Risk detection method and apparatus, storage medium, and electronic device

Abstract

The application discloses a risk detection method and device, a storage medium and an electronic device. The method comprises the following steps: acquiring a calling event generated by a workload in a cloud computing system, and analyzing the calling event to obtain an analysis result, and determining a container ID of the workload used for executing the calling event according to the analysis result; acquiring a rule engine with the same engine ID and container ID as the target rule engine; acquiring an execution log associated with the calling event through the container ID to obtain a target execution log, and sending the target execution log to the target rule engine; acquiring a detection rule in the target rule engine, and detecting the target execution log through the detection rule to obtain a detection result of the calling event. Through the application, the problem of poor detection efficiency and detection accuracy of the related art using multiple detection systems to detect the calling event in the cloud computing environment is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of risk control, in particular, to a risk detection method and device, a storage medium and an electronic device. BACKGROUND

[0002] With the development of virtual machine and container technology, the combination of the two is also closer. In a cloud computing environment, such as a hybrid cloud environment, the most common strategy is to deploy virtual machines on hosts, deploy containers in virtual machines, and use containers and virtual machines together to provide great flexibility for deploying and managing applications. Kubernetes (k8s for short) is a tool for managing containerized workloads and services, promoting container orchestration automation. As a representative of container orchestration technology, k8s is widely used in hybrid clouds.

[0003] When enterprises use a hybrid cloud environment, it is necessary to periodically detect the call events in each workload in the hybrid cloud environment to ensure the normal operation of k8s and hosts in the hybrid cloud environment. However, the existing security detection technology needs to set a detection system for detecting k8s and a detection system for detecting hosts in the hybrid cloud. Since two different systems need to be used for detection, the detection process is complex, and the association between problems occurring on both sides of k8s and hosts cannot be detected, resulting in incorrect detection results.

[0004] In view of the problems of poor detection efficiency and detection accuracy of using multiple detection systems to detect the call events in the cloud computing environment in the related art, no effective solution has been proposed so far. SUMMARY

[0005] The present application provides a risk detection method and device, a storage medium and an electronic device to solve the problem of poor detection efficiency and detection accuracy of using multiple detection systems to detect the call events in the cloud computing environment in the related art.

[0006] According to an aspect of the present application, a risk detection method is provided. The method comprises: obtaining a call event generated by a workload in a cloud computing system, and parsing the call event to obtain a parsing result, and determining a container ID of the workload for executing the call event according to the parsing result; obtaining a rule engine with the same engine ID and container ID as the target rule engine, wherein the rule engine comprises a detection rule for determining whether the call event is at risk; obtaining an execution log associated with the call event through the container ID to obtain a target execution log, and sending the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the call event; obtaining the detection rule in the target rule engine, and detecting the target execution log through the detection rule to obtain a detection result of the call event, wherein the detection result represents whether the call event is a risk event.

[0007] Optionally, obtaining the rule engine with the same engine ID and container ID as the target rule engine comprises: determining whether there is a rule engine with the same engine ID and container ID in the plurality of rule engines; in the case that there is a rule engine with the same engine ID and container ID, determining the rule engine corresponding to the engine ID as the target rule engine; in the case that there is no rule engine with the same engine ID and container ID, generating an initial rule engine, obtaining the workload associated with the container ID from a first comparison table, and obtaining a detection rule for detecting the associated workload, adding the obtained detection rule to the initial rule engine to obtain the target rule engine, wherein the first comparison table comprises a plurality of workloads and attribute information of each workload.

[0008] Optionally, obtaining the workload associated with the container ID from the first comparison table comprises: obtaining a target container corresponding to the container ID from the first comparison table, and obtaining attribute information of the target container; parsing the attribute information of the target container to obtain a target host for running the target container and a target cluster where the target host is located; and determining the target container, the target host and the target cluster as the workload associated with the container ID.

[0009] Optionally, obtaining the detection rule for detecting the associated workload comprises: in the case that the associated workload comprises a container, obtaining a first detection rule for detecting the container from a rule feature library, wherein the rule feature library stores detection rules for detecting different types of workloads; and / or in the case that the associated workload comprises a host, obtaining a second detection rule for detecting the container from the rule feature library; and / or in the case that the associated workload comprises a cluster, obtaining a third detection rule for detecting the cluster from the rule feature library; and determining at least one of the first detection rule, the second detection rule and the third detection rule as the detection rule for detecting the associated workload.

[0010] Optionally, obtaining the execution log associated with the calling event through the container ID comprises: obtaining a target container corresponding to the container ID, and obtaining an execution log of the target container to obtain a first execution log, wherein the first execution log comprises: a container file system mounting point, and whether the container is abnormally started; determining a target host where the target container is located according to attribute information of the target container, and obtaining an execution log of the target host to obtain a second execution log, wherein the second execution log comprises processes, users, files and network behaviors of an operating system of the host; and combining the first execution log, the second execution log and the attribute information of the target container into the target execution log.

