Container detection method, device, electronic device and storage device based on k8s cluster

Abstract

The present invention provides a container detection method, device, electronic device and storage device based on k8s cluster, belonging to the technical field of computer network security management, the method comprising: constructing a k8s cluster model, the k8s cluster model is a cluster management platform based on containers; performing vulnerability scanning on ports in the containers of the k8s cluster model to obtain port vulnerability information, and performing vulnerability scanning on applications in the containers of the k8s cluster model based on the port vulnerability information; performing corresponding data scheduling processing according to the results of the vulnerability scanning to achieve security protection of the containers of the k8s cluster. The present invention constructs a k8s cluster model, and performs vulnerability scanning on ports and applications in the containers of the k8s cluster model based on the constructed k8s cluster model, so as to timely discover port vulnerabilities and application vulnerabilities in the container.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security management, and in particular to a container detection method, device, electronic device and storage device based on a k8s cluster. Background Art

[0002] A container is a standardized unit of software that packages code and all its dependencies so that an application can run reliably and quickly from one computing environment to another.

[0003] The existing application deployment method is to deploy containers. Each container is isolated from each other, each container has its own file system, and the processes between containers will not affect each other, and computing resources can be distinguished. Compared with virtual machines, containers can be deployed quickly. Since containers are decoupled from the underlying facilities and machine file systems, they can be migrated between different clouds and different versions of operating systems. As a specific implementation of container technology, Docker has received more and more attention in recent years. To some extent, Docker has become the representative of container technology. Although Docker's design achieves good operating system-level isolation, it also has many security risks, such as its default networking mode, sharing the operating system kernel and host resources with the host, using the Linux Capabilities mechanism, and insufficient isolation.

[0004] Therefore, it is necessary to carry out comprehensive security protection for Docker containers, mainly including security protection of template files, image files, container operation protection, application protection in containers, and protection of container operation environment. However, the existing container security methods can no longer meet the needs of container security protection after container and isolation, which is reflected in the following points: First, there is no node detection model based on K8S system; second, it is impossible to detect security vulnerabilities and virus Trojans in port mirroring; third, it is difficult to detect attacks on container networks. Summary of the invention

[0005] The present invention provides a container detection method, device, electronic device and storage device based on a k8s cluster, which are used to solve the problem in the prior art that the container security protection requirements cannot be met after the container is isolated, realize security protection in the container security protection process, and improve the detection efficiency.

[0006] The present invention provides a container detection method based on a k8s cluster, comprising:

[0007] Build a k8s cluster model, which is a container-based cluster management platform;

[0008] Perform vulnerability scanning on ports in the container of the k8s cluster model to obtain port vulnerability information, and perform vulnerability scanning on applications in the container of the k8s cluster model based on the port vulnerability information;

[0009] Corresponding data scheduling processing is performed according to the results of the vulnerability scanning to achieve security protection of the containers of the k8s cluster.

[0010] According to a container detection method based on a k8s cluster provided by the present invention, the k8s cluster model is constructed, including:

[0011] Set up a communication network model where multiple Master nodes control Node nodes;

[0012] Set up multiple Node nodes for each Master node, and deploy multiple Pods on each Node node. The Master node is the control node of the k8s cluster model, and the Node node is used to run the Pod;

[0013] Deploy the application in a group of interrelated containers. A Pod includes one or more containers. The containers in the Pod communicate with the Pod containers of other Node nodes.

[0014] According to a container detection method based on a k8s cluster provided by the present invention, the vulnerability scanning is performed on the port in the container of the k8s cluster model to obtain port vulnerability information, and the vulnerability scanning is performed on the application in the container of the k8s cluster model based on the port vulnerability information, including:

[0015] Use the preset plug-in to access the services in the k8s cluster model through the domain name;

[0016] Add the domain name and port information corresponding to the service to the task queue of the application scan;

[0017] Obtaining scanning tasks from the task queue at regular intervals, and performing page crawling on the application program according to the scanning tasks to obtain page file and directory information;

[0018] According to the page file and directory information, the name and version information of the application are obtained, and a vulnerability scan is performed on the port to obtain the port vulnerability information;

[0019] According to the name and version information of the application and the port vulnerability information, a vulnerability scan is performed on the application to obtain the application vulnerability information.

[0020] According to a container detection method based on a k8s cluster provided by the present invention, the corresponding data scheduling processing is performed according to the result of the vulnerability scanning to realize the security protection of the container of the k8s cluster, including:

[0021] One of the multiple Pods of a Node node in the k8s cluster model is set as vulnerability scanning node Pod1, where the vulnerability scanning node Pod1 does not deploy an application but has storage space;

[0022] Through the vulnerability scanning node Pod1, all Pods under the same Node node are scanned for vulnerabilities;

[0023] According to the number of Pods with vulnerabilities found in the vulnerability scan, corresponding data scheduling processing is performed to achieve security protection of the containers of the k8s cluster.

