a flow chart of real-time monitoring of containers of the present invention;

[0063] Figure 5 A baseline compliance scanning flow chart for the present invention;

[0064] Figure 6 FIG. 4 is a diagram of the device architecture of the present invention. DETAILED DESCRIPTION

[0065] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0066] Example 1

[0067] This embodiment intends to disclose a container environment security protection method based on CVE, the steps are as follows: Figure 1As shown, including:

[0068] S1, establish App service and Agent service to separate front-end and back-end management;

[0069] S2, build CVE library;

[0070] S3, and based on the CVE library, performs security scans on container images through the App service and Agent service;

[0071] S4, monitors the environment in the container in real time through the Agent service monitoring container;

[0072] S5, based on the CVE library, performs baseline compliance scans on Docker and Kubernetes components through the App service and Agent service;

[0073] S6, sends security scan results, real-time monitoring results, and baseline compliance scan results to Kafka;

[0074] S7 processes the container environment based on the data in Kafka and stores the processed data in the CVE library for subsequent analysis and query.

[0075] In this embodiment, Figure 2 As shown in the figure, the front-end and back-end separation mode is adopted for development. The front-end Web service is developed with AngularJs, and the back-end App service is developed with the go-restful framework of the Go language to provide responses for front-end operations. The Agent (client) is developed with C++ for information collection and security protection of the node host. The Consumer (consumer service) is developed with Java to process the result information generated by the Agent service and provide App service query.

[0076] Web services are used to provide interactive interface operations.

[0077] The App service is used to respond to Web service requests and generally includes five major functions: CVE data management, baseline rule refresh, task triggering, registry-based image scanning, and baseline scanning of K8S-Master nodes.

[0078] The Agent service is deployed on each node that needs protection and includes seven major functions: client environment information collection, baseline rule data loading, message receiver, host-based mirroring, baseline scanning of K8S-worker nodes, protection of running containers, and data sending.

[0079] The Consumer service processes and stores node environment information, baseline scan results, and image scan results.

[0080] The Etcd service serves as the client service registration center. The App service watches (monitors) the Etcd service to determine the client service status (online / offline) and baseline rule version (consistent / abnormal).

[0081] The Kafka service is used to store the client's image scan results and baseline scan results on the host and the container environment monitoring data.

[0082] The Redis service is used to store baseline scanning rule data.

[0083] MongoDB is used to store core application data.

[0084] PostgreSQL is used to store CVE vulnerability data.

[0085] The Registry service is used to store Docker images, image hierarchies, and image-related metadata, and is also used to respond to Docker pull / push requests.

[0086] The process of building the CVE library includes:

[0087] Collect vulnerability information from historical vulnerability records, vulnerability databases, security research institutions, vulnerability reporting platforms, and software vendor channels. Vulnerability information includes vulnerability description, impact scope, vulnerability type, vulnerability level, and repair suggestions;

[0088] Clean the collected vulnerability information, remove duplicate, invalid or erroneous information, and organize it into a standardized format;

[0089] Map vulnerability information to software, hardware, or system components to establish associations between vulnerabilities and affected objects;

[0090] The cleaned, organized and mapped vulnerability information is stored in the CVE library.

[0091] The security scan of the container image includes: initiating a security scan of the image in the registry through the App service and initiating a security scan of the image on the host through the Agent service. These two modes can quickly produce temporary version data and generate the official release version data through version release.

[0092] The specific process of security scanning is as follows Figure 3 As shown, including:

[0093] For image scanning in the registry, the App service needs to download the image layer file through the registry. For image scanning on the host, the Agent service directly scans the image file.

[0094] By parsing the manifest file in the image, we can get the address digest of all the layer files in the image. Through this address, we can find the content of the current layer file, and then parse the image file content to get a file list.

[0095] Identify the operating system type in the image by parsing the / etc / os-release and / usr / lib / os-release files, and view the software information installed in the image through the operating system package management tool;

[0096] Compare the software version in the current image with the version in the CVE data, identify related vulnerabilities, and complete the image scan.

