A malicious container detection method, system, device and host

Abstract

The present invention discloses a malicious container detection method, system, device and host, which belongs to the field of container security technology. First, the system call process events of the host machine are collected in the kernel state, and the collected system call process events are saved in the common cache of the kernel state and the user state. Then, the system call process events are extracted from the common cache in the user state, and context data is associated with these system call process events to obtain the complete data of the system call process events. Finally, the complete data of the system call process events is input into the neural network module to obtain the result of whether the container executing the system call process event is a malicious container. It can be seen that this detection method can detect the container process in the running process and ensure the security of the system during the running of the container process. At the same time, this detection method does not require modification to the container itself, is non-invasive to the container, and occupies less memory resources of the system.

Description

Technical Field

[0001] The present invention relates to the field of container security technology, and in particular to a malicious container detection method, system, device, and host. Background Art

[0002] With the development of cloud computing technology, packaging applications into container images and deploying them through containerization has become mainstream. Compared to traditional virtual machine deployment, container deployment offers advantages such as faster startup, reduced system resource usage, and independence from the underlying environment. However, because multiple containers can run on the same host machine and share the same kernel, this can lead to a series of system security issues such as container escape, high-risk system calls, and privilege escalation attacks. Because containers are isolated from the host machine, conventional host anomaly detection methods are inappropriate for detecting abnormal containers.

[0003] In the existing technology, static detection is usually used to detect malicious containers. For example, it detects whether each file in the container contains malicious programs. However, this detection method cannot guarantee the security of the system during the running of processes in the container. In the existing technology, detection monitoring programs are also deployed in the container to continuously track the process information running in the container image. However, this method requires modifications to the container itself and is invasive to the container. Moreover, when the number of container processes on the same host machine increases, the number of corresponding deployed detection monitoring programs will also increase, increasing the usage of system memory resources. Summary of the Invention

[0004] The purpose of the present invention is to provide a malicious container detection method, system, device and host, which ensure the security of the system during the operation of the container process without requiring any modification to the container itself, is non-invasive to the container, and occupies less memory resources of the system.

[0005] To solve the above technical problems, the present invention provides a malicious container detection method, comprising:

[0006] Collecting system call process events of the host machine in kernel state, and saving the collected system call process events to a common cache of kernel state and user state;

[0007] Extracting the system call process event from the common cache in the user state, and associating context data with the system call process event, obtaining complete data of the system call process event and storing it in the user state;

[0008] The complete data of the system call process event is input into a pre-trained neural network model to obtain a result of whether the container executing the system call process event is a malicious container.

[0009] Preferably, after extracting the system call process event from the common cache in the user state, the method further includes:

[0010] Determine whether the system call process event exists in a pre-stored system call event list that needs to be detected;

[0011] If not, determining that the system call process event is a useless event, and deleting the useless event from the common cache;

[0012] If so, the process proceeds to the step of associating context data with the system call process event, obtaining complete data of the system call process event and saving it in user mode.

[0013] Preferably, after obtaining the result that the container executing the system call process event is a malicious container, the method further includes:

[0014] Generate warning information and control the display module to display the warning information.

[0015] Preferably, the neural network model is an RPN network model.

[0016] Preferably, the context data includes the system call process event execution time and / or the process name and / or the process executable file path and / or whether the process is a container process and / or the container image name.

[0017] Preferably, after associating the context data with the system call process event, the method further includes:

[0018] Detect whether the context data contains context data that has been saved in the user state. If so, delete the context data that has been saved in the user state.

[0019] Preferably, it also includes:

[0020] Determine whether a system call process event query instruction sent by the user is received;

[0021] If so, obtaining context data of the system call process event corresponding to the system call process event query instruction;

[0022] Adding the context data to the system call process event corresponding to the system call process event query instruction to obtain complete data of the system call process event corresponding to the system call process event query instruction;

[0023] The complete data is displayed via a display module.

[0024] To solve the above technical problems, the present invention further provides a malicious container detection system, comprising:

[0025] A system call process event collection and storage unit is used to collect system call process events of the host machine in the kernel state and save the collected system call process events to a common cache of the kernel state and the user state;

[0026] a system call process event context data association unit, configured to extract the system call process event from the common cache in the user state, associate context data with the system call process event, obtain complete data of the system call process event, and store the complete data in the user state;

[0027] The malicious container detection unit is used to input the complete data of the system call process event into a pre-trained neural network model to obtain a result of whether the container executing the system call process event is a malicious container.

[0028] To solve the above technical problems, the present invention further provides a malicious container detection device, comprising:

[0029] memory for storing computer programs;

[0030] A processor is configured to execute the computer program to implement the steps of the malicious container detection method.

