Method and system for improving cloud native environment intrusion detection efficiency

Abstract

The invention discloses a method and a system for improving cloud native environment intrusion detection efficiency. The method comprises the following steps: monitoring whether load configuration resources arranged in a cluster are changed or not; wherein in the cluster, a corresponding load configuration resource is set for each working load, and one working load relates to a plurality of instances; generating a corresponding intrusion detection rule set according to the changed target load configuration resources; according to a plurality of target instances related to a target workload corresponding to the target load configuration resource, determining a plurality of target nodes for operating the plurality of target instances from the cluster; sending the intrusion detection rule set to the plurality of target nodes, so that host intrusion detection systems on the plurality of target nodes execute detection operation based on the intrusion detection rule set; according to the invention, the efficiency and accuracy of intrusion detection are significantly improved, and more efficient and intelligent security protection is provided for the cloud native environment.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing and network security technologies, and in particular to a method and system for improving the efficiency of intrusion detection in a cloud-native environment. Background Art

[0002] The current mainstream intrusion detection systems include: network-based intrusion detection systems (NIDS) and host-based intrusion detection systems (HIDS). Among them, the object monitored by HIDS is the process. HIDS monitors the data source (system calls, system logs, audit records, etc.) through the detection rule set to detect abnormal behavior of the process. In addition, in a cloud-native environment, the workload is composed of one or more instance Pods, and an instance Pod is composed of one or more containers. The container is essentially a process running in a resource-constrained and isolated environment. Therefore, the abnormal behavior of the container can be monitored through system calls. Due to the isolation of containers, the detection rule set for processes running in containers and the detection rule set for processes running on the host should be treated differently; however, the detection rule set of traditional HIDS is static and is uniformly sent down to each endpoint (node) by the control center. Therefore, the detection rule set for each node is the same. Since the number and type of containers running on different nodes in a cloud-native environment are different, and the configuration of different containers may not be compatible, if the traditional HIDS detection method is used to perform intrusion detection on nodes in a cloud-native environment, there will be problems of low efficiency. Summary of the Invention The purpose of the present invention is to provide a method and system for improving the efficiency of intrusion detection in cloud native environments, effectively solving the limitations of static rule sets, significantly improving the efficiency and accuracy of intrusion detection, while reducing unnecessary performance losses, and providing more efficient and intelligent security protection for cloud native environments.

[0003] According to one aspect of the present invention, a method for improving the efficiency of intrusion detection in a cloud-native environment is provided, which is applied to a controller deployed in a cluster in a cloud-native environment. The method includes: Monitoring whether load configuration resources set in the cluster have changed; wherein corresponding load configuration resources are set for each workload in the cluster, and a workload involves multiple instances; Generate corresponding intrusion detection rule sets based on the changing target load configuration resources; Determining, from the cluster, a plurality of target nodes that run the plurality of target instances according to the plurality of target instances involved in the target workload corresponding to the target load configuration resource; The intrusion detection rule set is sent to the multiple target nodes, so that the host intrusion detection systems on the multiple target nodes perform detection operations based on the intrusion detection rule set.

[0004] Optionally, configuring resources according to the changed target load to generate a corresponding intrusion detection rule set specifically includes: Determining whether a system call event of a host intrusion system of the cluster includes a name of a target workload corresponding to the target workload configuration resource; If yes, then setting the name of the target workload as a matching condition; if no, then setting the names of the multiple target instances as matching conditions; The matching condition is used to execute detection operations according to the intrusion detection rule set only on the system call events corresponding to the names in the matching condition through the host intrusion detection system.

[0005] Optionally, configuring resources according to the changed target load to generate a corresponding intrusion detection rule set further includes: Parsing preset detection parameters from the target load configuration resource; generating a process detection rule related to the process behavior based on the detection parameter, and adding the process detection rule to the intrusion detection rule set; The detection parameters include a process whitelist and / or a file monitoring policy.