[0024] According to a container detection method based on a k8s cluster provided by the present invention, the corresponding data scheduling processing is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of the container of the k8s cluster, including:

[0025] When a vulnerability is found in a Pod, the storage data of the Pod with the vulnerability is obtained, and the storage data is stored in the vulnerability scanning node Pod1, and the Pod with the vulnerability is set as a new vulnerability scanning node Pod2;

[0026] Through the corresponding Node node of the Pod where the vulnerability occurs, obtain the vulnerability solution from the corresponding Master node or eliminate the vulnerability according to the scanned vulnerability content.

[0027] According to a container detection method based on a k8s cluster provided by the present invention, the corresponding data scheduling processing is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of the container of the k8s cluster, and also includes:

[0028] When multiple Pods are scanned for vulnerabilities, the storage data of the multiple Pods with vulnerabilities are transferred accordingly by scheduling multiple Pods in other Node nodes; or

[0029] When multiple Pods are found to have vulnerabilities, the backup storage space of multiple Pods in other Node nodes is scheduled to temporarily store the storage data of the multiple Pods with vulnerabilities, and the data is marked with numbers in sequence.

[0030] When the multiple Pods with vulnerabilities return to normal, the data in the corresponding Pod containers are stored back in order in the original Pods according to the labels to achieve security protection of the containers of the k8s cluster.

[0031] According to a container detection method based on a k8s cluster provided by the present invention, the corresponding data scheduling processing is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of the container of the k8s cluster, further comprising:

[0032] A neural network-based vulnerability training model is set for the vulnerability scanning node Pod1, wherein the vulnerability training model stores a database based on vulnerabilities, viruses or threats;

[0033] When the vulnerability scanning node Pod1 performs vulnerability scanning on other Pods, the vulnerability scanning node Pod1 obtains data in a Pod to be scanned, and inputs the data into the vulnerability training model as a test set;

[0034] If the output result of the vulnerability training model is normal, it means there is no vulnerability, and the vulnerability scanning node Pod1 continues to scan the next Pod;

[0035] If the output result of the vulnerability training model is abnormal, it means that a vulnerability has occurred. The Pod where the vulnerability occurs will be marked, and the data of the Pod where the vulnerability occurs will be obtained in real time and scheduled to the scanned and safe Pod. At the same time, a vulnerability resolution request will be sent to the corresponding Master node to obtain a vulnerability solution.

[0036] The present invention also provides a container detection device based on a k8s cluster, comprising:

[0037] Build a k8s cluster model module, which is used to build a k8s cluster model. The k8s cluster model is a container-based cluster management platform;

[0038] A vulnerability scanning module is used to perform vulnerability scanning on ports in the container of the k8s cluster model, obtain port vulnerability information, and perform vulnerability scanning on applications in the container of the k8s cluster model based on the port vulnerability information;

[0039] The scheduling and processing module is used to perform corresponding data scheduling and processing according to the results of the vulnerability scanning to achieve security protection of the containers of the k8s cluster.

[0040] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned methods for detecting containers based on a k8s cluster are implemented.

[0041] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned container detection methods based on the k8s cluster are implemented.

[0042] The present invention provides a container detection method, device, electronic device and storage device based on a k8s cluster. By constructing a k8s cluster model and performing vulnerability scanning on ports and applications in containers of the k8s cluster model based on the constructed k8s cluster model, port vulnerabilities in the container and application vulnerabilities can be discovered in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 It is a flow chart of a container detection method based on a k8s cluster provided by the present invention;

[0045] Figure 2 It is a schematic diagram of the process of building a k8s cluster model provided by the present invention;

[0046] Figure 3 It is a schematic diagram of building a k8s cluster model provided by the invention;

[0047] Figure 4 It is a schematic diagram of the flow of scanning port vulnerabilities and scanning application program vulnerabilities provided by the present invention;

[0048] Figure 5 It is a flow chart of data scheduling processing provided by the present invention;

[0049] Figure 6 It is a schematic diagram of a process of a single Pod having a vulnerability provided by the present invention;

[0050] Figure 7 It is a schematic diagram of a process of multiple Pod vulnerabilities provided by the present invention;

[0051] Figure 8 It is a flow chart of data scheduling processing based on the vulnerability training model provided by the present invention;

[0052] Fig. 9 It is a schematic diagram of a process of a single Pod having a vulnerability based on a vulnerability training model provided by the present invention;

[0053] Fig.10 It is a schematic diagram of a process of multiple Pods having vulnerabilities based on a vulnerability training model provided by the present invention;

[0054] Fig.11It is a structural schematic diagram of a container detection device based on a k8s cluster provided by the present invention;

[0055] Fig.12 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein.

[0058] The technical terms involved in the present invention are described below:

[0059] K8s is the abbreviation of Kubernetes, which is formed by replacing the eight characters "ubernete" with "8". It is an open source and containerized application management platform for multiple hosts. The goal of Kubernetes is to make the deployment of containerized applications simple and efficient. Kubernetes provides a mechanism for application deployment, planning, updating, and maintenance.

