Container monitoring and processing methods, devices, host machines, systems, storage media, and program products

Abstract

This application relates to container monitoring and processing methods, devices, host machines, systems, storage media, and program products, belonging to the field of information security technology. In this application, when a newly created process is detected in a container, its process identifier is used to obtain other dimensions of the newly created process, and the process identifier and other dimensions are associated to form process data for the newly created process. Then, the container image corresponding to the container to which the newly created process belongs is determined, and the process data of the newly created process is added to the container image. Finally, the process detection rule set configured on the container agent in the host machine is used to perform abnormal process detection processing on the process data in the container image. This achieves monitoring of container operation security from outside the container, rather than directly detecting running processes within the container, thereby reducing the burden on the container's own operation.

Description

Technical Field

[0001] This application belongs to the field of information security technology, specifically relating to container monitoring and processing methods, devices, host machines, systems, storage media, and program products. Background Technology

[0002] Containers provide isolated runtime environments for network service providers' applications. Specifically, each container contains its own dedicated and complete runtime environment, and changes within one container do not affect the runtime environments of other containers. While the processing power of applications running within containers is limited, security monitoring is required during container runtime. For example, if a security monitoring application is run within a container, the monitoring of other applications within the container can consume a significant portion of the container's processing power, potentially placing a heavy burden on the container's operation. Summary of the Invention

[0003] To address this issue, this application provides a container monitoring and processing method, apparatus, host machine, system, storage medium, and program product, which helps to solve the problem that monitoring other applications in a container by running security monitoring applications in the container will consume a considerable portion of the container's processing power, which may put a heavy burden on the container's operation.

[0004] To achieve the above objectives, this application adopts the following technical solution:

[0005] In a first aspect, this application provides a container monitoring and processing method, the method being applied to a host machine configuring a container, the method comprising:

[0006] When a new process is detected in the container, the process identifier of the new process is used to obtain other dimension information of the new process, and the process identifier of the new process and the other dimension information are associated to form the process data of the new process;

[0007] Determine the container image corresponding to the container to which the newly created process belongs, and add the process data of the newly created process to the container image corresponding to the container to which the newly created process belongs;

[0008] Using the process detection rule set configured on the container agent in the host machine, abnormal process detection processing is performed on the process data in the container image.

[0009] Secondly, this application provides a container monitoring and processing device, which is applied to a host machine configuring containers, and the container monitoring and processing device includes:

[0010] The process data acquisition module is used to obtain other dimension information of the new process by using the process identifier of the new process when a new process is detected in the container, and to establish an association between the process identifier of the new process and the other dimension information to form the process data of the new process.

[0011] The process data is added to the container image module to determine the container image corresponding to the container to which the newly created process belongs, and to add the process data of the newly created process to the container image corresponding to the container to which the newly created process belongs;

[0012] The host-side process detection and processing module is used to perform abnormal process detection processing on the process data in the container image by utilizing the agent-side process detection rule set configured in the container agent side of the container host.

[0013] Thirdly, this application provides a container host machine, including:

[0014] At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0017] Fourthly, this application provides a container monitoring system, comprising:

[0018] The container host as described in the third aspect above.

[0019] Fifthly, this application provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method described in the first aspect above.

[0020] In a sixth aspect, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0021] The application employs the above technical solution and has at least the following beneficial effects:

[0022] This application addresses the issue of newly created processes within containers configured on a container host. When a new process is detected in a container, its process identifier is used to obtain other dimensions of information about that new process. These process identifiers and other information are then correlated to form process data for the new process. Next, the container image corresponding to the container to which the new process belongs is determined, and the process data is added to that container image. Finally, the process detection rule set configured on the container agent in the host machine is used to perform abnormal process detection processing on the process data in the container image. This allows for monitoring the operational security of containers from outside the container, rather than directly detecting running processes within the container, thereby reducing the operational burden on the container itself.