[0006] Optionally, configuring resources according to the changed target load to generate a corresponding intrusion detection rule set further includes: Parsing the configuration information of the multiple target instances from the target load configuration resource; By analyzing the configuration information of the target instance, it is determined whether the container in the instance is mounted with a preset dangerous directory of the host machine. If so, a sensitive file access monitoring rule is generated and added to the intrusion detection rule set; By analyzing the configuration information of the target instance, it is determined whether the container in the instance contains preset dangerous permissions. If so, a system call monitoring rule related to the permission is generated and the system call monitoring rule is added to the intrusion detection rule set.

[0007] Optionally, sending the intrusion detection rule set to the multiple target nodes specifically includes: Pushing the intrusion detection rule set to the detection agent on the target node via a bidirectional communication link established between the controller and the detection agent deployed on the target node; and / or, Periodically receive update requests sent by the detection agent deployed on the target node, and send the latest version of the intrusion detection rule set to the detection agent on the target node.

[0008] Optionally, the method further includes: Recording the intrusion detection rule set generated for each load configuration resource into a preset rule map, so as to represent the corresponding relationship between the load configuration resource and the intrusion detection rule set through the rule map; Recording the nodes associated with each load configuration resource into a preset resource map, so as to represent the corresponding relationship between the load configuration resources and the nodes through the resource map; The intrusion detection rule set obtained by each node is recorded in a preset node map respectively, so as to represent the corresponding relationship between the node and the intrusion detection rule set through the node map.

[0009] To achieve the above object, the present invention further provides a system for improving the efficiency of intrusion detection in a cloud native environment, the system comprising: a controller deployed in a cluster of a cloud native environment, and a detection agent deployed on each node in the cluster; The controller is used to execute the above-mentioned method for improving the efficiency of intrusion detection in cloud native environments; The detection agent is used to intrude into the host detection system of the current node and perform detection operations based on the intrusion detection rule set stored on the current node.

[0010] Optionally, the detection agent is specifically used to: Collect detection data of the current node through the probe; wherein the detection data includes: system call events, attached processes, files and cloud native specific information; A target intrusion detection rule set is matched from all intrusion detection rule sets stored on the current node based on the detection data, and a detection operation is performed using the target intrusion detection rule set.

[0011] In order to achieve the above-mentioned objectives, the present invention also provides a computer device, which specifically includes: a memory, a processor, and a computer program stored on the memory and capable of running on the processor. When the processor executes the computer program, the steps of the method for improving the efficiency of intrusion detection in cloud native environments introduced above are implemented.

[0012] In order to achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method for improving the efficiency of intrusion detection in cloud native environments introduced above are implemented.

[0013] The method and system for improving the efficiency of intrusion detection in cloud-native environments provided by the present invention can dynamically generate a targeted detection rule set for the host intrusion detection system HIDS running on each node in the cluster according to the configuration of the workload in the cloud-native environment, thereby reducing the performance overhead of the HIDS matching rules, and further improving the efficiency of HIDS alarms. In the present invention, a host intrusion detection system HIDS based on a cloud-native environment is provided. By means of a controller mode, it can adapt to the elasticity and dynamics of the cloud-native environment, can be flexibly adjusted with the scaling of resources, can generate specific detection rules according to the containers running in the cloud-native environment, and can also generate unique detection rule sets for different nodes; on the one hand, it improves the efficiency of rule detection, and on the other hand, it can reduce the performance overhead of rule detection for each node. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings: Figure 1 This is an optional flowchart of the method for improving the efficiency of intrusion detection in a cloud-native environment provided in Example 1; Figure 2 A schematic diagram of an optional structural structure of a system for improving the efficiency of intrusion detection in cloud-native environments provided in Example 2; Figure 3 A schematic diagram of another optional structural component of the system for improving the efficiency of intrusion detection in cloud-native environments provided in Example 2; Figure 4 This is a schematic diagram of an optional hardware structure of the computer device provided in Example 3. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0016] Example 1 The embodiment of the present invention provides a method for improving the efficiency of intrusion detection in a cloud native environment, which is applied to a controller deployed in a cluster in a cloud native environment, such as Figure 1 As shown, the method specifically includes the following steps: Step S101: monitoring whether the load configuration resources set in the cluster have changed; wherein corresponding load configuration resources are set for each workload in the cluster, and one workload involves multiple instances.