[0031] To solve the above technical problems, the present invention further provides a host, comprising the malicious container detection device as described above.

[0032] The present invention provides a malicious container detection method, system, device and host. The method first collects system call process events of the host machine in the kernel state and saves the collected system call process events to the common cache of the kernel state and the user state. Then, the system call process events are extracted from the common cache in the user state, and context data is associated with these system call process events to obtain the complete data of the system call process events and save them in the user state. Finally, the complete data of the system call process events is input into a neural network module to obtain the result of whether the container executing the system call process event is a malicious container. It can be seen that this detection method can detect the container process in the running process and ensure the security of the system during the running of the container process. At the same time, this detection method does not require the deployment of a detection program in the container, that is, no modification is required to the container itself, is non-invasive to the container, and occupies less memory resources of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the prior art and the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0034] Figure 1 A flowchart of a malicious container detection method provided by the present invention;

[0035] Figure 2 A schematic diagram of the structure of a malicious container detection system provided by the present invention;

[0036] Figure 3 This is a schematic structural diagram of a malicious container detection device provided by the present invention. DETAILED DESCRIPTION

[0037] The core of the present invention is to provide a malicious container detection method, system, device and host, which ensure the security of the system during the operation of the container process without requiring any modification to the container itself, is non-invasive to the container, and occupies less memory resources in the system.

[0038] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0039] Please refer to Figure 1 , Figure 1 A flowchart of a malicious container detection method provided by the present invention includes:

[0040] S11: collecting system call process events of the host machine in the kernel state, and saving the collected system call process events to a common cache of the kernel state and the user state;

[0041] S12: extracting the system call process event from the common cache in the user state, and associating context data with the system call process event, obtaining complete data of the system call process event and saving it in the user state;

[0042] S13: Input the complete data of the system call process event into the pre-trained neural network model to obtain a result of whether the container executing the system call process event is a malicious container.

[0043] Considering that in the existing technology, static detection or deploying detection programs to detect malicious containers have certain defects, static detection cannot continuously detect during the operation of the container program to protect the security of the system. The method of deploying detection programs requires deploying detection programs in the container, which will make modifications to the container itself and is somewhat invasive. At the same time, as the number of container processes increases, the number of deployed detection programs will also increase, increasing the usage of system memory resources.

[0044] To solve this problem, in this embodiment, the kernel probe module deployed in the Linux kernel state first completes the collection of system call process events. Specifically, the kernel tool collects the entry and exit tracking points and process scheduling of the system call process events. It should be noted that the entire process of collecting system call process events is non-blocking, that is, the process of collecting system call process events does not block the current process of the system. Therefore, after the kernel probe module collects the system call process events through the kernel tool, it will save the collected system call process events to the common cache of the kernel state and the user state, and then terminate the process, ensuring that there is no impact on the business process and the business container is unaware.

[0045] Taking into account that the Linux user state cannot directly obtain data from the Linux kernel state, this embodiment saves the collected system call process events to the common cache of the kernel state and the user state, and does not make other copies of the event data, thereby reducing the occupation of system memory resources. In this way, the collected events are transferred from the Linux kernel state space to the Linux user state space. At the same time, by adjusting the size of the common cache, the amount of system memory resources occupied can also be adjusted.

[0046] Taking into account that the system call process events collected by the kernel probe module are just some raw data, which only contain the relevant parameters and execution results of the system call process, this embodiment deploys a data marking module in the user state to associate context data with the system call event. These context data include but are not limited to system data, container data, application data or file data. After the data marking module extracts the collected system call process events from the common cache of the kernel state and the user state, it will add context data to the system call process event association to improve the data of the system call process event and obtain the complete data of the system call process event. Finally, the complete data of the system call process event is input into the pre-trained neural network model to obtain the result of whether the container executing the system call process event is a malicious container.

[0047] In summary, the present invention provides a malicious container detection method, which first collects the system call process events of the host machine in the kernel state, and saves the collected system call process events to the common cache of the kernel state and the user state. Then, in the user state, the system call process events are extracted from the common cache, and context data is associated with these system call process events to obtain the complete data of the system call process events. Finally, the complete data of the system call process events is input into the neural network model to obtain the result of whether the container executing the system call process event is a malicious container. It can be seen that this detection method can detect the container process in the running process and ensure the security of the system during the running of the container process. At the same time, this detection method does not need to deploy a detection program in the container, that is, it does not need to modify the container itself, is non-invasive to the container, and occupies less memory resources of the system.