[0023] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart illustrating a container monitoring processing method according to an exemplary embodiment;

[0026] Figure 2 This is a block diagram illustrating the structure of a container host application container monitoring and processing device according to an exemplary embodiment;

[0027] Figure 3 This is a block diagram illustrating the structure of a container host according to an exemplary embodiment;

[0028] Figure 4 This is a block diagram illustrating the structure of a container monitoring system according to an exemplary embodiment. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be described in detail below. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0030] Please see Figure 1 , Figure 1 This is a flowchart illustrating a container monitoring processing method according to an exemplary embodiment. The container monitoring processing method is applied to a container host machine and includes the following steps:

[0031] Step S11: When a new process is detected in the container, the process identifier of the new process is used to obtain other dimension information of the new process, and the process identifier of the new process and the other dimension information are associated to form the process data of the new process.

[0032] Containers provide isolated runtime environments for applications. Specifically, each container contains its own dedicated and complete user environment, and changes within one container do not affect the runtime environments of other containers. In practice, a container host can be configured with one, two, or more containers. When an application runs within a container, a corresponding process is created. A process is an execution instance of a program, that is, the program currently running. When a process is created, a corresponding process identifier (Pid) is created. Through the process identifier, other dimensions of information about the corresponding process can be collected. This other dimensions may include, but are not limited to, the following: process path (cwd), terminal device (TTY) information at process startup, parent process's process ID (PPID) (if the process was started by another process, it has a parent process), process name (Name), executable file location (exe), process executing user (username), process startup time (bootTime), process session, and related information in the process chain. Using the above process-related information, secure monitoring of processes can be achieved.

[0033] To obtain other dimensions of information about a newly created process using its process identifier, in practical applications, the process identifier (Pid) of the newly created process in the container can be obtained through the Agent service in the host machine. Specifically, the process identifier of the newly created process can be obtained from the operating system kernel through the Netlink communication protocol between the application and the operating system kernel. Then, the process identifier is used to create acquisition paths for each dimension of process information, and the corresponding dimension information of the newly created process is collected through each acquisition path. For example: Based on the process identifier (Pid), create the following acquisition path to obtain dimension information: / proc / {pid} / exe, and collect the process's executable exe file through this acquisition path; Another example: Based on the process identifier (Pid), create the following acquisition path to obtain dimension information: / proc / {pid} / cmdline, and collect the process's command-line parameters through this acquisition path; Yet another example: Based on the process identifier (Pid), create the following acquisition path to obtain dimension information: / proc / {pid} / cgroup, and collect the cgroups information to which the corresponding process belongs. The cgroups information records the container identifier (container_id) of the container to which the process belongs, and then, through the container identifier (container_id) information, relevant information about the corresponding container can be queried.

[0034] After obtaining other dimensions of information about the newly created process, the process identifier of the newly created process is associated with the other dimensions of information to form the process data of the newly created process. This process data is then used to monitor the operational security of the container outside the container.

[0035] Step S12: Determine the container image corresponding to the container to which the newly created process belongs, and add the process data of the newly created process to the container image corresponding to the container to which the newly created process belongs.

[0036] Specifically, a container image can be created for the container in advance, and the process data obtained in step S1 above can be stored in the container image. When a new process appears in the container, it indicates that a change has occurred in the container. Since the container image is static, the process data of the new process is added to the container image corresponding to the container to which the new process belongs, so as to synchronize with the corresponding container and ensure data synchronization for monitoring the security of container operation outside the container.

[0037] In one embodiment, determining the container image corresponding to the container to which the newly created process belongs includes:

[0038] Obtain the container identifier of the container to which the newly created process belongs;

[0039] By using the mapping relationship between the container identifier and the corresponding container image, the container image corresponding to the container to which the newly created process belongs is determined.

[0040] Specifically, a corresponding container image can be created in advance for the container, and a mapping relationship can be established between the container image and the container identifier. Through this mapping relationship, the corresponding container image can be automatically found by simply using the container identifier.