[0060] The present invention constructs a node detection model based on the K8s cluster, and based on the K8s cluster model, performs vulnerability scans on ports and applications in the container. It can detect security vulnerabilities and virus Trojans in port mirroring, and can also detect vulnerabilities in applications in the container to discover attacks on the container network. This solves the problems that the prior art does not have a node detection model based on the K8s system, cannot detect security vulnerabilities and virus Trojans in port mirroring, and is difficult to discover attacks on the container network.

[0061] Combine the following Figure 1-Figure 12 The present invention describes a container detection method, device, electronic device and storage device based on a k8s cluster.

[0062] Figure 1 It is a flow chart of the container detection method based on k8s cluster provided by the present invention, such as Figure 1 A container detection method based on a k8s cluster includes:

[0063] Step 101, build a k8s cluster model, where the k8s cluster model is a container-based cluster management platform.

[0064] Docker, as a representative of container technology, is a tool for creating containers. However, it is difficult to apply Docker to specific business implementations, such as orchestration, management, and scheduling. Therefore, a k8s cluster model is built to manage Docker and containers in a more advanced and flexible manner.

[0065] Step 102: Perform a vulnerability scan on the port in the container of the k8s cluster model to obtain port vulnerability information, and perform a vulnerability scan on the application in the container of the k8s cluster model based on the port vulnerability information.

[0066] By performing vulnerability scans on ports and applications in containers of the k8s cluster model based on the built k8s cluster model, port vulnerabilities and application vulnerabilities in containers can be discovered in a timely manner to achieve security protection for container operation.

[0067] Step 103, performing corresponding data scheduling processing according to the result of the vulnerability scan to achieve security protection of the container of the k8s cluster.

[0068] Optionally, the container detection method based on the k8s cluster further includes:

[0069] All vulnerability information of the vulnerability scan is saved in a database, and a vulnerability summary table is generated for use by a Pod provided with a neural network-based vulnerability training model.

[0070] According to the results of vulnerability scanning of port vulnerabilities and application program vulnerabilities in the container, the present invention can implement efficient vulnerability prevention through corresponding data scheduling processing for the problem of insecure data storage caused by vulnerabilities.

[0071] The above steps 101 to 103 will be described in detail below.

[0072] Figure 2 It is a schematic diagram of the process of building a k8s cluster model provided by the present invention. Figure 3 This is a schematic diagram of building a k8s cluster model provided by the invention, such as Figure 2 , Figure 3 In the above step 101, the construction of the k8s cluster model includes:

[0073] Step 201, set a communication network model for multiple Master nodes to control Node nodes. The k8s cluster is composed of Master nodes and Node (Worker) nodes. Most operations in the k8s cluster can be implemented through the kubectl command line tool.

[0074] Step 202, set multiple Node nodes for each Master node, and deploy multiple Pods for each Node node. The Master node is the control node of the k8s cluster model, and the Node node is used to run the Pod.

[0075] Specifically, the Master node includes API Sever, Scheduler, and Controller Management. API Sever is used to respond to user requests and coordinate the work of various components within the same Master node control domain. Scheduler is used for cluster resource scheduling and binds a host to each Pod in the Pod queue to be scheduled. Controller Management is responsible for controlling different controllers in k8s.

[0076] Specifically, the Node node is a working node used to run the Pod. Each Node node also includes components such as kublet, Proxy, and Docker. Among them, kublet is responsible for managing and controlling the Pod, including receiving and creating the Pod, starting the Pod, and monitoring the running status of the Pod; Proxy mainly creates proxy services for the Pod, obtains the resource description file of the Service, and performs routing forwarding; Docker is used to create containers.

[0077] Specifically, Pod is the most basic operation unit of the k8s cluster. A Pod represents a process running in the cluster, and the Pod encapsulates one or more closely related containers.

[0078] Step 203, deploy the application in a group of interrelated containers. A Pod includes one or more containers. The containers in the Pod communicate with the Pod containers of other Node nodes.

[0079] Optionally, multiple containers in a Pod are usually tightly coupled, and the containers run on the same host machine. All containers use the same IP address and port, so that the containers in the Pod can communicate directly with the Pod containers on other nodes. Using Pod container groups to manage and schedule a group of functionally related containers as a whole improves the flexibility and efficiency of scheduling.

[0080] Therefore, through the above-mentioned k8s cluster model, the construction of Master nodes, Node nodes, databases, container networks and corresponding front-end modules can be completed. The constructed k8s cluster model is more convenient for application deployment and operation and maintenance.

[0081] Figure 4 FIG. 1 is a flow chart of scanning port vulnerabilities and scanning application program vulnerabilities provided by the present invention, such as Figure 4 In the above step 102, the vulnerability scanning of the port in the container of the k8s cluster model is performed to obtain the port vulnerability information, and the vulnerability scanning of the application in the container of the k8s cluster model is performed based on the port vulnerability information, including:

[0082] Step 401, use the preset plug-in to access the services in the k8s cluster model through the domain name.