[0011] Optionally, the method further comprises: detecting an operation of deleting the container and / or an operation of changing the attribute information of the container; in a case where the operation of deleting the container is detected, determining a deleted container, deleting the attribute information of the deleted container in the first comparison table, and deleting the rule engine corresponding to the container ID of the deleted container; and / or in a case where the operation of changing the attribute information of the container is detected, determining a container whose attribute information is changed, and updating the attribute information of the container whose attribute information is changed in the first comparison table.

[0012] Optionally, determining the container ID of the workload for executing the calling event according to the analysis result comprises: judging whether the target container for executing the calling event is indicated in the analysis result; in a case where the target container for executing the calling event is indicated in the analysis result, determining the ID of the target container as the container ID; and in a case where the target container for executing the calling event is not indicated in the analysis result, determining a host for executing the calling event, obtaining a preset ID of the host for executing the calling event, and determining the preset ID as the container ID.

[0013] According to another aspect of the present application, a risk detection apparatus is provided. The apparatus comprises: a first obtaining unit configured to obtain a calling event generated by a workload in a cloud computing system, and analyze the calling event to obtain an analysis result, and determine a container ID of the workload for executing the calling event according to the analysis result; a second obtaining unit configured to obtain a rule engine whose engine ID is the same as the container ID to obtain a target rule engine, wherein the rule engine comprises a detection rule for determining whether the calling event is at risk; a sending unit configured to obtain an execution log associated with the calling event through the container ID to obtain a target execution log, and send the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the calling event; and a first detection unit configured to obtain the detection rule in the target rule engine, and detect the target execution log through the detection rule to obtain a detection result of the calling event, wherein the detection result represents whether the calling event is a risk event.

[0014] According to another aspect of the embodiments of the present application, a computer storage medium is also provided for storing a program, wherein the program controls the device where the computer storage medium is located to perform a risk detection method when the program is executed.

[0015] According to another aspect of the embodiments of the present application, an electronic device is also provided, comprising one or more processors and a memory; the memory stores computer readable instructions, and the processor is configured to execute the computer readable instructions, wherein the computer readable instructions perform a risk detection method when executed.

[0016] According to the present application, the following steps are adopted: obtaining a calling event generated by a workload in a cloud computing system, and parsing the calling event to obtain a parsing result; determining a container ID of the workload used to execute the calling event according to the parsing result; obtaining a rule engine with the same container ID as the engine ID to obtain a target rule engine, wherein the rule engine comprises a detection rule used to determine whether the calling event is at risk; obtaining an execution log associated with the calling event through the container ID to obtain a target execution log, and sending the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the calling event; obtaining the detection rule in the target rule engine, and detecting the target execution log through the detection rule to obtain a detection result of the calling event, wherein the detection result represents whether the calling event is a risk event. The present application solves the problem of poor detection efficiency and detection accuracy of using multiple detection systems to detect calling events in a cloud computing environment in the related art. By determining the container ID of the workload used to execute the calling event, the rule engine corresponding to the calling event and having the detection rule is determined, and the execution log associated with the calling event is obtained, so that the execution log is detected through the rule engine, thereby determining whether the calling event is at risk. Therefore, the calling events in all types of workloads can be detected through the rule engine only, and the number of rule engines is not limited, which can run in parallel, and each rule engine only corresponds to a certain container ID, thereby improving the detection efficiency and detection accuracy of the security detection of the cloud computing system. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are part of the present application, are used to provide a further understanding of the present application, and the illustrative embodiments of the present application and their descriptions are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flowchart of a risk detection method according to an embodiment of the present application;

[0019] Figure 2 is a flowchart of an optional risk detection method according to an embodiment of the present application;

[0020] Figure 3 FIG. 1 is a schematic diagram of a risk detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] It should be noted that the embodiments and features of the present application can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0022] In order to enable persons skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units need not be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0024] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties. For example, an interface is provided between the system and the relevant user or institution. Before obtaining the relevant information, the interface needs to send a request to the aforementioned user or institution, and after receiving the consent information fed back by the aforementioned user or institution, the relevant information is obtained.

[0025] It should be noted that the risk detection method, device, storage medium and electronic device determined by the present disclosure can be used in the field of risk control, and can also be used in any field other than the field of risk control. The application field of the risk detection method, device, storage medium and electronic device determined by the present disclosure is not limited.

[0026] For the convenience of description, the following describes some nouns or terms related to the embodiments of the present application:

[0027] Host: is the infrastructure in the hybrid cloud, the host runs the operating system, virtual machine, container runtime environment, and the core components of k8s.