[0041] To obtain the container identifier of the container to which a newly created process belongs, the following acquisition path can be created based on the process identifier (Pid): / proc / {pid} / cgroup. Through this acquisition path, the cgroups information of the corresponding process can be collected. The cgroups information records the container identifier (container_id) of the container to which the process belongs. The container identifier (container_id) information is obtained from the cgroups information. Then, based on the obtained container identifier (container_id) information, the mapping relationship between the container identifier and the corresponding container image is used to find the container image corresponding to the container to which the newly created process belongs, and the process data of the newly created process is added to the container image corresponding to the container to which the newly created process belongs.

[0042] In one embodiment, before determining the container image corresponding to the container to which the newly created process belongs by utilizing the mapping relationship between the container identifier and the corresponding container image, the method further includes:

[0043] Use the container's socket interface to periodically retrieve information about running containers on the container host machine;

[0044] For the running container, a corresponding container image is created, and a mapping relationship is established between the container identifier of the running container and the corresponding container image.

[0045] Specifically, through the container's socket interface, container runtime information on the container host can be obtained. This runtime information includes, but is not limited to, the number of running containers, the container identifiers of the running containers, and detailed configuration information of the running containers. Based on this runtime information, corresponding container images can be created for each running container. Then, a mapping relationship can be established between the container identifiers of each running container and their corresponding container images. Through this mapping relationship, the corresponding container image can be automatically found simply by using the container identifier.

[0046] This solution updates the container's running status periodically, creates container images for running containers, and then monitors the container's running security from outside the container, ensuring the validity of the process data used for monitoring.

[0047] Step S13: Using the agent process detection rule set configured in the container agent on the container host, perform abnormal process detection processing on the process data in the container image.

[0048] The container proxy in the host machine provides container proxy services. The container proxy can be configured with a process detection rule set, which is used to determine whether a process is abnormal. By using the process detection rule set configured in the container proxy in the host machine, abnormal process detection is performed on the process data in the container image. This enables monitoring of the container's running security from outside the container, rather than directly detecting the running processes in the container, thereby reducing the burden on the container itself.

[0049] In one embodiment, step S13, which involves using the agent process detection rule set configured in the container agent on the container host to perform abnormal process detection processing on the process data in the container image, includes:

[0050] The process data in the container image is obtained through the container agent.

[0051] Using the agent process detection rule set, the other dimensions of information in the process data are detected.

[0052] When it is detected that dimensional information matches the process detection rule in the agent process detection rule set, an alarm is issued based on the process identifier in the process data.

[0053] Specifically, as shown in step S11, each process data carries a process identifier. The container agent can retrieve process data from the container image based on this process identifier. For each process data's other dimensions, the agent's process detection rule set is used for detection. For example, one detection rule is to determine whether the command line (cmdline) contains preset sensitive keywords. These sensitive keywords may include, but are not limited to, the following: "whoami," used to query the current user; and "pwd," used to query the path of the current working directory. When a dimension matches a process detection rule in the agent's process detection rule set, it indicates that the process corresponding to that process data is abnormal. Since the process identifier can indicate the corresponding process, an alert can be issued using the process identifier in the process data.

[0054] In summary, for each container configured on the container host, when a new process is detected within a container, its process identifier is used to obtain other dimensions of information about the new process. This process identifier is then associated with the other dimensions to form process data for the new process. Next, the container image corresponding to the container to which the new process belongs is determined, and the process data is added to that container image. Finally, the process detection rule set configured on the container agent in the host machine is used to perform abnormal process detection processing on the process data in the container image. This achieves monitoring of container runtime security from outside the container, rather than directly detecting running processes within the container, thereby reducing the workload and pressure on the container itself.