[0083] Optionally, use the kube-dns plug-in to access services in the k8s cluster through domain names to achieve automatic service discovery. Multiple kube-dns can be configured through the kubectl command line tool. kube-dns provides DNS services for the k8s cluster.

[0084] Step 402: Add the domain name and port information corresponding to the service to the task queue of the application program scan.

[0085] Optionally, obtain the services in the k8s cluster through the API Server interface, and add the domain name and port information corresponding to the service to the task queue of the application scan.

[0086] Step 403: Obtain scanning tasks from the task queue at a regular interval, and perform page crawling on the application program according to the scanning tasks to obtain page files and directory information.

[0087] Optionally, the scanning task can be obtained from the task queue at regular intervals by a task acquirer of the scanning system, and handed over to a corresponding module (such as a crawler module) to crawl pages of the application program to obtain page files and directory information.

[0088] Step 404, obtaining the name and version information of the application program according to the page file and directory information, and performing vulnerability scanning on the port to obtain the port vulnerability information.

[0089] Optionally, the name and version information of the application can be obtained through a port scanning module.

[0090] Optionally, by performing vulnerability scanning on the port, first vulnerability information corresponding to the upload backdoor program, second vulnerability information consisting of the upload file vulnerability, third vulnerability information corresponding to the backend login cracking password, and fourth vulnerability information consisting of the open source Web system's own vulnerability can be obtained. The first vulnerability information, the second vulnerability information, the third vulnerability information, and the fourth vulnerability information are aggregated into the port vulnerability information.

[0091] Step 405: perform vulnerability scanning on the application program according to the name and version information of the application program and the port vulnerability information to obtain the application program vulnerability information.

[0092] Optionally, after identifying the name and version information of the application, the port vulnerability information is sent to a general vulnerability detection module and an exploit detection module to detect application vulnerabilities and obtain application vulnerability information. The vulnerability detection module and the exploit detection module are modules preset by the system to detect application vulnerabilities.

[0093] After the above-mentioned port vulnerability scanning and application vulnerability scanning in the container, when there is a vulnerability problem, it is necessary to perform data scheduling processing on the data security problem in the container.

[0094] Figure 5 It is a flow chart of data scheduling processing provided by the present invention, such as Figure 5 In the above step 103, the corresponding data scheduling process is performed according to the result of the vulnerability scan to achieve security protection of the container of the k8s cluster, including:

[0095] Step 501, set one of the multiple Pods of a Node node in the k8s cluster model as a vulnerability scanning node Pod1, and the vulnerability scanning node Pod1 does not deploy an application but has storage space.

[0096] Step 502: Perform vulnerability scanning on all Pods under the same Node node through the vulnerability scanning node Pod1.

[0097] Optionally, according to the deployment requirements of the actual application scenario, at least one Pod can be deployed in an empty state. By deploying such an empty Pod, vulnerability scans are performed on all Pods under the same Node node to achieve efficient vulnerability prevention.

[0098] Step 503, performing corresponding data scheduling processing according to the number of Pods with vulnerabilities found in the vulnerability scan to achieve security protection for the containers of the k8s cluster.

[0099] The above vulnerability scanning method can be achieved by setting one Pod (for example, named Pod1) among multiple Pods contained in each Node node in the k8s cluster as a vulnerability scanning node, and Pod1 set as a vulnerability scanning node may not deploy applications, but has the same deployment storage space as other Pods. In this way, when Pod1 as a vulnerability scanning node scans other Pods and finds vulnerabilities, it can transfer the data stored in the Pod with the vulnerability to its own storage space to solve the problem of data insecurity in the vulnerability, and also realize efficient vulnerability protection.

[0100] The following describes the corresponding data scheduling process for the number of Pods with vulnerabilities in the above step 503.

[0101] Figure 6 It is a schematic diagram of the process of a single Pod having a vulnerability provided by the present invention, such as Figure 6 In the above step 503, the corresponding data scheduling process is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of the container of the k8s cluster, including:

[0102] Step 601, when a vulnerability is found in a certain Pod, the storage data of the Pod with the vulnerability is obtained, and the storage data is stored in the vulnerability scanning node Pod1, and the Pod with the vulnerability is set as a new vulnerability scanning node Pod2.

[0103] Since the new vulnerability scanning node Pod2 does not store data (because the data previously stored in the new vulnerability scanning node Pod2 has been transferred to the vulnerability scanning node Pod1, and the vulnerability scanning node Pod1 is deployed with storage space), there is no security threat even if a vulnerability exists.

[0104] Step 602, through the corresponding Node node of the Pod where the vulnerability occurs, obtain the vulnerability solution from the corresponding Master node or eliminate the vulnerability according to the scanned vulnerability content.