[0017] In this embodiment, the k8s (Kubernetes) cluster will be used as an example for explanation. A controller will be set up in the k8s cluster in advance. The controller is a deployment-type workload and is deployed in the k8s cluster. The main responsibility of the controller is to monitor the workload of the entire k8s cluster and generate an intrusion detection rule set for each node in the k8s cluster based on the cloud-native environment information.

[0018] In this embodiment, corresponding load configuration resources are also set up for different workloads in the k8s cluster. A workload is an application running on Kubernetes. The Kubernetes container orchestration system is the de facto standard for cloud native. A workload consists of one or more instance Pods, and an instance Pod consists of one or more containers. Containers are a virtualization technology based on operating system capabilities (namespaces and cgroups). Containers are essentially processes running in a resource-constrained and isolated environment. In addition, load configuration resources are custom resources (CRDs). A load configuration resource includes configuration information and preset detection parameters for the multiple instance Pods involved. Therefore, the load configuration resource of a workload is associated with a group of instance Pods related to the workload, and the load configuration resource includes the configuration information of the group of instance Pods and some detection parameters used to generate intrusion detection rules.

[0019] Specifically, step S101 includes: The controller implements a control loop mode (also known as controller mode), in which the controller continuously attempts to bring the current state of the monitored object closer to the desired state. The monitored object in this embodiment is the load configuration resource described above. The controller monitors changes in the load configuration resource by calling the list-watch method of the kube-apiserver. Changes in the load configuration resource are triggered by changes in a certain instance Pod or associated workload. Therefore, through this mode, the controller can effectively track changes in instance Pods or workloads, thereby being able to adapt very well to the elasticity and dynamism of cloud-native environments.

[0020] Among them, changes in load configuration resources include: adding load configuration resources for new workloads in the k8s cluster, deleting load configuration resources for existing workloads, and updating load configuration resources for existing workloads; in addition, updating load configuration resources for existing workloads includes: adding or reducing instance Pods and updating detection parameters.

[0021] Step S102: Generate a corresponding intrusion detection rule set according to the changed target load configuration resources.

[0022] In this embodiment, whenever a change in load configuration resources is monitored, a reconcile method in the controller is called. This method is an entry method for generating an intrusion detection rule set.

[0023] Specifically, step S102 includes: Step A1: determining whether the system call event of the host intrusion system of the cluster contains the name of the target workload corresponding to the target workload configuration resource; Step A2: If yes, then set the name of the target workload as a matching condition; if no, then set the names of the multiple target instances as matching conditions; The matching condition is used to execute detection operations according to the intrusion detection rule set only on the system call events corresponding to the names in the matching condition through the host intrusion detection system.

[0024] It should be noted that an intrusion detection rule includes fields such as rule name, rule description, matching conditions, output, priority, and enable flag. The core work of the controller in generating intrusion detection rules is to generate the matching conditions of the rules. Only when the matching conditions are met will the corresponding intrusion detection rule be called for detection operations.

[0025] In this embodiment, the controller finds a group of instance Pods through the configuration information and detection parameters defined by the load configuration resource in the above-mentioned entry method. First, this group of instance Pods will be sorted according to the node (nodeName) to which they belong, and all the nodes affected by the load configuration resource will also be filtered out. It should be noted that nodes is a collection of nodName. Sorting the nodeName of a group of instance Pods here can ensure that when this group of instance Pods does not change, the content of the generated intrusion detection rule set will not change; the purpose of filtering out all the nodes affected by the load configuration resource is to know which nodes to update the intrusion detection rules on when the intrusion detection rule set corresponding to the load configuration resource changes.