[0028] Virtual machine: a virtual machine running on a host, which can run application processes or containers on the virtual machine;

[0029] Container: a container application running directly on a host or virtual machine, which is independent of k8s

[0030] According to the embodiments of the present application, a risk detection method is provided.

[0031] Figure 1 is a flowchart of the risk detection method provided by the embodiments of the present application. As shown in Figure 1 , the method comprises the following steps:

[0032] Step S102, obtaining a call event generated by a workload in a cloud computing system, and parsing the call event to obtain a parsing result, and determining a container ID of the workload used to execute the call event according to the parsing result.

[0033] Specifically, the cloud computing system can be a hybrid cloud system, which can include multiple hosts. The hosts can also be virtual machines. Each host includes multiple containers. Some of the containers are containers corresponding to k8s, i.e., containers used by application programs in the k8s system in the hybrid cloud.

[0034] Further, the above-mentioned hosts, containers, and application programs in k8s are all workloads in the hybrid cloud. When one or more workloads in the hybrid cloud occur a call event, a security protection system deployed on each host can perform security detection on the call event, thereby ensuring the security of the hybrid cloud.

[0035] When a call event occurs, the host where the workload that occurs the call event is located can parse the call event to obtain process information, and obtain the container ID corresponding to the call event from the process information, so as to determine the container actually executing the call event according to the container ID, and determine whether the call event is risky according to the information of the container.

[0036] For example, a call event occurs in a certain application program in k8s. By parsing the call event, the corresponding process information can be obtained, and the container ID of at least one container actually executing the call event can be determined according to the process information, so as to determine the container corresponding to the call event.

[0037] Step S104, a rule engine with the same engine ID as the container ID is obtained, and a target rule engine is obtained, wherein the rule engine includes a detection rule for determining whether the call event is risky.

[0038] Specifically, in each security protection system, there is a rule engine matching module, and the rule engine matching module includes a plurality of rule engines, wherein each rule engine only stores rule information of one container, and the container ID of the corresponding container is the engine ID of the rule engine. After obtaining the target rule engine according to the container ID, it can be determined whether the call event is risky through the detection rule in the target rule engine.

[0039] Step S106, obtain the execution log associated with the call event through the container ID, obtain the target execution log, and send the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the call event.

[0040] Specifically, after determining the target rule engine, the execution log associated with the call event is obtained through the container ID, the target execution log is obtained, and the target execution log is sent to the target rule engine, so that the target engine can analyze and process the target execution log, and then determine whether the call event is risky.

[0041] Step S108, obtain the detection rule in the target rule engine, and detect the target execution log through the detection rule to obtain the detection result of the call event, wherein the detection result represents whether the call event is a risky event.

[0042] Specifically, after sending the target execution log to the target rule engine, the target execution log can be detected through the detection rule in the target rule engine, so as to determine whether the call event is risky, and thus the effect of improving the detection efficiency and detection accuracy of the security detection of the cloud computing system is achieved.

[0043] The risk detection method provided in the embodiments of the present application comprises the following steps: obtaining a calling event generated by a workload in a cloud computing system, and parsing the calling event to obtain a parsing result; determining a container ID of the workload used to execute the calling event according to the parsing result; obtaining a rule engine with the same engine ID and container ID as the target rule engine, wherein the rule engine comprises a detection rule used to determine whether the calling event is at risk; obtaining an execution log associated with the calling event through the container ID to obtain a target execution log, and sending the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the calling event; obtaining the detection rule in the target rule engine, and detecting the target execution log through the detection rule to obtain a detection result of the calling event, wherein the detection result represents whether the calling event is a risk event. The problem of poor detection efficiency and detection accuracy of using multiple detection systems to detect the calling event in the cloud computing environment in the related art is solved. The container ID of the workload used to execute the calling event is determined, so that the rule engine corresponding to the calling event and having the detection rule is determined, and the execution log associated with the calling event is obtained, so that the execution log is detected through the rule engine, so as to determine whether the calling event is at risk, thereby achieving that the calling event in all types of workloads can be detected through the rule engine, the number of rule engines is not limited, the rule engines can run in parallel, and each rule engine only corresponds to a certain container ID, thereby improving the detection efficiency and detection accuracy of the security detection of the cloud computing system.

[0044] Since the rule engine corresponding to the container ID may not exist in the rule engine matching module, optionally, in the risk detection method provided in the embodiments of the present application, obtaining the rule engine with the same engine ID and container ID as the target rule engine comprises: determining whether the rule engine with the same engine ID and container ID exists in the multiple rule engines; in the case that the rule engine with the same engine ID and container ID exists, determining the rule engine corresponding to the engine ID as the target rule engine; in the case that the rule engine with the same engine ID and container ID does not exist, generating an initial rule engine, obtaining the workload associated with the container ID from a first comparison table, and obtaining the detection rule used to detect the associated workload, adding the obtained detection rule to the initial rule engine to obtain the target rule engine, wherein the first comparison table comprises multiple workloads and attribute information of each workload.