[0105] Figure 7 It is a flow chart of the process of multiple Pod vulnerabilities provided by the present invention, such as Figure 7 In the above step 503, the corresponding data scheduling process is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of the container of the k8s cluster, including:

[0106] Step 701, when multiple Pods are scanned and vulnerabilities are found, the storage data of the multiple Pods with vulnerabilities are correspondingly transferred by scheduling multiple Pods in other Node nodes.

[0107] In order to solve the problem of vulnerabilities in multiple Pods scanned, data can be stored by scheduling Pods in other Node nodes.

[0108] Step 702, when multiple Pods are scanned and found to have vulnerabilities, the storage data of the multiple Pods with vulnerabilities are temporarily stored accordingly by scheduling the backup storage space of multiple Pods in other Node nodes, and are marked with numbers in sequence.

[0109] Step 702 is another processing method different from step 701, that is, during deployment, at least one backup space can be deployed for the containers in the Pod in each Node to schedule the applications in the same Pod with a vulnerability to the backup spaces in other Pods for temporary storage, and mark them one by one.

[0110] Step 703, when the multiple Pods with vulnerabilities return to normal, the data in the corresponding Pod containers are stored back in order to the original Pods according to the labels to achieve security protection of the containers of the k8s cluster.

[0111] The above vulnerability scanning method can achieve security protection of data in the Pod container by deploying at least one backup space for the container in the Pod of each Node in the k8s cluster to store the data stored in the Pod where the vulnerability occurs during the scanning process.

[0112] In addition to the data scheduling and processing method based on the above Pod, data scheduling and processing can also be implemented by setting a vulnerability training model based on a neural network by using Pod1 as a vulnerability scanning node. The data scheduling and processing of Pod1 with a vulnerability training model is described below.

[0113] Figure 8 : is a flow chart of data scheduling processing based on vulnerability training model provided by the present invention, such as Figure 8 In the above step 503, the corresponding data scheduling process is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of the container of the k8s cluster, further including:

[0114] Step 801: Setting a neural network-based vulnerability training model for the vulnerability scanning node Pod1, wherein the vulnerability training model stores a database based on vulnerabilities, viruses or threats.

[0115] Step 802, when the vulnerability scanning node Pod1 performs vulnerability scanning on other Pods, the vulnerability scanning node Pod1 obtains data from a Pod to be scanned (the Pod can be recorded as a task node), and inputs the data into the vulnerability training model as a test set.

[0116] Step 803: If the output result of the vulnerability training model is normal, it means there is no vulnerability, and the vulnerability scanning node Pod1 continues to scan the next Pod.

[0117] Step 804: If the output result of the vulnerability training model is abnormal, it means that a vulnerability has occurred. The Pod where the vulnerability occurs (the Pod can be recorded as a miss task node. If there are multiple Pods, they are recorded as miss task1, misstask2, ..., miss taskn respectively) is marked, and the data of the Pod where the vulnerability occurs is obtained in real time and scheduled to the scanned and safe Pod. At the same time, a vulnerability resolution request is sent to the corresponding Master node to obtain a vulnerability solution.

[0118] The following is an example of a Pod that has a vulnerability in step 804 (e.g. Fig. 9 ) and when multiple Pods have vulnerabilities (such as Fig.10 ) are described.

[0119] Fig. 9 FIG. 1 is a flow chart of a vulnerability in a single Pod based on a vulnerability training model provided by the present invention, such as Fig. 9 In the above step 804, if the output result of the vulnerability training model is abnormal, it indicates that a vulnerability has occurred, including:

[0120] Step 901, when a vulnerability is found in a Pod, the vulnerability training model in the vulnerability scanning node Pod1 is directly scheduled to the Pod where the vulnerability occurs, and the data stored in the Pod where the vulnerability occurs is transferred to the vulnerability scanning node Pod1.

[0121] Step 902, when the Pod with the vulnerability returns to normal (i.e., the vulnerability problem has been resolved), the Pod with the vulnerability plays the role of vulnerability scanning (its previously stored data has been scheduled to Pod1), and continues to scan the next unscanned Pod for vulnerabilities.

[0122] Fig.10 It is a flow chart of the occurrence of vulnerabilities in multiple Pods based on the vulnerability training model provided by the present invention, such as Fig.10 In the above step 804, if the output result of the vulnerability training model is abnormal, it indicates that a vulnerability has occurred, including:

[0123] Step 1001, when multiple Pods are scanned for vulnerabilities, the vulnerability training model in the vulnerability scanning node Pod1 is scheduled to the Pod where the vulnerability first occurs. At the same time, the storage data of the multiple Pods with vulnerabilities are temporarily stored accordingly by scheduling the backup storage space of multiple Pods in other Node nodes, and the data are marked with numbers in sequence.

