Target detection method and system based on docker virtual isolation, device, and storage medium

Abstract

The application discloses a target detection method and system based on Docker virtual isolation, equipment and a storage medium, wherein the method is characterized in that a plurality of target detection models are obtained by training, the plurality of models are integrated into an integrated model and constructed into a Docker image, each sub-model is located in a different container, the Docker container is isolated and enhanced, the interaction relationship between the containers and between the container and the image is determined when each deep learning model is started, the safety, isolation and execution speed are taken into account, a multilayer perception neural network is input based on the current running state of the computer and the detection accuracy requirement, and the container number and the image file number expected to be started and stopped are output, so that the method can be quickly applied to different task application scenarios, the control strategy does not need to be frequently adjusted manually according to specific tasks, the human development cost is greatly saved, and the Docker project of a specific scene can be efficiently started in a short time.

Description

Technical Field

[0001] This invention relates to the field of target detection technology, and in particular to a target detection method and system based on Docker virtual isolation, an electronic device, and a computer-readable storage medium. Background Technology

[0002] With continuous breakthroughs in artificial intelligence technology, deep learning models for object detection, semantic segmentation, and object tracking have developed strong anti-interference capabilities and are increasingly being applied in various industrial production environments, such as vending machines and precision assembly lines. The successful application of these models demonstrates the powerful practicality of deep learning. In substations, computer rooms, and other locations, there are numerous scenarios involving the detection of circuit breaker status. Traditional manual inspection is costly and poses safety hazards. Deep learning models hold great potential in these environments. However, since large-scale computing equipment is typically not feasible in industrial production sites, embedded edge computing devices are generally used to run various deep learning models. This necessitates excellent system virtualization and isolation characteristics for these edge computing devices. In recent years, Docker, as an operating system-level virtualization technology, has emerged and is gradually replacing traditional virtualization solutions, being widely used in various edge computing scenarios. Docker virtualization technology relies primarily on the namespaces and control groups provided by the Linux kernel. The security of the Linux kernel directly determines the security of Docker. While Docker has gained widespread adoption due to its advantages, it has also exposed increasing shortcomings, such as poor isolation, complex security hardening, and susceptibility to data leaks. In recent years, the security hardening solution SELinux has been proposed to enhance the security isolation of Docker. While this isolation method can minimize the resources accessible to service processes in the system, it performs user permission checks on all resources, wasting significant computing resources and time. Furthermore, it is complex to operate and suffers from poor compatibility, failing to adequately meet the security isolation and sharing requirements of shared data files between Docker containers. In addition, the AppArmor solution has been proposed to strengthen mandatory process access. Unlike SELinux, it only controls access to certain system resources. Although flexible, the exposed uncontrolled files may be leaked, making its security and isolation inferior to SELinux.

[0003] Furthermore, when allocating resources for Docker images (such as memory, CPU, video capture cards, etc.), traditional control strategies involve manually designing complex if...else... control logic to manipulate resource allocation and achieve orderly interaction between containers and between containers and images. In real-world scenarios, this manually designed control strategy requires frequent adjustments for specific tasks, a process that is complex, repetitive, and difficult to standardize. Summary of the Invention

[0004] This invention provides a target detection method and system based on Docker virtual isolation, as well as an electronic device and a computer-readable storage medium, to solve the technical problems of poor security and isolation of existing Docker containers, and the need for frequent manual adjustment of control strategies for specific tasks when allocating resources for executing Docker images, which is complex, repetitive and difficult to unify.

[0005] According to one aspect of the present invention, a target detection method based on Docker virtual isolation is provided, comprising the following:

[0006] Train multiple deep learning models for object detection;

[0007] Integrate multiple trained deep learning models into a single ensemble model;

[0008] The integrated model is constructed as a Docker image, so that each deep learning model is located in a different container, and each container and image file is uniquely numbered.