[0045] Specifically, when obtaining the rule engine corresponding to the container ID from the rule engine matching module, if there is an engine ID that is the same as the container ID, the rule engine can be determined as the target rule engine. If there is no engine ID that is the same as the container ID, an empty initial rule engine needs to be newly created, the working load corresponding to the container ID is determined according to the first correspondence table, the corresponding detection rule is determined according to the working load, the detection rule is added to the initial rule engine, and the engine ID of the rule engine is determined as the container ID, so as to complete the creation of the target rule engine in the rule engine matching module.

[0046] It should be noted that, since there are many working loads in the hybrid cloud, and the configuration modes of different products of different manufacturers are not unified, many working loads cannot be unified, therefore, in the present solution, the three-layer grouping mode is used to group the many working loads, so as to determine the working load type and attribute information of each working load, and generate the first correspondence table. First, the working loads are classified according to clusters, to obtain the cluster information of each working load, and each cluster is also regarded as a working load, wherein, the computing environment that belongs to the same management unit and has the same physical attribute is called a cluster, for example, a vpc of a public cloud is a cluster, and a k8s environment is a cluster. Further, after the cluster is determined, the hosts in the cluster are grouped, each host group contains a part of hosts, and each host group is also regarded as a working load. Specifically, for a k8s cluster, the working loads need to be grouped according to the namespace in the k8s environment, so as to obtain a plurality of k8s type working loads, wherein, each namespace is also regarded as a working load. In the host group, the working loads can also be divided into host type and container type, wherein, the host type is a working load without container, and the container type is a container as a working load.

[0047] Through the above classification mode, the working loads can be divided into: cluster, namespace, k8s, host group, host, and container, and the attribute information of each working load is determined according to the information of each working load and the attribute information of the group where the working load is located, so as to obtain the first correspondence table. Table 1 is a kind of optional first correspondence table, as shown in Table 1, the first correspondence table includes a plurality of working loads and attribute information of each working load.

[0048] Table 1

[0049] Workload Type Attribute Information Cluster Cluster Name Namespace Cluster Name, Namespace k8s Cluster Name, Namespace, Application Name, Application Type Host Group Cluster Name, Host Group Name Host Cluster Name, Host Group Name, Host Name Container Container ID, Host Group Name (or Application Name), Host Name, Container Image Name

[0050] Optionally, in the risk detection method provided in the embodiments of the present application, the workloads associated with the container ID are obtained from the first correspondence table, including: obtaining a target container corresponding to the container ID from the first correspondence table, and obtaining attribute information of the target container; parsing the attribute information of the target container to obtain a target host for running the target container and a target cluster where the target host is located; and determining the target container, the target host and the target cluster as the workloads associated with the container ID.

[0051] Specifically, when the workloads associated with the container ID are obtained through the first correspondence table, the corresponding container can be determined in the first correspondence table according to the container ID to obtain a target container, and the corresponding host name is determined according to the attribute information of the target container (if the container is called by k8s, the k8s name also needs to be obtained), so as to obtain the corresponding target host or target application system, and then the corresponding target cluster is determined through the target host or target application system, and the target container, target host and target cluster are determined as the workloads associated with the container ID.

[0052] It should be noted that in the case that the target container corresponds to k8s, the corresponding Namespace also needs to be determined, and the Namespace is also determined as the workload associated with the container ID.

[0053] Optionally, in the risk detection method provided in the embodiments of the present application, obtaining the detection rule for detecting the associated workloads includes: in the case that the associated workloads include containers, obtaining a first detection rule for detecting the containers from a rule feature library, wherein the rule feature library stores detection rules for detecting different types of workloads; and / or in the case that the associated workloads include hosts, obtaining a second detection rule for detecting the containers from the rule feature library; and / or in the case that the associated workloads include clusters, obtaining a third detection rule for detecting the clusters from the rule feature library; and determining at least one of the first detection rule, the second detection rule and the third detection rule as the detection rule for detecting the associated workloads.

[0054] Specifically, after obtaining the workloads associated with the container ID, the detection rule corresponding to each workload can be obtained from the rule feature library, so that the detection rule corresponding to the container ID can be added to the initial rule engine, so as to obtain the target rule engine.