[0124] Although the vulnerability training model in the vulnerability scanning node Pod1 has been scheduled to the Pod where the vulnerability first occurs, the vulnerability problem of the Pod where the vulnerability first occurs may not have been resolved, and it will play the role of vulnerability scanning to continue to scan the next unscanned Pod for vulnerabilities. Therefore, through the aforementioned content, backup storage space can be reserved in each Pod deployed, and during the scheduling process, the data of each Pod can be identified and matched.

[0125] Step 1002, when the multiple Pods with vulnerabilities return to normal, the data in the corresponding Pod containers are stored back in order to the original Pods according to the labels to achieve security protection of the containers of the k8s cluster.

[0126] It can be seen that through the above data scheduling and processing, the container security protection detection and vulnerability problem solving of the K8s cluster can be realized, and the vulnerability detection efficiency can be effectively improved, thereby realizing the effective protection of the container security of the K8s cluster.

[0127] The container detection device based on the k8s cluster provided by the present invention is described below. The container detection device based on the k8s cluster described below and the container detection method based on the k8s cluster described above can refer to each other.

[0128] Fig.11 It is a structural schematic diagram of a container detection device based on a k8s cluster provided by the present invention, such as Fig.11 A container detection device 1100 based on a k8s cluster includes a k8s cluster model building module 1110, a vulnerability scanning module 1120, and a scheduling processing module 1130.

[0129] The k8s cluster model building module 1110 is used to build a k8s cluster model, where the k8s cluster model is a container-based cluster management platform.

[0130] The vulnerability scanning module 1120 is used to perform vulnerability scanning on the ports in the container of the k8s cluster model, obtain port vulnerability information, and perform vulnerability scanning on the application in the container of the k8s cluster model based on the port vulnerability information.

[0131] The scheduling processing module 1130 is used to perform corresponding data scheduling processing according to the results of the vulnerability scanning to achieve security protection of the containers of the k8s cluster.

[0132] Optionally, the container detection device 1100 based on the k8s cluster also includes a vulnerability information storage module (not shown in the figure), which saves all vulnerability information of the vulnerability scan into a database and generates a vulnerability summary table for use by a Pod equipped with a neural network-based vulnerability training model.

[0133] Optionally, the k8s cluster model building module 1110 is further used to perform the following steps:

[0134] Set up a communication network model where multiple Master nodes control Node nodes;

[0135] Set up multiple Node nodes for each Master node, and deploy multiple Pods on each Node node. The Master node is the control node of the k8s cluster model, and the Node node is used to run the Pod;

[0136] Deploy the application in a group of interrelated containers. A Pod includes one or more containers. The containers in the Pod communicate with the Pod containers of other Node nodes.

[0137] Optionally, the vulnerability scanning module 1120 is further configured to perform the following steps:

[0138] Use the preset plug-in to access the services in the k8s cluster model through the domain name;

[0139] Add the domain name and port information corresponding to the service to the task queue of the application scan;

[0140] Obtaining scanning tasks from the task queue at regular intervals, and performing page crawling on the application program according to the scanning tasks to obtain page file and directory information;

[0141] According to the page file and directory information, the name and version information of the application are obtained, and a vulnerability scan is performed on the port to obtain the port vulnerability information;

[0142] According to the name and version information of the application and the port vulnerability information, a vulnerability scan is performed on the application to obtain the application vulnerability information.

[0143] Optionally, the scheduling processing module 1130 is further configured to perform the following steps:

[0144] One of the multiple Pods of a Node node in the k8s cluster model is set as vulnerability scanning node Pod1, where the vulnerability scanning node Pod1 does not deploy an application but has storage space;

[0145] Through the vulnerability scanning node Pod1, all Pods under the same Node node are scanned for vulnerabilities;

[0146] According to the number of Pods with vulnerabilities found in the vulnerability scan, corresponding data scheduling processing is performed to achieve security protection of the containers of the k8s cluster.

[0147] Optionally, the scheduling processing module 1130 is further configured to perform the following steps:

[0148] When a vulnerability is found in a Pod, the storage data of the Pod with the vulnerability is obtained, and the storage data is stored in the vulnerability scanning node Pod1, and the Pod with the vulnerability is set as a new vulnerability scanning node Pod2;

[0149] Through the corresponding Node node of the Pod where the vulnerability occurs, obtain the vulnerability solution from the corresponding Master node or eliminate the vulnerability according to the scanned vulnerability content.

[0150] Optionally, the scheduling processing module 1130 is further configured to perform the following steps:

[0151] When multiple Pods are scanned for vulnerabilities, the storage data of the multiple Pods with vulnerabilities are transferred accordingly by scheduling multiple Pods in other Node nodes; or

[0152] When multiple Pods are found to have vulnerabilities, the backup storage space of multiple Pods in other Node nodes is scheduled to temporarily store the storage data of the multiple Pods with vulnerabilities, and the data is marked with numbers in sequence.

[0153] When the multiple Pods with vulnerabilities return to normal, the data in the corresponding Pod containers are stored back in order in the original Pods according to the labels to achieve security protection of the containers of the k8s cluster.