[0009] Enhance the isolation of Docker containers and clarify the interaction relationships between containers and between containers and images when each deep learning model starts;

[0010] Given the computer's current operating status and detection accuracy requirements, input the trained multilayer perceptron neural network and output the container number and image file number to be launched.

[0011] The target detection task is performed based on the output of the multilayer perceptron neural network.

[0012] Furthermore, the process of integrating multiple trained deep learning models into an ensemble model includes the following:

[0013] The inputs of multiple trained deep learning models are combined, so that each deep learning model can share the data transmitted from the image acquisition card and perform independent calculations based on the image data to give the output results.

[0014] Furthermore, the process of enhancing the isolation of Docker containers and clarifying the interaction relationships between containers and between containers and images when each deep learning model starts includes the following:

[0015] Restrict access between containers;

[0016] Restrict mutual access between containers and images;

[0017] Restrict access to shared data volumes.

[0018] Furthermore, the process of restricting mutual access between containers includes the following:

[0019] Configure the access control information between containers in the configuration file;

[0020] Parse the configuration file, initialize various working environments, and enter the container to wait for work;

[0021] Based on the parsed mutual access control information, determine whether the current container has the right to access the target container. If yes, proceed to the next step; otherwise, deny access.

[0022] The target container's files are identified to determine whether they are restricted files on the host machine. If so, access is denied; otherwise, proceed to the next step.

[0023] Determine whether the target container's file is readable and writable. If so, allow the current container to access the target container; otherwise, deny access.

[0024] Furthermore, the process of restricting mutual access between containers and images includes the following:

[0025] Configure the mutual access control information between the container and the image in the configuration file;

[0026] Parse the configuration file, initialize various working environments, and enter the container to wait for work;

[0027] Based on the parsed mutual access control information, determine whether the current container has the right to access the target image. If yes, proceed to the next step; otherwise, deny access.

[0028] The system determines whether the current container has the right to modify the target image file based on the mutual access control information. If so, the current container is allowed to read and write to the target image file; otherwise, the current container is only allowed to read from the target image file.

[0029] Furthermore, the process of restricting access to the shared data volume includes the following:

[0030] Configure the mutual access control information between the container and the file system in the configuration file;

[0031] Parse the configuration file, initialize various working environments, and enter the container to wait for work;

[0032] Based on the parsed mutual access control information, determine whether the current container has permission to access the file system. If yes, proceed to the next step; otherwise, deny access.

[0033] The target file is identified, and it is determined whether the target file exists under the shared data volume. If not, access is denied; if it does, proceed to the next step.

[0034] Determine if the target file is readable and writable. If so, allow the current container to access the target file; otherwise, deny access.

[0035] Furthermore, the process of inputting the trained multilayer perceptron with the computer's current operating state and detection accuracy requirements includes the following:

[0036] Based on the total amount of computer memory and the current remaining memory, the remaining memory is quantized into a value within the range of (0,1). The CPU utilization, the quantized value of remaining memory, and the task accuracy requirements are then input into the trained multilayer perceptron neural network.

[0037] In addition, the present invention also provides a target detection system based on Docker virtual isolation, including

[0038] The model training module is used to train multiple deep learning models for object detection.

[0039] The model integration module is used to integrate multiple trained deep learning models into a single ensemble model.

[0040] The construction module is used to build the integrated model into a Docker image, so that each deep learning model is located in a different container, and each container and image file is uniquely numbered.

[0041] The isolation enhancement module is used to enhance the isolation of Docker containers and clarify the interaction relationships between containers and between containers and images when each deep learning model starts.

[0042] The classification module is used to input the trained multilayer perceptron with the computer's current running state and detection accuracy requirements, and output the container number and image file number to be launched.

[0043] The execution module is used to perform object detection tasks based on the output of the multilayer perceptron neural network.

[0044] In addition, the present invention also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method described above by calling the computer program stored in the memory.

[0045] In addition, the present invention also provides a computer-readable storage medium for storing a computer program for target detection based on Docker virtual isolation, wherein the computer program executes the steps of the method described above when running on a computer.