[0097] Real-time monitoring of the environment within the container is the security protection of the environment within the container, including: rebound monitoring, local privilege escalation monitoring and malicious command monitoring, and real-time analysis of the processes within the container.

[0098] Among them, rebound monitoring includes real-time monitoring of all reverse connection behaviors using Shell in the container and setting up a connection whitelist for devices that are allowed to make reverse connections. The connection whitelist is set in the order of source host, process name, target host, and target port;

[0099] Local privilege escalation monitoring includes real-time monitoring of whether there is any behavior in the container where the privilege is escalated from a low-privilege user process to a high-privilege user process;

[0100] Malicious command monitoring includes real-time monitoring of the processes in the malicious command list within the protection container and setting up a command whitelist for the processes allowed to run. The malicious command list and the command whitelist are set in the order of execution process, execution command line, host IP and container name.

[0101] The specific steps of the real-time monitoring process are as follows: Figure 4 As shown, including:

[0102] Collect all process information on the host machine by frequency;

[0103] Organize all processes into a process list according to the parent-child process relationship;

[0104] Analyze whether there is bash to bash in the process list, if yes, it is considered as rebound shell;

[0105] Analyze whether there is a situation where ordinary users become root users in the process list. If so, it is determined as local privilege escalation;

[0106] Check whether there is a blacklist process in the matching process list. If yes, it is considered a malicious command.

[0107] Send the protection result to Kafka.

[0108] Baseline compliance scanning is divided into baseline compliance scanning of Kubernetes control nodes initiated by App services and baseline compliance scanning of Kubernetes computing nodes initiated by Agent services.

[0109] In order to enable the client to quickly load rule data after the server modifies the baseline rule, instead of publishing the client and server versions at the same time, this embodiment implements real-time loading of baseline data based on the cache center mode, which greatly improves the efficiency of baseline data modification.

[0110] The process of baseline scanning is as follows Figure 5 As shown, including:

[0111] Initiate rule data refresh through web service, and the App service flushes the data into redis service, then modifies the registration center node information, and the registration center notifies each client to load the cache;

[0112] Use the docker version command to obtain the Docker version and the kubectl get no command to obtain the versions of the control node and computing node. Associate the version number with CVE data to detect vulnerabilities in the current version.

[0113] Query the dockerd, kubelet, api-server, controller-manager, etcd, and scheduler process information to obtain all configuration files and startup parameters;

[0114] Check the user and user group ownership and file permissions of the configuration files;

[0115] Parse the startup parameters to generate a parameter list, cyclically match the baseline rules, and check whether the baseline meets the security standards.

[0116] Finally, the container environment is processed including:

[0117] If the security scan result shows that there is a security vulnerability, repair the vulnerability or make repair suggestions based on the CVE library;

[0118] If the real-time monitoring result shows that there is a behavior of using Shell to make a reverse connection, elevating the privilege from a low-privileged user process to a high-privileged user process, or running a process in the malicious command list, an alarm will be issued and the operation of the behavior in the container will be stopped;

[0119] If the baseline compliance scan result shows that the baseline does not meet the security standards, repair or make repair suggestions for the baseline that does not meet the security standards based on the CVE library;

[0120] Comprehensive security scan results, real-time monitoring results, and baseline compliance scan results are used to make visual statistics on the security level of the container environment.

[0121] Example 2

[0122] This embodiment intends to disclose a container environment security protection device based on CVE, the specific structure is as follows Figure 6 As shown, including:

[0123] Dashboard module 1, which centrally displays the total number of images, the number of defective images, the pass rate of baseline compliance checks for all hosts and clusters, statistics on abnormal behavior events that occurred in containers in the current month, and the total number of hosts and containers, as well as the number of online and offline hosts and containers;

[0124] Vulnerability library management module 2, builds and manages the CVE library;

[0125] Image scanning module 3, based on the CVE library, performs security scans on container images through App services and Agent services, and sends the results to Kafka;

[0126] Container monitoring module 4 monitors the environment in the container in real time through the Agent service monitoring container and sends the results to Kafka;

[0127] Baseline scanning module 5, based on the CVE library, performs baseline compliance scanning on Docker and Kubernetes components through App service and Agent service, and sends the results to Kafka;

[0128] Processing module 6 processes the container environment according to the data in Kafka and stores the processed data in the database for subsequent analysis and query.