[0055] In one embodiment, the method further includes:

[0056] The process data is sent to the distributed message queue Kafka on the cloud server using the container proxy, so that the stream processing framework Flink on the cloud server can retrieve the process data from the distributed message queue Kafka, store the process data in the search engine ElasticSearch on the cloud server, and index the process data in the search engine ElasticSearch based on the process identifier in the process data. Then, abnormal process detection processing is performed on the indexed process data using the cloud process detection rule set on the cloud server.

[0057] The container broker can periodically collect and aggregate process data for delivery. Process data first enters a buffer on the container host machine. The container broker then uses this buffer to send process data to the cloud server. For example, the container broker can periodically (including but not limited to every second) collect process data, aggregate it, and if the aggregated data exceeds the buffer's capacity, separate a portion of the data so that the remaining data can be sent to the cloud server's distributed message queue, Kafka, at once. This process data sending overload can be avoided. The separated process data can be placed in the next delivery. The cloud server receives the process data sent from the host machine through its distributed message queue, Kafka. Then, the cloud server's stream processing framework, Flink, writes the process data from Kafka to the search engine, Elasticsearch. The distributed message queue, Kafka, can build real-time streaming data channels based on data traffic, providing high throughput for both the container broker sending process data and the Flink stream processing framework reading process data.

[0058] For process data stored in the Elasticsearch search engine, the cloud server uses the process identifiers of each process to index the process data. Based on the indexed process data, the cloud server uses a pre-configured cloud process detection rule set to perform abnormal process detection processing. Because the cloud server is independent of the container host, the cloud process detection rule set can be configured more comprehensively; for example, the cloud process detection rule set can detect all dimensions of information in the process data. When the cloud server detects an abnormal process, it can send an alert to the container host based on the abnormal process's process identifier. This solution, by detecting process data on the cloud server, also achieves monitoring of container runtime security from outside the container.

[0059] In one embodiment, the method further includes:

[0060] For the files in the container image, perform abnormal file detection, and when an abnormal file is detected, obtain the access path of the abnormal file in the container image;

[0061] Using the access path, the corresponding file is located in the container corresponding to the container image through the container agent, and the found file is isolated or deleted.

[0062] The above solution detects abnormal files based on each file in the container image. This method monitors the operational security of the container from outside the container. When an abnormal file is detected in the container image, the access path of the abnormal file in the container image is used to search for the corresponding file in the container corresponding to the container image through the container agent. The found file is the abnormal file. The found file is isolated or deleted. This method monitors and processes the files in the container to reduce the burden on the container itself.

[0063] To illustrate the abnormal file detection for files in the container image, this application provides the following embodiments.

[0064] In one embodiment, the abnormal file detection for files in the container image includes:

[0065] Step S201: Obtain the root directory of the web service in the container image;

[0066] Step S202: Using preset webshell detection rules, detect the web files in the root directory of the web service to see if there are any webshell files. If there are webshell files, then an abnormal file is detected.

[0067] A WebShell is a malicious backdoor file that exists in the form of a webpage file. It is mixed in with normal webpage files in the webroot directory of the web service, allowing malicious operations such as data deletion or modification to be performed on the website server.

[0068] Webshell files, which are backdoor files on websites, can include, but are not limited to, high-risk command scripts such as GET_cmd. Specifically, taking the GET_cmd high-risk command script file as an example, a webshell file with the following content can be a backdoor file on a website:

[0069] <?

[0070] system($_GET['cmd']);

[0071] echo' <form method＝"post"action＝".. .. hackable uploads webshell.php"> <input type＝"text"name＝"cmd"> < / form> ';

[0072] ? >

[0073] WebShell backdoor files can be identified using regular expression matching rules. Taking the file given in the specific example above, the following regular expression matching rules can be formulated to detect high-risk GET_cmd command script files:

[0074] [^\\>](\\$_GET|\\$_POST)\\[[^\\(\\)\\{\\}\\[\\]]{0,8}\\]\\((\\$_GET|\\$_POST)\\[

[0075] Specifically, it is possible to traverse each web file in the root directory of the web service in the container image, and use the regular expression matching rules for the GET_cmd high-risk command script file mentioned above to detect whether there are keywords in the content of each web file that are matched by the regular expression matching rules. For example, in the specific example of the web backdoor file WebShell mentioned above, the keywords "GET" and "POST" are present, which can be matched by the regular expression matching rules, and thus the file is detected as the web backdoor file WebShell.