[0055] It should be noted that the rule feature library is a collection of expert knowledge of detection rules formed by analyzing known threats, and the detection rules of the rule feature library are classified into the following categories according to threat types: container escape, user privilege escalation, sensitive file read-write, abnormal user behavior, abnormal process, reverse shell, malicious data deletion, and the like, and each threat type is corresponded to a workload, so that after obtaining the workload associated with the container ID, all detection rules corresponding to the workload can be obtained from the rule feature library. For example, the workload is a host, and the detection rules for the host are selected. The workload is k8s, and the detection rules for k8s are selected.

[0056] Optionally, in the risk detection method provided in the embodiments of the present application, the execution log associated with the calling event is obtained through the container ID, and the target execution log is obtained by obtaining the target container corresponding to the container ID and obtaining the execution log of the target container to obtain the first execution log, wherein the first execution log includes: container file system mounting point, whether the container is abnormally started; the target host where the target container is located is determined according to the attribute information of the target container, and the execution log of the target host is obtained to obtain the second execution log, wherein the second execution log includes the process, user, file and network behavior of the operating system of the host; and the first execution log, the second execution log and the attribute information of the target container are combined into the target execution log.

[0057] Specifically, after determining the container ID, the execution log corresponding to the container ID needs to be obtained through the security protection system, which includes: the execution log of the target container, that is, the first execution log, wherein the log information of the container includes: the ID of the container, the container name, the container image information, the container file system mounting point, whether the container is started with privilege, and the like. At the same time, the target host where the target container is located needs to be determined and the execution log of the target host needs to be obtained, that is, the second execution log, wherein the execution log of the target host includes: the process, user, file, network behavior and the like of the operating system of the host.

[0058] Further, after obtaining the first execution log and the second execution log, the first execution log, the second execution log and the attribute information of the target container can be combined into the target execution log, so that the target rule engine can determine whether the calling event has executed the risk step according to the target execution log, thereby determining the risk of the calling event.

[0059] Optionally, in the risk detection method provided in the embodiments of the present application, the method further comprises: detecting an operation of deleting a container and / or an operation of changing attribute information of the container; in the case of detecting the operation of deleting the container, determining the deleted container, deleting the attribute information of the deleted container in the first correspondence table, and deleting the rule engine corresponding to the container ID of the deleted container; and / or in the case of detecting the operation of changing the attribute information of the container, determining the container whose attribute information is changed, and updating the attribute information of the container whose attribute information is changed in the first correspondence table.

[0060] Specifically, when the security protection system does not perform security detection, it is necessary to periodically acquire the container attribute information change situation of the container in each host and the container deletion situation. In the case of the container attribute information change situation, it is necessary to change the attribute information of the container in the first correspondence table, so that correct detection rules and container information can be obtained when the security protection system performs detection and when the rule engine is created.

[0061] Further, in the case of the container deletion, it is necessary to not only delete the attribute information of the container in the first correspondence table, but also delete the rule engine corresponding to the container in each rule engine matching module of the security protection system, so that the space of the rule engine matching module is saved.

[0062] Optionally, in the risk detection method provided in the embodiments of the present application, determining the container ID of the working load for executing the calling event according to the analysis result comprises: judging whether the target container for executing the calling event is indicated in the analysis result; in the case that the target container for executing the calling event is indicated in the analysis result, determining the ID of the target container as the container ID; and in the case that the target container for executing the calling event is not indicated in the analysis result, determining the host for executing the calling event, acquiring a preset ID of the host for executing the calling event, and determining the preset ID as the container ID.

[0063] Specifically, in the case that the target host for executing the calling event is indicated in the analysis result, it indicates that the calling event is a host call and does not use the container. At this time, the preset ID can be determined as the container ID, so that when the security protection system acquires the container ID, it can know that the calling event corresponding to the ID is a host call, so that the execution log corresponding to the calling event is sent to the rule engine corresponding to the host, thereby completing the detection of the calling event.

[0064] For example, “host” can be used as the preset ID, and in the case that the calling event is generated by the host, “host” can be used as the corresponding container ID, so that in subsequent processing, “host” can be used to distinguish that the source of the calling event is the host, thereby completing the detection of the calling event, and achieving the effect of improving the detection accuracy.

[0065] Figure 2 is a flowchart of an optional risk detection method provided by an embodiment of the present application. As shown in Figure 2 the security protection system arranged on each host can detect the call event occurring on the host, wherein the k8s call event can be detected by the corresponding container of k8s, after detecting the call event, the call event can be obtained, the execution log corresponding to the container ID can be determined through the container ID, and the execution log is sent to the rule engine corresponding to the container ID in the rule engine matching module, so as to detect the execution log in the rule engine generated through the first comparison table, so as to determine whether the call event has risk, and further to achieve that the call event in all types of workloads can be detected only through the rule engine, the number of rule engines is not limited, the rule engines can run in parallel, and each rule engine only corresponds to a certain container ID, so as to improve the detection efficiency and detection accuracy of the security detection of the cloud computing system.