[0046] The present invention has the following effects:

[0047] This invention presents a Docker-based virtual isolation-based object detection method. Multiple object detection models are trained, each with its own characteristics. For example, some models have high accuracy but high computational cost, some have low accuracy but low computational cost, and some strike a balance between computational cost and accuracy. These models are then integrated into a single ensemble model, with each object detection model serving as a sub-model within the ensemble. All sub-models share a single input and output. The ensemble model is then constructed as a Docker image, with each sub-model residing within a separate container to ensure isolation between them. Each container and image file is uniquely identified and individually controlled. Furthermore, Docker containers are enhanced with isolation measures, and the interactions between containers and between containers and images are clearly defined during the startup of each deep learning model. This prevents container escape, inter-container access leaks, and shared data security issues, significantly improving the security of container operation, image files, and shared data volumes. Simultaneously, it ensures that each object detection model can quickly invoke the corresponding container and image file to execute object detection tasks, balancing security, isolation, and execution speed. Finally, based on the computer's current operating status and detection accuracy requirements, the input is fed into the trained multilayer perceptron neural network, which outputs the container number and image file number corresponding to the most suitable target detection model to execute the target detection task. It can adaptively output the most suitable container calling scheme according to the current computer's computing resources and detection accuracy requirements. If the current computing resources are insufficient and the detection accuracy requirements are not high, the lightweight model image is activated; if the current computing resources are sufficient and the detection accuracy requirements are high, the complex model image is activated. Compared with the traditional manual design of control strategies, it can be quickly applied to different task application scenarios without the need for frequent manual adjustment of control strategies according to specific tasks, which greatly saves human development costs and can efficiently start Docker projects for specific scenarios in a short time.

[0048] In addition, the target detection system based on Docker virtual isolation of the present invention also has the above-mentioned advantages.

[0049] In addition to the objectives, features, and advantages described above, the present invention has other objectives, features, and advantages. The invention will now be described in further detail with reference to the figures. Attached Figure Description

[0050] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0051] Figure 1 This is a flowchart illustrating a preferred embodiment of the target detection method based on Docker virtual isolation according to the present invention.

[0052] Figure 2 This is a schematic diagram of Docker container isolation enhancement according to a preferred embodiment of the present invention.

[0053] Figure 3 yes Figure 1 A schematic diagram of the sub-process of step S4 in the process.

[0054] Figure 4 This is a schematic diagram of the container isolation enhancement system architecture according to a preferred embodiment of the present invention.

[0055] Figure 5 This is a schematic diagram illustrating access control between containers and images according to a preferred embodiment of the present invention.

[0056] Figure 6 This is a schematic diagram of access control between containers according to a preferred embodiment of the present invention.

[0057] Figure 7 This is a schematic diagram illustrating access control between a container and a shared data volume according to a preferred embodiment of the present invention.

[0058] Figure 8 yes Figure 3 A schematic diagram of the sub-process of step S41.

[0059] Figure 9 yes Figure 3 A schematic diagram of the sub-process of step S42.

[0060] Figure 10 yes Figure 3 A schematic diagram of the sub-process of step S43.

[0061] Figure 11 This is a schematic diagram of the module structure of a target detection system based on Docker virtual isolation according to another embodiment of the present invention. Detailed Implementation

[0062] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, the present invention can be implemented in many different ways as defined and covered below.

[0063] like Figure 1 As shown, a preferred embodiment of the present invention provides a target detection method based on Docker virtual isolation, including the following:

[0064] Step S1: Train multiple deep learning models for object detection;

[0065] Step S2: Integrate the multiple trained deep learning models into an ensemble model;

[0066] Step S3: Construct the integrated model into a Docker image, so that each deep learning model is located in a different container, and give each container and image file a unique number;

[0067] Step S4: Enhance the isolation of Docker containers and clarify the interaction relationships between containers and between containers and images when each deep learning model starts;

[0068] Step S5: Input the trained multilayer perceptron with the computer's current running status and detection accuracy requirements, and output the container number and image file number to be started;

[0069] Step S6: Perform the target detection task based on the output of the multilayer perceptron neural network.