[0129] The home page view of Dashboard module 1 is used to display the asset information and various risk information of the container cloud platform, including cluster statistics, host statistics, container statistics, warehouse statistics, image statistics, and risk statistics. The first four functions will display the total number / online number / offline number of hosts and containers. In addition, the image statistics will display the total number of images / defective images, and the risk overview will display the baseline compliance check pass rate of all hosts and clusters and the statistics of abnormal behavior events that occurred in the container that month.

[0130] Vulnerability library management module 2 provides visual maintenance capabilities for CVE data. It provides file import of CVE data and cloning of existing version CVE data to generate a version to be released. For unreleased version CVE data, operations can be added, modified, and deleted. The data of the version to be released can be turned into the official version through the release operation. It also provides the function of exporting CVE data.

[0131] The functions of the image scanning module 3 include image warehouse management, image scanning within the warehouse, host image scanning, and scanning result display. Image warehouse management can add, delete, modify, and query image warehouses. For image scanning within the warehouse, you can select a specific image warehouse for image scanning. You can scan all images or specify images. In addition, you can set triggers on the image project to automatically scan the submitted images. For host image scanning, you can select a specified host to scan all images on the host. The scan result list displays the image project, image tag, and vulnerability status. Opening the vulnerability details displays the defect code, severity, component, current version, and repair version.

[0132] Container monitoring module 4 includes three functions: rebound detection, malicious commands, and local privilege escalation.

[0133] Bounce detection: Real-time monitoring of all reverse connection behaviors using Shell in the container. In addition, whitelist rules can be set, including: source host, process name, target host, and target port.

[0134] Malicious commands: Based on the configured malicious command rules, malicious commands in the protection container are monitored in real time. Whitelist rules can also be set, including execution process, execution command line, host IP, and container name.

[0135] Local privilege escalation: Monitor in real time whether there is any behavior in the container where the privilege is escalated from a low-privileged user process to a high-privileged user process.

[0136] Baseline scanning module 5 includes two contents: CISDocker container baseline check and CIS Kubernetes baseline check. The importance, check item category, check item, check result, and detailed expansion are displayed under the two functions. During the inspection, you can trigger all inspections with one click, or you can select specified inspection items and inspection objects for inspection. You can export and open the details to display the inspection item description, inspection method, repair suggestions and specific object list. The container baseline specific list displays the container name, container status, host IP, and inspection results. The Kubernetes baseline specific list displays the host IP, host name, grouping, and inspection results.

[0137] The specific details of the above modules can be understood by referring to the relevant descriptions and effects in Example 1.

[0138] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or substitutions within the technical scope disclosed by the present invention, and these modifications or substitutions should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A container environment security protection method based on CVE, characterized in that: The method comprises: Establish App services and Agent services to separate front-end and back-end management; Build a CVE library and perform security scans on container images through App and Agent services based on the CVE library. Monitor the environment in the container in real time through the Agent service monitoring container; Based on the CVE library, perform baseline compliance scans on Docker and Kubernetes components through App services and Agent services; Send security scan results, real-time monitoring results, and baseline compliance scan results to Kafka; Based on the data in Kafka, the container environment is processed and the processed data is stored in the CVE library for subsequent analysis and query.

2. According to a CVE-based container environment security protection method according to claim 1, it is characterized in that: The construction process of the CVE library includes: Collect vulnerability information from historical vulnerability records, vulnerability databases, security research institutions, vulnerability reporting platforms, and software vendor channels. Vulnerability information includes vulnerability description, impact scope, vulnerability type, vulnerability level, and repair suggestions; Clean the collected vulnerability information, remove duplicate, invalid or erroneous information, and organize it into a standardized format; Map vulnerability information to software, hardware, or system components to establish associations between vulnerabilities and affected objects; The cleaned, organized and mapped vulnerability information is stored in the CVE library.