[0066] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0067] The embodiment of the present application also provides a risk detection device, and it should be noted that the risk detection device of the embodiment of the present application can be used to execute the risk detection method provided by the embodiment of the present application. The risk detection device provided by the embodiment of the present application is introduced as follows.

[0068] Figure 3 is a schematic diagram of a risk detection device provided by an embodiment of the present application. As shown in Figure 3 the device includes a first acquisition unit 31, a second acquisition unit 32, a sending unit 33, and a first detection unit 34.

[0069] Specifically, the first acquisition unit 31 is configured to acquire a call event generated by a workload in a cloud computing system, analyze the call event, obtain an analysis result, and determine a container ID of the workload used to execute the call event according to the analysis result.

[0070] Specifically, the cloud computing system can be a hybrid cloud system, and the hybrid cloud system can include a plurality of hosts, wherein the hosts can also be virtual machines, and each host includes a plurality of containers, wherein some of the containers are containers corresponding to k8s, that is, containers used by applications in the k8s system in the hybrid cloud.

[0071] Further, the above host, container, and application in k8s are all workloads in the hybrid cloud. When one or more workloads in the hybrid cloud have a call event, the security protection system deployed on each host can perform security detection on the call event, thereby ensuring the security of the hybrid cloud.

[0072] When the call event occurs, the first acquisition unit 31 can analyze the call event through the host where the workload that has the call event is located, thereby obtaining process information, and obtaining the container ID corresponding to the call event from the process information, so as to determine the container that actually executes the call event according to the container ID, and determine whether the call event is risky according to the information of the container.

[0073] For example, a call event occurs in a certain application in k8s. By analyzing the call event, the corresponding process information can be obtained, and the container ID of at least one container that actually executes the call event can be determined according to the process information, thereby determining the container corresponding to the call event.

[0074] The second acquisition unit 32 is configured to acquire a rule engine with an engine ID same as the container ID, to obtain a target rule engine, wherein the rule engine includes a detection rule for determining whether the call event is risky.

[0075] Specifically, in each security protection system, there is a rule engine matching module, and the rule engine matching module includes a plurality of rule engines, wherein each rule engine only stores the rule information of one container, and the container ID of the corresponding container is the engine ID of the rule engine. After obtaining the target rule engine according to the container ID, it can be determined whether the call event is risky through the detection rule in the target rule engine.

[0076] The sending unit 33 is configured to obtain a target execution log associated with the call event through the container ID, and send the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the call event.

[0077] Specifically, after determining the target rule engine, the execution log associated with the call event is obtained through the container ID to obtain the target execution log, and the target execution log is sent to the target rule engine, so as to correspond the target rule engine corresponding to the container ID and the target execution log.

[0078] The first detection unit 34 is configured to acquire the detection rule in the target rule engine, and detect the target execution log through the detection rule to obtain a detection result of the call event, wherein the detection result represents whether the call event is a risky event.

[0079] Specifically, after the target execution log is sent to the target rule engine, the target execution log can be detected by the detection rule in the target rule engine, so as to determine whether the call event exists risk, and thus the effect of improving the detection efficiency and detection accuracy of the security detection of the cloud computing system is achieved.

[0080] The risk detection device provided by the embodiment of the application comprises a first acquisition unit 31, which is configured to acquire a call event generated by a workload in a cloud computing system, and analyze the call event to obtain an analysis result, and determine a container ID of the workload used to execute the call event according to the analysis result; a second acquisition unit 32, which is configured to acquire a rule engine with the same engine ID and container ID as the target rule engine, to obtain the target rule engine, wherein the rule engine comprises a detection rule, and the detection rule is used to determine whether the call event exists risk; a sending unit 33, which is configured to acquire an execution log associated with the call event by the container ID, to obtain a target execution log, and send the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the call event; and a first detection unit 34, which is configured to acquire the detection rule in the target rule engine, and detect the target execution log by the detection rule to obtain a detection result of the call event, wherein the detection result represents whether the call event is a risk event. The problem that the detection efficiency and detection accuracy of the security detection of the call event in the cloud computing environment by using multiple detection systems are poor in the related art is solved. The container ID of the workload used to execute the call event is determined, so as to determine the rule engine with the detection rule corresponding to the call event, and the execution log associated with the call event is acquired, so as to detect the execution log by the rule engine, to determine whether the call event exists risk. Thus, the call event in all types of workloads can be detected by only the rule engine, the number of the rule engines is not limited, the rule engines can be run in parallel, and each rule engine only corresponds to a certain container ID, so that the detection efficiency and detection accuracy of the security detection of the cloud computing system are improved.