[0070] As can be understood, the Docker-based virtual isolation object detection method in this embodiment trains multiple object detection models, each with its own characteristics. For example, some models have high accuracy but high computational cost, some have low accuracy but low computational cost, and some strike a balance between computational cost and accuracy. These multiple models are then integrated into a single ensemble model, with each object detection model serving as a sub-model within the ensemble, sharing a single input and output. The ensemble model is then constructed as a Docker image, with each sub-model residing in a different container to ensure isolation between them. Each container and image file is uniquely identified and individually controlled. Furthermore, Docker containers are enhanced with isolation measures, and the interactions between containers and between containers and images are clearly defined during the startup of each deep learning model. This prevents container escape, inter-container access leaks, and shared data security issues, significantly improving the security of container operation, image files, and shared data volumes. Simultaneously, it ensures that each object detection model can quickly invoke the corresponding container and image file to execute object detection tasks, balancing security, isolation, and execution speed. Finally, based on the computer's current operating status and detection accuracy requirements, the input is fed into the trained multilayer perceptron neural network, which outputs the container number and image file number corresponding to the most suitable target detection model to execute the target detection task. It can adaptively output the most suitable container calling scheme according to the current computer's computing resources and detection accuracy requirements. If the current computing resources are insufficient and the detection accuracy requirements are not high, the lightweight model image is activated; if the current computing resources are sufficient and the detection accuracy requirements are high, the complex model image is activated. Compared with the traditional manual design of control strategies, it can be quickly applied to different task application scenarios without the need for frequent manual adjustment of control strategies according to specific tasks, which greatly saves human development costs and can efficiently start Docker projects for specific scenarios in a short time.

[0071] It is understood that in step S1, multiple object detection models are obtained through training. Each object detection model has its own characteristics. For example, some object detection models have high accuracy but high computational cost, some have low accuracy but low computational cost, and some have a relatively balanced approach between computational cost and accuracy. The specific training process of the object detection models is existing technology and will not be described in detail here.

[0072] It is understood that step S2 specifically includes the following:

[0073] The inputs of multiple trained deep learning models are combined, so that each deep learning model can share the data transmitted from the image acquisition card and perform independent calculations based on the image data to give the output results.

[0074] Specifically, each deep learning model is treated as a sub-model of the ensemble model. Each sub-model can share the image data transmitted from the image acquisition card and can perform independent calculations based on the image data to give output results. The appropriate sub-model is automatically selected to perform the object detection task through the adaptive calculation results of the subsequent multilayer perceptual neural network.

[0075] Understandable, such as Figure 2 As shown, in step S3, the integrated model is constructed as a Docker image. This image file contains all the environment files and essential functional files required by the containers, ensuring that each deep learning model resides in a different container, guaranteeing isolation and security between the models. Each container and image file is uniquely numbered, facilitating the automatic invocation of the corresponding numbered container and image file to execute the object detection task based on the adaptive calculation results of the multilayer perceptron neural network. Furthermore, the training component, model weight component, and production environment deployment component for each deep learning model can also reside in separate containers.

[0076] Understandable, such as Figure 3 As shown, step S4 specifically includes the following:

[0077] Step S41: Restrict mutual access between containers;

[0078] Step S42: Restrict mutual access between containers and images;

[0079] Step S43: Restrict access to the shared data volume.