3. According to a CVE-based container environment security protection method according to claim 1, it is characterized in that: The security scanning of the container image through the App service and the Agent service specifically includes: initiating a security scan of the image in the Registry through the App service and initiating a security scan of the image on the host through the Agent service.

4. According to a CVE-based container environment security protection method according to claim 3, it is characterized in that: The security scanning process includes: Parse the manifest file in the image, obtain the address of all layer layers of the image and find the content of the current layer file; Parse the image file content of the current layer file to get the file list; Identify the operating system type in the image by parsing the / etc / os-release and / usr / lib / os-release files in the file list, and view the software information installed in the image; Compare the software version in the current image with the software version in the CVE library to identify whether there are related vulnerabilities and complete the image scan.

5. According to a CVE-based container environment security protection method according to claim 1, it is characterized in that: The real-time monitoring of the environment within the container includes: rebound monitoring, local privilege escalation monitoring and malicious command monitoring.

6. According to a CVE-based container environment security protection method according to claim 5, it is characterized in that: The rebound monitoring includes real-time monitoring of all reverse connection behaviors using Shell in the container and setting a connection whitelist for devices that are allowed to make reverse connections. The connection whitelist is set in the order of source host, process name, target host and target port; The local privilege escalation monitoring includes real-time monitoring whether there is any behavior of escalating privileges from a low-privilege user process to a high-privilege user process in the container; The malicious command monitoring includes real-time monitoring of the processes in the malicious command list in the protection container and setting a command whitelist for the processes allowed to run. The malicious command list and the command whitelist are set in the order of execution process, execution command line, host IP and container name.

7. The method for protecting container environment security based on CVE according to claim 1, characterized in that: The baseline compliance scan is divided into a baseline compliance scan of the Kubernetes control node initiated by the App service and a baseline compliance scan of the Kubernetes computing node initiated by the Agent service.

8. The method for protecting container environment security based on CVE according to claim 7, characterized in that: The baseline compliance scanning process includes: Get the versions of Docker and Kubernetes nodes, and detect vulnerabilities in the current version by associating the version numbers with CVE data; Query process information and obtain all configuration files and startup parameters; Check the user and user group ownership and file permissions of the configuration files; Parse the startup parameters to generate a parameter list, cyclically match the baseline rules, and check whether the baseline meets the security standards.

9. The method for protecting container environment security based on CVE according to claim 1, characterized in that: The processing of the container environment includes: If the security scan result shows that there is a security vulnerability, repair the vulnerability or make repair suggestions based on the CVE library; If the real-time monitoring result shows that there is a behavior of using Shell to make a reverse connection, elevating the privilege from a low-privileged user process to a high-privileged user process, or running a process in the malicious command list, an alarm will be issued and the operation of the behavior in the container will be stopped; If the baseline compliance scan result shows that the baseline does not meet the security standards, repair or make repair suggestions for the baseline that does not meet the security standards based on the CVE library; Comprehensive security scan results, real-time monitoring results, and baseline compliance scan results are used to make visual statistics on the security level of the container environment.

10. A container environment security protection device based on CVE, characterized in that: The method comprises: The Dashboard module centrally displays the total number of images, the number of defective images, the pass rate of baseline compliance checks for all hosts and clusters, statistics on abnormal behavior events that occurred in containers in the current month, and the total number of hosts and containers, as well as the number of online and offline hosts and containers. Vulnerability library management module, builds and manages CVE library; The image scanning module performs security scans on container images through the App service and Agent service according to the CVE library, and sends the results to Kafka; The container monitoring module monitors the environment in the container in real time through the Agent service monitoring container and sends the results to Kafka; The baseline scanning module performs baseline compliance scanning on Docker and Kubernetes components through the App service and Agent service according to the CVE library, and sends the results to Kafka; The processing module processes the container environment according to the data in Kafka and stores the processed data in the database for subsequent analysis and query.

Images