[0048] Based on the above embodiment:

[0049] As a preferred embodiment, after extracting the system call process event from the common cache in the user state, the method further includes:

[0050] Determine whether the system call process event exists in a pre-stored system call event list that needs to be detected;

[0051] If not, determine that the system call process event is a useless event, and delete the useless event from the common cache;

[0052] If so, the process proceeds to the step of associating context data with the system call process event, obtaining complete data of the system call process event and saving it in the user state.

[0053] In this embodiment, considering that not all collected system call process events are events that need to be detected during actual use, this solution also deploys an event filtering module in the Linux user state. After extracting system call process events from the common cache, the event filtering module deletes unnecessary and useless events based on the system call event list that needs to be detected. The system call event list that needs to be detected here includes the event types that need to be obtained. For example, network request-related operations may require the collection of socket-related system call process events, while file operation-related operations may require the collection of file-related system call process events.

[0054] In addition, the list of system call events that need to be detected is obtained in the process of pre-training the neural network model. Through the list of system call events that need to be detected, the interference of useless events can be greatly reduced and the detection efficiency can be improved.

[0055] As a preferred embodiment, after obtaining the result that the container executing the system call process event is a malicious container, the method further includes:

[0056] Generate alarm information and control the display module to display the alarm information.

[0057] In this embodiment, considering that the result of obtaining that the container that executes the system call process event is a malicious container, it is necessary to issue an alarm to the user, so this solution will generate alarm information based on the complete data of the system call process event, and display it through the display module to prompt the user to perform subsequent processing operations, such as stopping the malicious container process, performing a deep scan of the malicious container, blocking the continued spread and use of the malicious container, and improving the security of the system.

[0058] As a preferred embodiment, the neural network model is an RPN network model.

[0059] In this embodiment, the RPN network model is used as the malicious container detection model. Other neural network models that can implement malicious container detection can also be used as the malicious container detection model in this solution. The present invention does not make any special limitations here.

[0060] As a preferred embodiment, the context data includes the execution time of the system call process event and / or the process name and / or the process executable file path and / or whether the process is a container process and / or the container image name.

[0061] In this embodiment, the data marking module deployed in the user state associates the context data of the system call process event with the system call process event, including the execution time of the system call process event and / or the process name and / or the process executable file path and / or whether the process is a container process and / or the container image name, etc. For example, for a high-risk system call event, the original data collected by the kernel probe module may only contain the name of the system call event and the calling process number. After the event is associated with the context data through the data marking module, data such as the execution time of the system call process event, the process name, the process executable file path, whether the process is a container process, the container image name, etc. will be added to complete the data of the entire system call process event, and the complete data of the system call process event is obtained, leaving sufficient context information for subsequent detection and alarm.

[0062] As a preferred embodiment, after associating context data with the system call process event, the method further includes:

[0063] Check whether the context data contains context data that has been saved in the user state. If so, delete the context data that has been saved in the user state.

[0064] In this embodiment, considering that during the actual operation of the system, there will be more and more containers and processes on the system, which will lead to more and more system call process events being collected. If context data is completely added to each system call process event and saved in the user state, this part of the data will be several times the collected original data, resulting in a doubling of the pressure on data storage and transmission. Therefore, this solution uses a method of implicitly adding context data. This method can reduce the pressure of excessive data volume, and can also efficiently provide context data for system call process events. Specifically, the context data of system call process events are summarized according to factors such as process type, timeline and process type, and saved together to ensure that the same data is not stored. That is, for the same context data part in multiple system call process events, only one copy is saved in the user state, which greatly reduces the pressure on data storage. At the same time, when it is necessary to output the complete data of the system call process event, the context data associated with the system call process event is queried and added to the system call process event.

[0065] As a preferred embodiment, the present invention further comprises:

[0066] Determine whether a system call process event query instruction sent by the user is received;

[0067] If so, obtaining context data of the system call process event corresponding to the system call process event query instruction;

[0068] Adding the context data to the system call process event corresponding to the system call process event query instruction to obtain complete data of the system call process event corresponding to the system call process event query instruction;

[0069] The complete data of the system call process event corresponding to the system call process event query instruction is displayed through the display module.

[0070] In this embodiment, it is taken into consideration that the user may have the need to query the system call process event. Because when this solution receives the system call process event query instruction sent by the user, it will query the context data of the system call process event that the user wants to query in the context data of the collected system call process event stored in the user state, and add the queried context data to the system call process event that the user wants to query to obtain the complete data of the system call process event that the user wants to query, and then display the complete data of the system call process event that the user wants to query to the user through the display module, which facilitates the user's operation and improves the feasibility of the solution.