[0080] Specifically, considering that this invention applies to embedded virtualization deployments in deep learning object detection tasks, the most critical issues for this application scenario are Docker container security and shared file security. Container security issues are divided into container escape and inter-container access leakage. Container escape refers to malicious actors exploiting system vulnerabilities and software design flaws to bypass container boundaries and enter the host machine to perform illegal operations when executing user programs. Shared file security refers to the issue of shared data between containers. In the current cloud environment, container data sharing is a very common technology. Therefore, a solution needs to be designed to provide effective protection and isolation between container data sharing and between containers and the host machine to address these two issues. Figures 4 to 7As shown, the container isolation enhancement system architecture of this invention mainly includes two modules: a container isolation module and a data volume isolation module. The configuration file provides system-related configuration information and allows for quick modification of access control policies. These policies primarily include inter-container access control, inter-container and image file access control, and inter-container and shared data volume access control. Restricting inter-container access control effectively ensures the security of the container working environment, allowing each container to perform its designated function. Restricting access to containers and image files improves image file security, preventing simultaneous access to image files in multiple containers and thus avoiding system crashes. Restricting access to shared data volumes ensures their security, preventing container security issues caused by Docker's inherent limitations and Linux system vulnerabilities. This protects the host file system and container file systems from unauthorized reading or modification.

[0081] Specifically, such as Figure 8 As shown, step S41 specifically includes the following:

[0082] Step S411: Configure the mutual access control information between containers in the configuration file;

[0083] Step S412: Parse the configuration file, initialize various working environments, and enter the container to wait for work;

[0084] Step S413: Determine whether the current container has permission to access the target container based on the parsed mutual access control information. If yes, proceed to the next step; otherwise, deny access.

[0085] Step S414: Identify the files in the target container and determine whether the files are restricted by the host machine. If so, deny access; otherwise, proceed to the next step.

[0086] Step S415: Determine whether the target container's file can be read or written. If so, allow the current container to access the target container; otherwise, deny access.

[0087] It is understandable that when accessing between containers, the system first checks whether the current container has the necessary access permissions to the target container. This ensures the security of the target container's working environment and prevents unauthorized reading or modification of its file system. Then, it checks whether the target container's files are restricted by the host machine. If so, access is denied, preventing the current container from illegally bypassing the target container and entering the host machine to perform unauthorized operations. This ensures isolation between the container and the host machine. This invention, through two levels of security and isolation measures, can prevent container security issues caused by inherent flaws in Docker and Linux system vulnerabilities. It protects both the host and container file systems from unauthorized reading or modification and maximizes the utilization of accessible data by the container for efficient and secure operation.

[0088] Specifically, such as Figure 9 As shown, step S42 specifically includes the following:

[0089] Step S421: Configure the mutual access control information between the container and the image in the configuration file;

[0090] Step S422: Parse the configuration file, initialize various working environments, and enter the container to wait for work;

[0091] Step S423: Determine whether the current container has permission to access the target image based on the parsed mutual access control information. If yes, proceed to the next step; otherwise, deny access.

[0092] Step S424: Determine whether the current container has the right to modify the target image file based on the mutual access control information. If so, allow the current container to perform read and write operations on the target image file; otherwise, only allow the current container to perform read operations on the target image file.

[0093] It's understandable that when accessing an image between a container and its container, the system first checks whether the container has permission to access the image, improving the security of the image file and preventing system crashes caused by simultaneous access to the image file in multiple containers. Then, it checks whether the container has permission to modify the target image file. If so, the container is allowed to read and write to the target image file; otherwise, it is only allowed to read from the target image file, preventing unauthorized operations and further enhancing the security of the image file.

[0094] Specifically, such as Figure 10 As shown, step S43 specifically includes the following:

[0095] Step S431: Configure the mutual access control information between the container and the file system in the configuration file;

[0096] Step S432: Parse the configuration file, initialize various working environments, and enter the container to wait for work;

[0097] Step S433: Determine whether the current container has permission to access the file system based on the parsed mutual access control information. If yes, proceed to the next step; otherwise, deny access.

[0098] Step S434: Identify the target file and determine whether it exists under the shared data volume. If not, deny access; if so, proceed to the next step.

[0099] Step S435: Determine whether the target file can be read or written. If so, allow the current container to access the target file; otherwise, deny access.