[0081] Optionally, in the risk detection device provided in the embodiments of the present application, the second acquisition unit 32 comprises: a judgment subunit, configured to judge whether there is a rule engine with the same engine ID and container ID in the plurality of rule engines; a first determination subunit, configured to determine the rule engine corresponding to the engine ID as the target rule engine in the case that there is a rule engine with the same engine ID and container ID; and a generation subunit, configured to generate an initial rule engine in the case that there is no rule engine with the same engine ID and container ID, acquire the workload associated with the container ID from the first comparison table, acquire the detection rule for detecting the associated workload, add the acquired detection rule to the initial rule engine, and obtain the target rule engine, wherein the first comparison table comprises a plurality of workloads and attribute information of each workload.

[0082] Specifically, when the rule engine corresponding to the container ID is acquired from the rule engine matching module, if there is an engine with the same engine ID and container ID, the rule engine can be determined as the target rule engine. If there is no engine with the same engine ID and container ID, an empty initial rule engine needs to be newly created, the workload corresponding to the container ID is determined according to the first comparison table, the corresponding detection rule is determined according to the workload, the detection rule is added to the initial rule engine, and the engine ID of the rule engine is determined as the container ID, so that the creation of the target rule engine is completed in the rule engine matching module.

[0083] It should be noted that, since there are many workloads in the hybrid cloud, and the configuration modes of different products of different manufacturers are not unified, a plurality of workloads cannot be unified, therefore, in the present scheme, the plurality of workloads are grouped by three-layer grouping, so as to determine the workload type and attribute information of each workload, and generate the first comparison table. First, the workloads are classified according to clusters, to obtain the cluster information of each workload, and each cluster is also regarded as a workload, wherein the computing environment with the same management unit and physical attribute is called a cluster, for example, a vpc of a public cloud is a cluster, and a k8s environment is a cluster. Further, after the cluster is determined, the hosts in the cluster are grouped, each host group contains a part of hosts, and each host group is also regarded as a workload. Specifically, for a k8s cluster, the workloads need to be grouped according to the namespace in the K8s environment, so as to obtain a plurality of k8s type workloads, wherein each namespace is also regarded as a workload. In the host group, the workloads can also be divided into host type and container type, wherein the host type is a workload without container, and the container type is a container as a workload.

[0084] Through the above classification manner, the workloads can be classified into cluster, namespace, k8s, host group, host, and container, and the attribute information of each workload is determined according to the information of each workload and the attribute information of the group where the workload is located, so as to obtain a first correspondence table. Table 1 is an optional first correspondence table. As shown in Table 1, the first correspondence table includes a plurality of workloads and the attribute information of each workload.

[0085] Optionally, in the risk detection apparatus provided in the embodiments of the present application, the generating subunit comprises: a first obtaining module, configured to obtain a target container corresponding to the container ID from the first correspondence table, and obtain the attribute information of the target container; an analyzing module, configured to analyze the attribute information of the target container to obtain a target host used for running the target container and a target cluster where the target host is located; and a first determining module, configured to determine the target container, the target host, and the target cluster as the workload associated with the container ID.

[0086] Specifically, when the workload associated with the container ID is obtained through the first correspondence table, the corresponding container can be determined in the first correspondence table according to the container ID to obtain a target container, and the corresponding host name is determined according to the attribute information of the target container (if the container is called by k8s, the k8s name also needs to be obtained), so as to obtain the corresponding target host or target application system, and then the corresponding target cluster is determined through the target host or target application system, and the target container, the target host, and the target cluster are determined as the workload associated with the container ID.

[0087] It should be noted that in the case that the target container corresponds to k8s, the corresponding Namespace also needs to be determined, and the Namespace is also determined as the workload associated with the container ID.

[0088] Optionally, in the risk detection apparatus provided in the embodiments of the present application, the generating subunit comprises: a second obtaining module, configured to obtain, in the case that the associated workload comprises a container, a first detection rule for detecting the container from a rule feature library, wherein the rule feature library stores detection rules for detecting different types of workloads; and / or a third obtaining module, configured to obtain, in the case that the associated workload comprises a host, a second detection rule for detecting the container from the rule feature library; and / or a fourth obtaining module, configured to obtain, in the case that the associated workload comprises a cluster, a third detection rule for detecting the cluster from the rule feature library; and a second determining module, configured to determine at least one of the first detection rule, the second detection rule, and the third detection rule as the detection rule for detecting the associated workload.

[0089] Specifically, after obtaining the workload associated with the container ID, the detection rule corresponding to each workload can be obtained from the rule feature library, so that the detection rule corresponding to the container ID can be added to the initial rule engine, thereby obtaining the target rule engine.