[0026] With the above set of instance Pods, we can generate a matching condition to match this set of instance Pods. Because host intrusion detection systems (HIDSs) include workload names when enriching system call events, matching a set of instance Pods for a specific workload type can be very simple: simply matching the workload name. Without a workload name, the only way to match the set of instance Pods is to use the "in" method, such as "pod.name in (pod1, pod2,..., podn)."

[0027] Furthermore, the step S102 further includes: Step B1: parsing preset detection parameters from the target load configuration resources; Step B2: generating a process detection rule related to the process behavior based on the detection parameter, and adding the process detection rule to the intrusion detection rule set; The detection parameters include a process whitelist and / or a file monitoring policy.

[0028] Furthermore, the step S102 further includes: Step C1: Parsing the configuration information of the multiple target instances from the target load configuration resource.

[0029] Step C2: By analyzing the configuration information of the target instance, determining whether the container in the instance mounts a preset dangerous directory of the host machine, and if so, generating a sensitive file access monitoring rule, and adding the sensitive file access monitoring rule to the intrusion detection rule set; The preset dangerous directory is at least one of the following: / etc / shadow, / etc / sudoers, / etc / security / pwquality.conf, / etc / pam.conf, / var / run / docker.sock; It should be noted that due to the isolation of containers in the instance Pod, normal container reading and writing of the application's / etc / shadow is not considered a dangerous operation. Only when the container can read and write the host's / etc / shadow is it considered a dangerous operation. Therefore, the controller only generates sensitive file access monitoring rules for containers that mount directories such as the root directory ( / ) and / etc. If the host intrusion detection system HIDS detects this behavior, the alarm reported is considered a valid alarm.

[0030] Step C3: By analyzing the configuration information of the target instance, determining whether the container in the instance contains a preset dangerous permission, if so, generating a system call monitoring rule related to the permission, and adding the system call monitoring rule to the intrusion detection rule set; The preset dangerous permissions are at least one of the following: CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_SYS_MODULE, CAP_DAC_READ_SEARCH, CAP_DAC_READ_SEARCH+CAP_DAC_OVERRIDE; In this embodiment, when the container has the CAP_SYS_ADMIN permission, it allows a large number of privileged operations, including mounting file systems. An attacker can trigger a rebound shell through the release_agent mechanism by mounting the cgroup file system; When the container has the CAP_SYS_PTRACE permission and the pid namespace is not isolated, an attacker can use the ptrace system call to inject shellcode that executes a rebound shell into any process; When a container has the CAP_SYS_MODULE permission, an attacker can add a malicious kernel module to the kernel and run a reverse shell. When a container has the CAP_DAC_READ_SEARCH permission, an attacker can exploit the container to run a malicious process that calls open_by_handle_at to brute-force read the host machine's file contents. When a container has CAP_DAC_READ_SEARCH+CAP_DAC_OVERRIDE permissions, an attacker can exploit the container to run a malicious process that calls open_by_handle_at to brute-force read the host's file contents, and can also write arbitrary content to the host's files.

[0031] Preferably, for a container containing SYS_ADMIN, the controller generates rules for monitoring the mount command and the mount system call; for a container containing SYS_PTRACE, the controller generates rules for monitoring the ptrace system call; and for a container containing SYS_MODULE, the controller generates rules for monitoring the init_module system call.

[0032] Step S103: according to the multiple target instances involved in the target workload corresponding to the target load configuration resource, determine multiple target nodes running the multiple target instances from the cluster.

[0033] Step S104: sending the intrusion detection rule set to the multiple target nodes, so that the host intrusion detection systems on the multiple target nodes perform detection operations based on the intrusion detection rule set.