[0154] Optionally, the scheduling processing module 1130 is further configured to perform the following steps:

[0155] A neural network-based vulnerability training model is set for the vulnerability scanning node Pod1, wherein the vulnerability training model stores a database based on vulnerabilities, viruses or threats;

[0156] When the vulnerability scanning node Pod1 performs vulnerability scanning on other Pods, the vulnerability scanning node Pod1 obtains data in a Pod to be scanned, and inputs the data into the vulnerability training model as a test set;

[0157] If the output result of the vulnerability training model is normal, it means there is no vulnerability, and the vulnerability scanning node Pod1 continues to scan the next Pod;

[0158] If the output result of the vulnerability training model is abnormal, it means that a vulnerability has occurred. The Pod where the vulnerability occurs will be marked, and the data of the Pod where the vulnerability occurs will be obtained in real time and scheduled to the scanned and safe Pod. At the same time, a vulnerability resolution request will be sent to the corresponding Master node to obtain a vulnerability solution.

[0159] Fig.12 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.12 As shown, the electronic device may include: a processor 1210, a communication interface 1220, a memory 1230 and a communication bus 1240, wherein the processor 1210, the communication interface 1220, and the memory 1230 communicate with each other through the communication bus 1240. The processor 1210 may call the logic instructions in the memory 1230 to execute the container detection method based on the k8s cluster, and the method includes:

[0160] Build a k8s cluster model, which is a container-based cluster management platform;

[0161] Perform vulnerability scanning on ports in the container of the k8s cluster model to obtain port vulnerability information, and perform vulnerability scanning on applications in the container of the k8s cluster model based on the port vulnerability information;

[0162] Corresponding data scheduling processing is performed according to the results of the vulnerability scanning to achieve security protection of the containers of the k8s cluster.

[0163] In addition, the logic instructions in the above-mentioned memory 1230 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0164] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, the computer can execute the container detection method based on the k8s cluster provided by the above methods, the method comprising:

[0165] Build a k8s cluster model, which is a container-based cluster management platform;

[0166] Perform vulnerability scanning on ports in the container of the k8s cluster model to obtain port vulnerability information, and perform vulnerability scanning on applications in the container of the k8s cluster model based on the port vulnerability information;

[0167] Corresponding data scheduling processing is performed according to the results of the vulnerability scanning to achieve security protection of the containers of the k8s cluster.

[0168] On the other hand, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the above-mentioned container detection method based on the k8s cluster, the method comprising:

[0169] Build a k8s cluster model, which is a container-based cluster management platform;

[0170] Perform vulnerability scanning on ports in the container of the k8s cluster model to obtain port vulnerability information, and perform vulnerability scanning on applications in the container of the k8s cluster model based on the port vulnerability information;

[0171] Corresponding data scheduling processing is performed according to the results of the vulnerability scanning to achieve security protection of the containers of the k8s cluster.

[0172] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0173] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A container detection method based on k8s cluster, characterized in that: include: Build a k8s cluster model, which is a container-based cluster management platform; Perform vulnerability scanning on ports in the container of the k8s cluster model to obtain port vulnerability information, and perform vulnerability scanning on applications in the container of the k8s cluster model based on the port vulnerability information; Perform corresponding data scheduling processing according to the results of the vulnerability scanning to achieve security protection of the container of the k8s cluster; The construction of the k8s cluster model includes: Set up a communication network model for multiple Master nodes to control Node nodes; Set up multiple Node nodes for each Master node, and deploy multiple Pods on each Node node. The Master node is the control node of the k8s cluster model, and the Node node is used to run the Pod; Deploy the application in a group of interrelated containers. A Pod includes one or more containers. The containers in the Pod communicate with the Pod containers of other Node nodes. The corresponding data scheduling processing is performed according to the result of the vulnerability scanning to realize the security protection of the container of the k8s cluster, including: One of the multiple Pods of a Node node in the k8s cluster model is set as vulnerability scanning node Pod1, where the vulnerability scanning node Pod1 does not deploy an application but has storage space; Through the vulnerability scanning node Pod1, all Pods under the same Node node are scanned for vulnerabilities; Perform corresponding data scheduling processing according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of containers in the k8s cluster; The corresponding data scheduling process is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of the container of the k8s cluster, including: When a vulnerability is found in a Pod, the storage data of the Pod with the vulnerability is obtained, and the storage data is stored in the vulnerability scanning node Pod1, and the Pod with the vulnerability is set as a new vulnerability scanning node Pod2; Through the corresponding Node node of the Pod where the vulnerability occurs, obtain the vulnerability solution from the corresponding Master node or eliminate the vulnerability according to the scanned vulnerability content; The corresponding data scheduling process is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of containers in the k8s cluster, and also includes: When multiple Pods are scanned for vulnerabilities, the storage data of the multiple Pods with vulnerabilities are transferred accordingly by scheduling multiple Pods in other Node nodes; or When multiple Pods are found to have vulnerabilities, the backup storage space of multiple Pods in other Node nodes is scheduled to temporarily store the storage data of the multiple Pods with vulnerabilities, and the data is marked with numbers in sequence. When the multiple Pods with vulnerabilities return to normal, the data in the corresponding Pod containers are stored back in order in the original Pods according to the labels to achieve security protection of the containers of the k8s cluster.