[0076] When a WebShell backdoor file is detected in the container image, its access path in the container image is used to search for the corresponding file in the container corresponding to the container image through the container agent. The found file is the WebShell backdoor file. The found file is isolated or deleted. In this way, the files in the container are monitored and processed to reduce the burden on the container itself.

[0077] In another embodiment, the abnormal file detection for files in the container image includes:

[0078] The file paths of each file in the container image are obtained. Using a preset abnormal path set, when a file path in the container image is detected to match an abnormal path in the abnormal path set, an abnormal file is determined to be detected.

[0079] In practical applications, some abnormal files, such as Trojan files, have fixed file paths. For example, a Trojan file like the Gates Trojan would create a fixed file path: ` / tmp / gate.lod`. By aggregating these fixed file paths (like those of the Gates Trojan) into a set of abnormal paths, each file path in the container image is identified one by one. When a file path in the container image matches an abnormal path in this set, an abnormal file is identified. Then, when an abnormal file is detected in the container image, the abnormal file path is used to search for the corresponding file in the container through the container agent. The found file is the abnormal file, and it is isolated or deleted. This method monitors and processes files within the container to reduce the load on the container itself.

[0080] Please see Figure 2 , Figure 2 This is a block diagram illustrating a container host application container monitoring processing device 2 according to an exemplary embodiment. The container monitoring processing device 2 includes:

[0081] The process data acquisition module 21 is used to obtain other dimension information of the new process by using the process identifier of the new process when a new process is detected in the container, and to establish an association between the process identifier of the new process and the other dimension information to form the process data of the new process.

[0082] The process data is added to the container image module 22 to determine the container image corresponding to the container to which the newly created process belongs, and to add the process data of the newly created process to the container image corresponding to the container to which the newly created process belongs;

[0083] The host-side process detection and processing module 23 is used to perform abnormal process detection processing on the process data in the container image by utilizing the agent-side process detection rule set configured in the container agent-side of the container host.

[0084] Further, process data is added to container image module 22 to determine the container image corresponding to the container to which the newly created process belongs, including: obtaining the container identifier of the container to which the newly created process belongs; and using the mapping relationship between the container identifier and the corresponding container image to determine the container image corresponding to the container to which the newly created process belongs.

[0085] Furthermore, before adding process data to the container image module 22 and determining the container image corresponding to the container to which the newly created process belongs by using the mapping relationship between the container identifier and the corresponding container image, it is also used to: periodically obtain running containers on the container host machine using the container's socket interface; for the running container, establish the corresponding container image, and establish a mapping relationship between the container identifier of the running container and the corresponding container image.

[0086] Furthermore, the host-side process detection and processing module 23 is specifically used for: obtaining the process data in the container image through the container agent; using the agent's process detection rule set to detect each dimension of the other dimension information in the process data; and when a dimension is detected to match a process detection rule in the agent's process detection rule set, issuing an alarm based on the process identifier in the process data.

[0087] Furthermore, the container monitoring and processing device 2 also includes:

[0088] The host-side file detection and processing module 24 is used to detect abnormal files in the container image, and when an abnormal file is detected, obtain the access path of the abnormal file in the container image; using the access path, find the corresponding file in the container corresponding to the container image through the container agent, and isolate or delete the found file.

[0089] Furthermore, in the host-side file detection and processing module 24, the abnormal file detection for the files in the container image includes: obtaining the root directory of the web service in the container image; using preset web shell detection rules, detecting the web files in the root directory of the web service to check for the existence of web shell files; if web shell files exist, then an abnormal file is detected.