[0071] The present invention also provides a malicious container detection system, please refer to Figure 2 , Figure 2A schematic diagram of the structure of a malicious container detection system provided by the present invention includes:

[0072] The system call process event collection and storage unit 21 is used to collect the system call process events of the host machine in the kernel state and save the collected system call process events to the common cache of the kernel state and the user state;

[0073] A system call process event context data association unit 22 is used to extract the system call process event from the common cache in the user state, associate the context data with the system call process event, obtain the complete data of the system call process event and save it in the user state;

[0074] The malicious container detection unit 23 is used to input the complete data of the system call process event into a pre-trained neural network model to obtain a result of whether the container executing the system call process event is a malicious container.

[0075] For an introduction to a malicious container detection system provided by the present invention, please refer to the above method embodiment, and the present invention will not be described in detail here.

[0076] The present invention also provides a malicious container detection device, please refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of a malicious container detection device provided by the present invention, which includes:

[0077] Memory 31, for storing computer programs;

[0078] The processor 32 is configured to execute a computer program to implement the steps of the above-mentioned malicious container detection method.

[0079] For an introduction to a malicious container detection device provided by the present invention, please refer to the above method embodiment, and the present invention will not be described in detail here.

[0080] The present invention also provides a host, comprising the above-mentioned malicious container detection device.

[0081] For an introduction to a host provided by the present invention, please refer to the above method embodiment, and the present invention will not be described in detail here.

[0082] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0083] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A malicious container detection method, characterized in that: include: Collecting system call process events of the host machine in kernel state, and saving the collected system call process events to a common cache of kernel state and user state; Specifically, the kernel tool is used to collect the entry and exit tracking points and process scheduling of the system call process event; wherein the process of collecting the system call process event will not block the current process of the system; Extracting the system call process event from the common cache in the user state, and associating context data with the system call process event to obtain complete data of the system call process event and save it in the user state; specifically, associating the context data with the system call process event using an implicit context data addition method; wherein the implicit context data addition method is to summarize the context data based on the process type, timeline and process type of the system call process event, and save the same context data portion in each of the system call process events to the user state; The complete data of the system call process event is input into a pre-trained neural network model to obtain a result of whether the container executing the system call process event is a malicious container.

2. The malicious container detection method according to claim 1, wherein: After extracting the system call process event from the common cache in the user state, the method further includes: Determine whether the system call process event exists in a pre-stored system call event list that needs to be detected; If not, determining that the system call process event is a useless event, and deleting the useless event from the common cache; If so, the process proceeds to the step of associating context data with the system call process event, obtaining complete data of the system call process event and saving it in user mode.

3. The malicious container detection method according to claim 1, wherein: After determining that the container that executed the malicious event is a malicious container, the following steps are also included: Generate warning information and control the display module to display the warning information.

4. The malicious container detection method according to claim 1, wherein: The neural network model is an RPN network model.

5. The malicious container detection method according to claim 1, wherein: The context data includes the execution time of the system call process event and / or the process name and / or the process executable file path and / or whether the process is a container process and / or the container image name.

6. The malicious container detection method according to any one of claims 1 to 5, characterized in that: After associating context data for the system call process event, the method further includes: Detect whether the context data contains context data that has been saved in the user state. If so, delete the context data that has been saved in the user state.

7. The malicious container detection method according to claim 6, wherein: Also includes: Determine whether a system call process event query instruction sent by the user is received; If so, obtaining context data of the system call process event corresponding to the system call process event query instruction; Adding the context data to the system call process event corresponding to the system call process event query instruction to obtain complete data of the system call process event corresponding to the system call process event query instruction; The complete data is displayed via a display module.

8. A malicious container detection system, characterized in that: include: A system call process event collection and storage unit is used to collect system call process events of the host machine in the kernel state and save the collected system call process events to a common cache of the kernel state and the user state; Specifically, the kernel tool is used to collect the entry and exit tracking points and process scheduling of the system call process event; wherein the process of collecting the system call process event will not block the current process of the system; a system call process event context data association unit, configured to extract the system call process event from the common cache in the user state, associate context data with the system call process event, obtain complete data of the system call process event, and store it in the user state; specifically, to associate context data with the system call process event using an implicit context data addition method; wherein the implicit context data addition method is to summarize the context data based on the process type, timeline, and process type of the system call process event, and store the same context data portion in each of the system call process events in the user state; The malicious container detection unit is used to input the complete data of the system call process event into a pre-trained neural network model to obtain a result of whether the container executing the system call process event is a malicious container.

9. A malicious container detection device, characterized in that: include: memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the malicious container detection method according to any one of claims 1 to 7.

10. A host, characterized in that: It includes the malicious container detection device as described in claim 9.

Images