2. According to the container detection method based on k8s cluster according to claim 1, it is characterized in that: The method of performing vulnerability scanning on the port in the container of the k8s cluster model to obtain port vulnerability information, and performing vulnerability scanning on the application in the container of the k8s cluster model based on the port vulnerability information, includes: Use the preset plug-in to access the services in the k8s cluster model through the domain name; Add the domain name and port information corresponding to the service to the task queue of the application scan; Obtaining scanning tasks from the task queue at regular intervals, and performing page crawling on the application program according to the scanning tasks to obtain page file and directory information; According to the page file and directory information, the name and version information of the application are obtained, and a vulnerability scan is performed on the port to obtain the port vulnerability information; According to the name and version information of the application and the port vulnerability information, a vulnerability scan is performed on the application to obtain the application vulnerability information.

3. According to the container detection method based on k8s cluster according to claim 1, it is characterized in that: The method further includes: performing corresponding data scheduling processing according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of containers in the k8s cluster: A neural network-based vulnerability training model is set for the vulnerability scanning node Pod1, wherein the vulnerability training model stores a database based on vulnerabilities, viruses or threats; When the vulnerability scanning node Pod1 performs vulnerability scanning on other Pods, the vulnerability scanning node Pod1 obtains data in a Pod to be scanned, and inputs the data into the vulnerability training model as a test set; If the output result of the vulnerability training model is normal, it means there is no vulnerability, and the vulnerability scanning node Pod1 continues to scan the next Pod; If the output result of the vulnerability training model is abnormal, it means that a vulnerability has occurred. The Pod where the vulnerability occurs will be marked, and the data of the Pod where the vulnerability occurs will be obtained in real time and scheduled to the scanned and safe Pod. At the same time, a vulnerability resolution request will be sent to the corresponding Master node to obtain a vulnerability solution.

4. A container detection device based on k8s cluster, characterized in that: include: Build a k8s cluster model module, which is used to build a k8s cluster model. The k8s cluster model is a container-based cluster management platform; A vulnerability scanning module is used to perform vulnerability scanning on ports in the container of the k8s cluster model, obtain port vulnerability information, and perform vulnerability scanning on applications in the container of the k8s cluster model based on the port vulnerability information; A scheduling processing module is used to perform corresponding data scheduling processing according to the results of the vulnerability scanning to achieve security protection of the containers of the k8s cluster; The construction of the k8s cluster model includes: Set up a communication network model for multiple Master nodes to control Node nodes; Set up multiple Node nodes for each Master node, and deploy multiple Pods on each Node node. The Master node is the control node of the k8s cluster model, and the Node node is used to run the Pod; Deploy the application in a group of interrelated containers. A Pod includes one or more containers. The containers in the Pod communicate with the Pod containers of other Node nodes. The corresponding data scheduling processing is performed according to the result of the vulnerability scanning to realize the security protection of the container of the k8s cluster, including: One of the multiple Pods of a Node node in the k8s cluster model is set as vulnerability scanning node Pod1, where the vulnerability scanning node Pod1 does not deploy an application but has storage space; Through the vulnerability scanning node Pod1, all Pods under the same Node node are scanned for vulnerabilities; Perform corresponding data scheduling processing according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of containers in the k8s cluster; The corresponding data scheduling process is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of the container of the k8s cluster, including: When a vulnerability is found in a Pod, the storage data of the Pod with the vulnerability is obtained, and the storage data is stored in the vulnerability scanning node Pod1, and the Pod with the vulnerability is set as a new vulnerability scanning node Pod2; Through the corresponding Node node of the Pod where the vulnerability occurs, obtain the vulnerability solution from the corresponding Master node or eliminate the vulnerability according to the scanned vulnerability content; The corresponding data scheduling process is performed according to the number of Pods with vulnerabilities in the vulnerability scan to achieve security protection of containers in the k8s cluster, and also includes: When multiple Pods are scanned for vulnerabilities, the storage data of the multiple Pods with vulnerabilities are transferred accordingly by scheduling multiple Pods in other Node nodes; or When multiple Pods are found to have vulnerabilities, the backup storage space of multiple Pods in other Node nodes is scheduled to temporarily store the storage data of the multiple Pods with vulnerabilities, and the data is marked with numbers in sequence. When the multiple Pods with vulnerabilities return to normal, the data in the corresponding Pod containers are stored back in order in the original Pods according to the labels to achieve security protection of the containers of the k8s cluster.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the container method based on the k8s cluster are implemented as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the container method based on the k8s cluster are implemented as described in any one of claims 1 to 3.

Images