[0090] Furthermore, in the host-side file detection and processing module 24, the step of performing abnormal file detection on the files in the container image includes: obtaining the file paths of each file in the container image, and using a preset abnormal path set, when a file path in the container image is detected to match an abnormal path in the abnormal path set, an abnormal file is determined to be detected.

[0091] Furthermore, the container monitoring and processing device 2 also includes:

[0092] The cloud server detection and processing module is used to send the process data to the distributed message queue Kafka on the cloud server using the container proxy, so that the stream processing framework Flink on the cloud server can obtain the process data from the distributed message queue Kafka, store the process data in the search engine ElasticSearch on the cloud server, and index the process data in the search engine ElasticSearch based on the process identifier in the process data. Furthermore, it uses the cloud process detection rule set on the cloud server to perform abnormal process detection processing on the indexed process data.

[0093] Regarding the container monitoring and processing device 2 in the above embodiments, the specific methods by which each module performs operations have been described in detail in the embodiments of the related methods described above, and will not be elaborated here.

[0094] Please see Figure 3 , Figure 3 This is a block diagram illustrating the structure of a container host 3 according to an exemplary embodiment. The container host 3 includes:

[0095] At least one processor 31; and

[0096] The memory 32 is communicatively connected to the at least one processor 31; wherein,

[0097] The memory 32 stores instructions that can be executed by the at least one processor 31, which, when executed by the at least one processor 31, enables the at least one processor 31 to perform the aforementioned related container monitoring processing method.

[0098] Regarding the container host 3 in the above embodiments, the specific manner in which its processor 31 executes the program in the memory 32 has been described in detail in the embodiments related to the method, and will not be elaborated here.

[0099] Please see Figure 4 , Figure 4 This is a block diagram illustrating a container monitoring system according to an exemplary embodiment. The container monitoring system includes:

[0100] As described above, container host 3; and

[0101] Cloud server 4 is used to receive the process data sent by the container host through the distributed message queue Kafka of cloud server 4, and to use the stream processing framework Flink of cloud server 4 to obtain the process data from the distributed message queue Kafka, store the process data in the search engine ElasticSearch of cloud server 4, and create an index for the process data in the search engine ElasticSearch based on the process identifier in the process data, and to use the cloud process detection rule set in cloud server 4 to perform abnormal process detection processing on the indexed process data.

[0102] For process data stored in the search engine ElasticSearch, it can be divided and stored according to time, retaining data from the most recent N days, such as, but not limited to, data from the most recent seven days, thereby reducing storage pressure and costs.

[0103] Among them, for Figure 4 For a detailed description of the container monitoring and processing device 2 of the container host 3, please refer to the relevant embodiments above.

[0104] The specific methods of the container monitoring system in the above embodiments have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0105] In addition, this application also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the above-described related container monitoring processing method.

[0106] The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0107] In addition, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned related container monitoring and processing method.

[0108] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0109] It should be noted that in the description of this application, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "multiple" or "more" means at least two.

[0110] It should be understood that when an element is referred to as "fixed to" or "set on" another element, it may be directly on the other element or may have an intervening element present at the same time; when an element is referred to as "connected to" another element, it may be directly connected to the other element or may have an intervening element present at the same time. In addition, the term "connected" as used herein may include wireless connections; the word "and / or" as used includes any unit and all combinations of one or more of the associated listed items.

[0111] Any process or method description in the flowchart or otherwise herein can be understood as: representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0112] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0113] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium. When executed, the program includes one or a combination of the steps of the method embodiments.

[0114] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0115] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0116] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0117] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A container monitoring processing method characterized by comprising: The method is applied to a container host machine configured with a container, and the method comprises: acquiring, in a time manner, a running container on the container host machine by using a socket interface of the container; establishing a corresponding container image for the running container, and establishing a mapping relationship between a container identifier of the running container and the corresponding container image; when a new process in the container is detected, acquiring other dimension information of the new process by using a process identifier of the new process, and establishing an association between the process identifier of the new process and the other dimension information to form process data of the new process; determining a container image corresponding to a container to which the new process belongs by using the mapping relationship, and adding the process data of the new process to the container image corresponding to the container to which the new process belongs; performing abnormal process detection processing on the process data in the container image by using a set of proxy end process detection rules configured by a container proxy end in the container host machine.