[0034] Specifically, the method further includes: Recording the intrusion detection rule set generated for each load configuration resource into a preset rule map, so as to represent the corresponding relationship between the load configuration resource and the intrusion detection rule set through the rule map; Recording the nodes associated with each load configuration resource into a preset resource map, so as to represent the corresponding relationship between the load configuration resources and the nodes through the resource map; The intrusion detection rule set obtained by each node is recorded in a preset node map respectively, so as to represent the corresponding relationship between the node and the intrusion detection rule set through the node map.

[0035] In this embodiment, all intrusion detection rule sets generated are stored through a rule map; wherein, an intrusion detection rule set includes all intrusion detection rules generated for a load configuration resource. In addition, the intrusion detection rule set specifically includes: rule set name, rule set content, content identifier, and rule set reference count; since the name of the load configuration resource is unique, the rule set name can use the name of the load configuration resource; the rule set content may include multiple intrusion detection rules for use by HIDS; the content identifier is a CRC32 generated based on the rule set content, which is used to determine whether the rule set content has been updated; the rule set reference count is used to represent the number of times the intrusion detection rule set is used by the node. When the rule set reference count is 0, the controller will delete the intrusion detection rule set with a rule set reference count of 0.

[0036] In this embodiment, the intrusion detection rule set stored on each node in the k8s cluster is recorded through a node map; for example, node 1 (node1) stores intrusion detection rule set 1 (rule1) and intrusion detection rule set 2 (rule2), while node 2 (node2) stores intrusion detection rule set 2 (rule2) and intrusion detection rule set 3 (rule3). It should also be noted that a version number is set for the intrusion detection rule set corresponding to each node in the node map. When the controller detects a change in the content identifier of an intrusion detection rule set from the rule map, the version number of the intrusion detection rule set in the node map is increased by 1.

[0037] In this embodiment, the correspondence between load configuration resources and nodes in the k8s cluster is stored through a resource map, that is, the rules of which nodes a load configuration resource will affect; due to the dynamic nature of the cloud native environment, the same load configuration resource will affect different nodes at different times, so the existence of the resource map provides a basis for updating the data in the node map.

[0038] Furthermore, the sending of the intrusion detection rule set to the multiple target nodes in step S104 specifically includes: Pushing the intrusion detection rule set to the detection agent on the target node via a bidirectional communication link established between the controller and the detection agent deployed on the target node; and / or, Periodically receive update requests sent by the detection agent deployed on the target node, and send the latest version of the intrusion detection rule set to the detection agent on the target node.

[0039] In this embodiment, a detection agent is deployed on each node of the k8s cluster in advance; wherein, the detection agent is a DaemonSet type workload, which is automatically deployed on each node of the k8s cluster; when the load configuration resource is coordinated and the load configuration resource determines the associated target node from the k8s cluster, the controller actively sends the latest version of the detection rule set to the target node through the gRPC two-way channel established between the controller and the detection agent on the target node; in addition, the HIDS running on the detection agent periodically sends an update request to the controller through the gRPC interface, and the update request carries the version number of the intrusion detection rule set currently used by the target node; when the controller finds through the node map that the version number in the node map is different from the version number in the stronger request, the controller sends the new version of the intrusion detection rule set to the detection agent on the target node.

[0040] Traditional host intrusion detection systems (HIDSs) typically use static rule sets, which are uniformly pushed to all nodes from a central platform. These rule sets lack the ability to adapt to the dynamic nature of cloud-native environments. In cloud-native environments, rapid workload scaling, frequent container scheduling, and dynamic allocation of node resources are commonplace. Static rule sets cannot dynamically adjust to workload migration, resulting in a disconnect between detection rules and the actual operating environment, increasing missed and false positive rates. Furthermore, each node is loaded with a massive rule set. Even if these rules are irrelevant to the node's current workload, they are still forced to load and match. This undoubtedly increases HIDS resource consumption, reduces detection efficiency, and increases system performance overhead. To address these issues, this embodiment aims to enable dynamic generation and precise distribution of HIDS rules. This embodiment dynamically generates customized detection rule sets based on the real-time configuration and operating environment of the workload, and precisely pushes these rules to the target nodes running the relevant workload. This embodiment effectively addresses the limitations of static rule sets, significantly improving the efficiency and accuracy of intrusion detection while reducing unnecessary performance losses, providing more efficient and intelligent security protection for cloud-native environments.