[0100] It is understandable that when restricting container access to a shared data volume, the system first determines whether the current container has permission to access the file system, ensuring the security of the file system. Then, it determines whether the target file directory is located under the shared data volume path. Access is only allowed if it is. This effectively prevents the current container from performing illegal operations on other files that are not under the shared data volume path, thus limiting the range of file paths that the container can access. Containers in different groups and with different access priorities can access different paths and numbers of shared files. This further ensures the security of the file system while guaranteeing the security of the shared data.

[0101] It can also be understood that by adopting the above three restriction and isolation methods, the present invention enables multiple trained deep learning models to be well deployed in actual working scenarios through embedding. When one of the deep learning models is selected, fast and secure data transmission can be carried out between containers, between containers and images, and between containers and shared data volumes based on the above restriction rules. This not only ensures the security and isolation of the containers, but also meets the need for fast data transmission.

[0102] It is understood that the process in step S5, which requires inputting the trained multilayer perceptron based on the computer's current operating state and detection accuracy, includes the following:

[0103] Based on the total amount of computer memory and the current remaining memory, the remaining memory is quantized into a value within the range of (0,1). The CPU utilization, the quantized value of remaining memory, and the task accuracy requirements are then input into the trained multilayer perceptron neural network.

[0104] Specifically, assuming a computer has a total of 8GB of memory and 4GB of remaining memory, the remaining memory can be quantified as 4 / 8 = 0.5. The quantized value of remaining memory is between (0,1), with smaller values ​​indicating less remaining memory and larger values ​​indicating more remaining memory. CPU utilization can be found in the computer's task manager, and its value is also between (0,1). Larger values ​​indicate a heavier computer load, while smaller values ​​indicate a lighter load. Remaining memory and CPU utilization are the primary resource allocation objects for Docker images. By quantizing both into values ​​within the (0,1) range and inputting them into a trained multilayer perceptron (MLP), the MLP can adaptively select the most suitable deep learning model based on the current computer performance. For example, if the computer has little remaining memory and high CPU utilization, the MLP will choose to use a container and image corresponding to a lightweight model; if there is plenty of remaining memory and low CPU utilization, the MLP will choose to use a container and image corresponding to a complex model. Furthermore, by also incorporating the detection accuracy requirement as input, the optimal deep learning model can be adaptively selected by comprehensively considering both the current computer performance and the required detection accuracy. Alternatively, in another embodiment of the present invention, the importance of the task can also be quantified as a value between (0,1) as input, with the larger the value, the more important the task.

[0105] Alternatively, the input values ​​for the neural network can be obtained based on the following formula:

[0106]

[0107] Where k represents the weight coefficient, with a value range of [0,1], x represents each quantized value, which can be a quantized value of remaining memory, CPU utilization, detection accuracy requirements, or task importance, and n represents the number of quantized values. By using weight calculation, multiple input factors can be comprehensively considered to select the most suitable deep learning model from multiple perspectives.

[0108] It is understandable that after the input values ​​are processed by the trained multilayer perceptron neural network, the probability of each container being used will be output, that is, the probability corresponding to each deep learning model. The container with the highest probability will then transfer data with other containers, images, and shared data volumes based on three pre-defined restriction and isolation methods to perform the target detection task.

[0109] In addition, such as Figure 11 As shown, another embodiment of the present invention also provides a target detection system based on Docker virtual isolation, preferably employing the above-described target detection method. This system includes...

[0110] The model training module is used to train multiple deep learning models for object detection.

[0111] The model integration module is used to integrate multiple trained deep learning models into a single ensemble model.

[0112] The construction module is used to build the integrated model into a Docker image, so that each deep learning model is located in a different container, and each container and image file is uniquely numbered.

[0113] The isolation enhancement module is used to enhance the isolation of Docker containers and clarify the interaction relationships between containers and between containers and images when each deep learning model starts.

[0114] The classification module is used to input the trained multilayer perceptron with the computer's current running state and detection accuracy, and output the container number and image file number to be launched.

[0115] The execution module is used to perform object detection tasks based on the output of the multilayer perceptron neural network.