2. The method of claim 1, wherein, The determination of the container image corresponding to the container to which the new process belongs comprises: acquiring a container identifier of the container to which the new process belongs; determining the container image corresponding to the container to which the new process belongs by using the mapping relationship between the container identifier and the corresponding container image.

3. The method of claim 1, wherein, The abnormal process detection processing on the process data in the container image by using the set of proxy end process detection rules configured by the container proxy end in the container host machine comprises: acquiring the process data in the container image through the container proxy end; detecting each dimension information of the other dimension information in the process data by using the set of proxy end process detection rules; when a dimension information hits a process detection rule in the set of proxy end process detection rules, performing an alarm prompt based on the process identifier in the process data.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: sending the process data to a distributed message queue Kafka of a cloud server by using the container proxy end, so that a stream processing framework Flink of the cloud server acquires the process data from the distributed message queue Kafka, stores the process data in a search engine ElasticSearch of the cloud server, indexes the process data in the search engine ElasticSearch based on the process identifier in the process data, and performs abnormal process detection processing on the indexed process data by using a set of cloud end process detection rules in the cloud server.

5. The method of claim 1, wherein, The method further comprises: performing abnormal file detection on a file in the container image, and when an abnormal file is detected, acquiring an access path of the abnormal file in the container image; finding a corresponding file from the container corresponding to the container image by using the access path through the container proxy end, and performing isolation or deletion processing on the found file.

6. The method of claim 5, wherein, The abnormal file detection on the file in the container image comprises: acquiring a root directory of a web service in the container image; The preset web backdoor file webshell detection rule is used to detect web files under a root directory of the web service to determine whether a web backdoor file exists.

7. The method of claim 5, wherein, The abnormal file detection on the files in the container image comprises: The file paths of the files in the container image are obtained, and a preset abnormal path set is used. When it is detected that a file path in the container image hits an abnormal path in the abnormal path set, it is determined that an abnormal file is detected.

8. A container monitoring processing device characterized by comprising: The container monitoring processing device is applied to a container host configured with a container, and the container monitoring processing device comprises: A process data obtaining module is configured to, when a new process in the container is detected, obtain other dimension information of the new process by using a process identifier of the new process, and associate the process identifier of the new process with the other dimension information to form process data of the new process. A process data adding to container image module is configured to use a socket interface of the container to obtain running containers on the container host at a regular time, establish a corresponding container image for the running containers, and establish a mapping relationship between a container identifier of the running containers and the corresponding container image. The mapping relationship is used to determine a container image corresponding to a container to which the new process belongs, and the process data of the new process is added to the container image corresponding to the container to which the new process belongs. A host end process detection processing module is configured to use a proxy end process detection rule set configured by a proxy end of a container agent in the container host to perform abnormal process detection processing on the process data in the container image.

9. A container host machine, comprising: Comprise: At least one processor; And A memory connected in communication with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

10. A container monitoring system characterized by, Comprise: The container host of claim 9.

11. The container monitoring system of claim 10, wherein, The container monitoring system further comprises: A cloud server is configured to receive the process data sent by the container host through a distributed message queue Kafka of the cloud server, obtain the process data from the distributed message queue Kafka by using a stream processing framework Flink of the cloud server, store the process data in a search engine ElasticSearch of the cloud server, index the process data based on the process identifier in the process data in the search engine ElasticSearch, and perform abnormal process detection processing on the indexed process data by using a cloud end process detection rule set in the cloud server.

12. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-7.

13. A computer program product, characterised in that, comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1-7.

Images