[0041] Example 2 The embodiment of the present invention provides a system for improving the efficiency of intrusion detection in cloud native environments, such as Figure 2 As shown, the system includes: a controller 201 deployed in a cluster of a cloud native environment, and a detection agent 202 deployed on each node in the cluster; The controller 201 includes: A monitoring module, configured to monitor whether a load configuration resource set in the cluster changes; wherein a corresponding load configuration resource is set for each workload in the cluster, and a workload involves multiple instances; A generation module is used to generate a corresponding intrusion detection rule set according to the changed target load configuration resources; a determination module, configured to determine, from the cluster, a plurality of target nodes running the plurality of target instances according to the plurality of target instances involved in the target workload corresponding to the target load configuration resource; A distribution module is configured to send the intrusion detection rule set to the multiple target nodes, so that the host intrusion systems on the multiple target nodes perform detection operations based on the intrusion detection rule set.

[0042] The detection agent 202 is used to: The detection operation is performed by the host intrusion detection system of the current node and based on the intrusion detection rule set stored on the current node.

[0043] Specifically, the generation module is used to: Determining whether a system call event of a host intrusion system of the cluster includes a name of a target workload corresponding to the target workload configuration resource; If yes, then setting the name of the target workload as a matching condition; if no, then setting the names of the multiple target instances as matching conditions; The matching condition is used to execute detection operations according to the intrusion detection rule set only on the system call events corresponding to the names in the matching condition through the host intrusion detection system.

[0044] Furthermore, the generating module is further configured to: Parsing preset detection parameters from the target load configuration resource; generating a process detection rule related to the process behavior based on the detection parameter, and adding the process detection rule to the intrusion detection rule set; The detection parameters include a process whitelist and / or a file monitoring policy.

[0045] Furthermore, the generation module is further configured to: Parsing the configuration information of the multiple target instances from the target load configuration resource; By analyzing the configuration information of the target instance, it is determined whether the container in the instance is mounted with the preset dangerous directory of the host machine. If so, a sensitive file access monitoring rule is generated and the sensitive file access monitoring rule is added to the intrusion detection rule set; By analyzing the configuration information of the target instance, it is determined whether the container in the instance contains preset dangerous permissions. If so, a system call monitoring rule related to the permission is generated and the system call monitoring rule is added to the intrusion detection rule set.

[0046] Specifically, the distribution module is used to: Pushing the intrusion detection rule set to the detection agent on the target node via a bidirectional communication link established between the controller and the detection agent deployed on the target node; and / or, Periodically receive update requests sent by the detection agent deployed on the target node, and send the latest version of the intrusion detection rule set to the detection agent on the target node.

[0047] Furthermore, the controller 201 further includes: A storage module is used to record the intrusion detection rule set generated for each load configuration resource into a preset rule map, so as to represent the correspondence between the load configuration resource and the intrusion detection rule set through the rule map; record the nodes associated with each load configuration resource into a preset resource map, so as to represent the correspondence between the load configuration resource and the node through the resource map; and record the intrusion detection rule set obtained by each node into a preset node map, so as to represent the correspondence between the node and the intrusion detection rule set through the node map.

[0048] Furthermore, the detection agent 202 is specifically configured to: Collect detection data of the current node through the probe; wherein the detection data includes: system call events, attached processes, files and cloud native specific information; A target intrusion detection rule set is matched from all intrusion detection rule sets stored on the current node based on the detection data, and a detection operation is performed using the target intrusion detection rule set.