[0116] As can be understood, the Docker-based virtual isolation object detection system in this embodiment trains multiple object detection models, each with its own characteristics. For example, some models have high accuracy but high computational cost, some have low accuracy but low computational cost, and some strike a balance between computational cost and accuracy. These multiple models are then integrated into a single ensemble model, with each object detection model serving as a sub-model within the ensemble. All sub-models share a single input and output. The ensemble model is then constructed as a Docker image, with each sub-model residing in a different container to ensure isolation between them. Each container and image file is uniquely identified and individually controlled. Furthermore, the Docker containers are enhanced with isolation measures, and the interactions between containers and between containers and images are clearly defined during the startup of each deep learning model. This prevents container escape, inter-container access leaks, and shared data security issues, significantly improving the security of container operation, image files, and shared data volumes. Simultaneously, it ensures that each object detection model can quickly invoke the corresponding container and image file to execute object detection tasks, balancing security, isolation, and execution speed. Finally, based on the computer's current operating status and detection accuracy requirements, the input is fed into the trained multilayer perceptron neural network, which outputs the container number and image file number corresponding to the most suitable target detection model to execute the target detection task. It can adaptively output the most suitable container calling scheme according to the current computer's computing resources and detection accuracy requirements. If the current computing resources are insufficient and the detection accuracy requirements are not high, the lightweight model image is activated; if the current computing resources are sufficient and the detection accuracy requirements are high, the complex model image is activated. Compared with the traditional manual design of control strategies, it can be quickly applied to different task application scenarios without the need for frequent manual adjustment of control strategies according to specific tasks, which greatly saves human development costs and can efficiently start Docker projects for specific scenarios in a short time.

[0117] It is understood that each module in the system of this embodiment corresponds to each method in the above method embodiment. Therefore, the specific working process and working principle of each module will not be described in detail here. Please refer to the above method embodiment.

[0118] In addition, another embodiment of the present invention provides an electronic device including a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method described above by calling the computer program stored in the memory.

[0119] In addition, another embodiment of the present invention provides a computer-readable storage medium for storing a computer program for target detection based on Docker virtual isolation, wherein the computer program executes the steps of the method described above when running on a computer.

[0120] Common computer-readable storage media include: floppy disks, flexible disks, hard disks, magnetic tapes, any other magnetic media, CD-ROMs, any other optical media, punch cards, paper tape, any other physical media with perforated patterns, random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), flash erasable programmable read-only memory (FLASH-EPROM), any other memory chips or cartridges, or any other media readable by a computer. Instructions may further be transmitted or received by a transmission medium. The term transmission medium can include any tangible or intangible medium used to store, encode, or carry instructions for machine execution, and includes digital or analog communication signals or intangible media that facilitate communication of such instructions. Transmission media include coaxial cables, copper wires, and optical fibers, which contain conductors for transmitting a bus of computer data signals.