[0049] In this embodiment, the detection agent 202 collects the system calls, attached processes, files, and cloud native specific information (containers, instance Pods, workloads, Namespaces) of the current node through the eBPF probe, and then uses the matching conditions of the intrusion detection rule set to perform rule matching.

[0050] like Figure 3The figure shows a detailed schematic of the system, in which the management platform distributes static rule sets to the controller. The controller monitors changes in the cluster's load configuration resources by calling the list-watch method on the kube-apiserver, generates intrusion detection rules for these changes, and distributes them to the corresponding nodes. A detection agent is deployed on each node in the cluster. The agent collects system calls using eBPF probes and performs detection operations based on the intrusion detection rule set stored on the node through the agent's detection engine.

[0051] Example 3 This embodiment also provides a computer device, such as a smart phone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server or cabinet server (including an independent server or a server cluster composed of multiple servers) that can execute programs. Figure 4 As shown, the computer device 40 of this embodiment includes at least but not limited to: a memory 401 and a processor 402 that can be interconnected via a system bus. It should be noted that Figure 4 Only computer device 40 is shown having components 401 - 402 , but it should be understood that implementing all of the illustrated components is not a requirement, and greater or fewer components may alternatively be implemented.

[0052] In this embodiment, memory 401 (i.e., a readable storage medium) includes flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, a magnetic disk, an optical disk, etc. In some embodiments, memory 401 may be an internal storage unit of computer device 40, such as the hard disk or internal memory of computer device 40. In other embodiments, memory 401 may also be an external storage device of computer device 40, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, etc. Of course, memory 401 may also include both internal storage units and external storage devices of computer device 40. In this embodiment, memory 401 is typically used to store the operating system and various application software installed on computer device 40. Furthermore, memory 401 may also be used to temporarily store various types of data that has been output or is about to be output.

[0053] In some embodiments, the processor 402 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 402 is generally used to control the overall operation of the computer device 40 .

[0054] Specifically, in this embodiment, the processor 402 is configured to execute a program for a method for improving the efficiency of intrusion detection in a cloud-native environment stored in the memory 401. When the program for improving the efficiency of intrusion detection in a cloud-native environment is executed, the following steps are implemented: Monitoring whether load configuration resources set in the cluster have changed; wherein corresponding load configuration resources are set for each workload in the cluster, and a workload involves multiple instances; Generate corresponding intrusion detection rule sets based on the changing target load configuration resources; Determining, from the cluster, a plurality of target nodes that run the plurality of target instances according to the plurality of target instances involved in the target workload corresponding to the target load configuration resource; The intrusion detection rule set is sent to the multiple target nodes, so that the host intrusion detection systems on the multiple target nodes perform detection operations based on the intrusion detection rule set.

[0055] The specific implementation process of the above method steps can be found in Example 1, and this embodiment will not be repeated here.

[0056] Example 4 This embodiment further provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, a server, an App store, etc., on which a computer program is stored. When the computer program is executed by a processor, the following method steps are implemented: Monitoring whether load configuration resources set in the cluster have changed; wherein corresponding load configuration resources are set for each workload in the cluster, and a workload involves multiple instances; Generate corresponding intrusion detection rule sets based on the changing target load configuration resources; Determining, from the cluster, a plurality of target nodes that run the plurality of target instances according to the plurality of target instances involved in the target workload corresponding to the target load configuration resource; The intrusion detection rule set is sent to the multiple target nodes, so that the host intrusion detection systems on the multiple target nodes perform detection operations based on the intrusion detection rule set.

[0057] The specific implementation process of the above method steps can be found in the first embodiment, and this embodiment will not be repeated here.

[0058] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0059] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0060] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method.

[0061] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for improving the efficiency of intrusion detection in a cloud native environment, characterized in that: Applied to a controller deployed in a cluster in a cloud-native environment, the method includes: Monitoring whether load configuration resources set in the cluster have changed; wherein corresponding load configuration resources are set for each workload in the cluster, and a workload involves multiple instances; Generate corresponding intrusion detection rule sets based on the changing target load configuration resources; Determining, from the cluster, a plurality of target nodes that run the plurality of target instances according to the plurality of target instances involved in the target workload corresponding to the target load configuration resource; The intrusion detection rule set is sent to the multiple target nodes, so that the host intrusion detection systems on the multiple target nodes perform detection operations based on the intrusion detection rule set.

2. The method for improving the efficiency of intrusion detection in a cloud native environment according to claim 1 is characterized in that: The generating of a corresponding intrusion detection rule set according to the changed target load configuration resources specifically includes: Determining whether a system call event of a host intrusion system of the cluster includes a name of a target workload corresponding to the target workload configuration resource; If yes, then setting the name of the target workload as a matching condition; if no, then setting the names of the multiple target instances as matching conditions; The matching condition is used to execute detection operations according to the intrusion detection rule set only on the system call events corresponding to the names in the matching condition through the host intrusion detection system.

3. The method for improving the efficiency of intrusion detection in cloud native environments according to claim 1 is characterized in that: The generating of a corresponding intrusion detection rule set according to the changed target load configuration resources also includes: Parsing preset detection parameters from the target load configuration resource; generating a process detection rule related to the process behavior based on the detection parameter, and adding the process detection rule to the intrusion detection rule set; The detection parameters include a process whitelist and / or a file monitoring policy.

4. The method for improving the efficiency of intrusion detection in a cloud native environment according to claim 1, characterized in that: The generating of a corresponding intrusion detection rule set according to the changed target load configuration resources also includes: Parsing the configuration information of the multiple target instances from the target load configuration resource; By analyzing the configuration information of the target instance, it is determined whether the container in the instance is mounted with the preset dangerous directory of the host machine. If so, a sensitive file access monitoring rule is generated and the sensitive file access monitoring rule is added to the intrusion detection rule set; By analyzing the configuration information of the target instance, it is determined whether the container in the instance contains preset dangerous permissions. If so, a system call monitoring rule related to the permission is generated and the system call monitoring rule is added to the intrusion detection rule set.

5. The method for improving the efficiency of intrusion detection in a cloud native environment according to claim 1, characterized in that: The sending the intrusion detection rule set to the multiple target nodes specifically includes: Pushing the intrusion detection rule set to the detection agent on the target node via a bidirectional communication link established between the controller and the detection agent deployed on the target node; and / or, Periodically receive update requests sent by the detection agent deployed on the target node, and send the latest version of the intrusion detection rule set to the detection agent on the target node.

6. The method for improving the efficiency of intrusion detection in a cloud native environment according to claim 1, characterized in that: The method further comprises: Recording the intrusion detection rule set generated for each load configuration resource into a preset rule map, so as to represent the corresponding relationship between the load configuration resource and the intrusion detection rule set through the rule map; Recording the nodes associated with each load configuration resource into a preset resource map, so as to represent the corresponding relationship between the load configuration resources and the nodes through the resource map; The intrusion detection rule set obtained by each node is recorded in a preset node map respectively, so as to represent the corresponding relationship between the node and the intrusion detection rule set through the node map.

7. A system for improving the efficiency of intrusion detection in cloud native environments, characterized in that: The system includes: a controller deployed in a cluster of a cloud native environment, and a detection agent deployed on each node in the cluster; Wherein, the controller is used to perform the method according to any one of claims 1 to 6; The detection agent is used to intrude into the host detection system of the current node and perform detection operations based on the intrusion detection rule set stored on the current node.

8. The system for improving intrusion detection efficiency in cloud native environments according to claim 7, characterized in that: The detection agent is specifically used to: Collect detection data of the current node through the probe; wherein the detection data includes: system call events, attached processes, files and cloud native specific information; A target intrusion detection rule set is matched from all intrusion detection rule sets stored on the current node based on the detection data, and a detection operation is performed using the target intrusion detection rule set.

9. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 6 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images