[0121] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A target detection method based on Docker virtual isolation, characterized in that, The application relates to a method for training and deploying a plurality of deep learning models for target detection. The method comprises the following steps: training a plurality of deep learning models for target detection; integrating the plurality of trained deep learning models into an integrated model; constructing the integrated model into a Docker image, so that each deep learning model is located in a different container, and each container and image file is uniquely numbered; isolating and enhancing the Docker containers, and clearly defining the interaction between containers and between containers and images when each deep learning model is started; inputting the trained multi-layer perception neural network according to the current running state of the computer and the detection accuracy requirement, and outputting the container number and image file number expected to be started; performing a target detection task according to the output result of the multi-layer perception neural network; the process of isolating and enhancing the Docker containers, and clearly defining the interaction between containers and between containers and images when each deep learning model is started comprises the following steps: limiting the mutual access between containers; limiting the mutual access between containers and images; limiting the access to shared data volumes; the process of limiting the mutual access between containers comprises the following steps: setting mutual access control information between containers in a configuration file; parsing the configuration file, initializing various working environments, and entering a container to wait for work; judging whether the current container has the right to access a target container according to the parsed mutual access control information, and if yes, entering the next step, and if not, refusing to access; identifying the files of the target container, judging whether the files are host machine restricted files, and if yes, refusing to access, and if not, entering the next step; 2.The Docker virtual isolation based target detection method of claim 1, wherein, judging whether the files of the target container can be read and written, and if yes, allowing the current container to access the target container, and if not, refusing to access. the process of integrating the plurality of trained deep learning models into an integrated model comprises the following steps: 3.The Docker virtual isolation based target detection method of claim 1, wherein, merging the inputs of the plurality of trained deep learning models together, so that each deep learning model can share the data transmitted by an image acquisition card, and independently operate based on the image data to give an output result. the process of limiting the mutual access between containers and images comprises the following steps: setting mutual access control information between containers and images in a configuration file; parsing the configuration file, initializing various working environments, and entering a container to wait for work; judging whether the current container has the right to access a target image according to the parsed mutual access control information, and if yes, entering the next step, and if not, refusing to access; 4.The Docker virtual isolation based target detection method of claim 1, wherein, judging whether the current container has the right to modify the target image file according to the mutual access control information, and if yes, allowing the current container to read and write the target image file, and if not, only allowing the current container to read the target image file. the process of limiting the access to shared data volumes comprises the following steps: setting mutual access control information between containers and file systems in a configuration file; parsing the configuration file, initializing various working environments, and entering a container to wait for work; judging whether the current container has the right to access a file system according to the parsed mutual access control information, and if yes, entering the next step, and if not, refusing to access. The target file is identified, and it is determined whether the target file exists under the shared data volume. If not, access is denied; if it does, proceed to the next step. Determine if the target file is readable and writable. If so, allow the current container to access the target file; otherwise, deny access.

5. The Docker virtual isolation based target detection method according to any one of claims 1-4, wherein, The process of inputting the trained multilayer perceptron with the computer's current operating state and detection accuracy requirements includes the following: Based on the total amount of computer memory and the current remaining memory, the remaining memory is quantized into a value within the range of (0,1). The CPU utilization, the quantized value of the remaining memory, and the task accuracy requirements are then input into the trained multilayer perceptron neural network. 6.A target detection system based on Docker virtual isolation, characterized in that, include The model training module is used to train multiple deep learning models for object detection. The model integration module is used to integrate multiple trained deep learning models into a single ensemble model. The construction module is used to build the integrated model into a Docker image, so that each deep learning model is located in a different container, and each container and image file is uniquely numbered. The isolation enhancement module is used to enhance the isolation of Docker containers and clarify the interaction relationships between containers and between containers and images when each deep learning model starts. The classification module is used to input the trained multilayer perceptron with the computer's current running state and detection accuracy requirements, and output the container number and image file number to be launched. The execution module is used to perform object detection tasks based on the output of the multilayer perceptual neural network. The process of enhancing the isolation of Docker containers and clarifying the interaction relationships between containers and between containers and images when each deep learning model starts includes the following: Restrict access between containers; Restrict mutual access between containers and images; Restrict access to shared data volumes; The process of restricting access between containers includes the following: Configure the access control information between containers in the configuration file; Parse the configuration file, initialize various working environments, and enter the container to wait for work; Based on the parsed mutual access control information, determine whether the current container has the right to access the target container. If yes, proceed to the next step; otherwise, deny access. The target container's files are identified to determine whether they are restricted files on the host machine. If so, access is denied; otherwise, proceed to the next step. Determine whether the target container's file is readable and writable. If so, allow the current container to access the target container; otherwise, deny access.

7. An electronic device, comprising: The method includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method as described in any one of claims 1 to 5 by calling the computer program stored in the memory. 8.A computer readable storage medium for storing a computer program for object detection based on Docker virtual isolation, the computer program comprising instructions which, when executed by a computer, cause the computer to carry out the method according to any one of claims 1 to 7. The computer program, when run on a computer, performs the steps of the method as described in any one of claims 1 to 5.

Images