[0090] It should be noted that the rule feature library is a collection of expert knowledge of detection rules formed by analyzing known threats, and the detection rules of the rule feature library are classified into categories such as container escape, user privilege escalation, sensitive file read-write, abnormal user behavior, abnormal process, reverse shell, and malicious data deletion according to threat categories, and each threat category is corresponded to a workload, so that after obtaining the workload associated with the container ID, all detection rules corresponding to the workload can be obtained from the rule feature library. For example, the workload is a host, and the detection rule for the host is selected. The workload is k8s, and the detection rule for k8s is selected.

[0091] Optionally, in the risk detection apparatus provided in the embodiments of the present application, the sending unit 33 comprises: an obtaining subunit, configured to obtain a target container corresponding to the container ID and obtain an execution log of the target container to obtain a first execution log, wherein the first execution log comprises: a container file system mounting point and whether the container is abnormally started; a second determining subunit, configured to determine a target host where the target container is located according to attribute information of the target container and obtain an execution log of the target host to obtain a second execution log, wherein the second execution log comprises process, user, file and network behavior of an operating system of the host; and a combining subunit, configured to combine the first execution log, the second execution log and the attribute information of the target container into a target execution log.

[0092] Specifically, after determining the container ID, the execution log corresponding to the container ID also needs to be obtained through the security protection system, which includes: the execution log of the target container, that is, the first execution log, wherein the log information of the container includes: the ID of the container, the container name, the container image information, the container file system mounting point, and whether the container is started with privilege. At the same time, the target host where the target container is located and the execution log of the target host, that is, the second execution log, also need to be obtained, wherein the execution log of the target host includes: process, user, file, network behavior and other information of the operating system of the host.

[0093] Further, after obtaining the first execution log and the second execution log, the first execution log, the second execution log and the attribute information of the target container can be combined into a target execution log, so that the target rule engine can determine whether the risk step is executed according to the target execution log, thereby determining the risk of the calling event.

[0094] Optionally, in the risk detection apparatus provided in the embodiments of the present application, the apparatus further comprises: a second detection unit, configured to detect an operation of deleting a container and / or an operation of changing attribute information of a container; a deletion unit, configured to, in a case where the operation of deleting a container is detected, determine a deleted container, delete the attribute information of the deleted container in the first correspondence table, and delete the rule engine corresponding to the container ID of the deleted container; and / or an updating unit, configured to, in a case where the operation of changing the attribute information of the container is detected, determine a container whose attribute information is changed, and update the attribute information of the container whose attribute information is changed in the first correspondence table.

[0095] Specifically, when the security protection system does not perform security detection, it is necessary to periodically acquire the container attribute information change situation of each host and the container deletion situation. In a case where the container attribute information change situation occurs, it is necessary to change the attribute information of the container in the first correspondence table, so that correct detection rules and container information can be obtained when the security protection system performs detection and when the rule engine is created.

[0096] Further, in a case where a container is deleted, it is necessary to not only delete the attribute information of the container in the first correspondence table, but also delete the rule engine corresponding to the container in each rule engine matching module of the security protection system, so that the space of the rule engine matching module is saved.

[0097] Optionally, in the risk detection apparatus provided in the embodiments of the present application, the first acquisition unit 31 comprises: a second judgment submodule, configured to judge whether the target container of the execution call event is indicated in the analysis result; a third determination submodule, configured to, in a case where the target container of the execution call event is indicated in the analysis result, determine the ID of the target container as the container ID; and a fourth determination submodule, configured to, in a case where the target container of the execution call event is not indicated in the analysis result, determine the host of the execution call event, acquire the preset ID of the host of the execution call event, and determine the preset ID as the container ID.

[0098] Specifically, in a case where the target host of the execution call event is indicated in the analysis result, it is indicated that the call event is a host call and a container is not used, and at this time, the preset ID can be determined as the container ID, so that when the security protection system acquires the container ID, it can be known that the call event corresponding to the ID is a host call, and thus the execution log corresponding to the call event can be sent to the rule engine corresponding to the host, so that the detection of the call event is completed.

[0099] For example, the "host" can be taken as a preset ID, and the "host" is taken as a corresponding container ID in the case that a calling event is generated by the host, so that the "host" can be used to distinguish that the source of the calling event is the host in subsequent processing, thereby completing detection of the calling event, and achieving the effect of improving detection accuracy.

[0100] The risk detection device includes a processor and a memory, the first acquisition unit 31, the second acquisition unit 32, the sending unit 33, the first detection unit 34 and the like are stored in the memory as program units, and the corresponding functions are realized by the processor executing the program units stored in the memory.

[0101] The processor includes a kernel, and the kernel calls the corresponding program units in the memory. The kernel can be set to one or more, and the problem of poor detection efficiency and detection accuracy of using multiple detection systems to detect the calling event in the cloud computing environment in the related art can be solved by adjusting the kernel parameters.

[0102] The memory can include a non-permanent memory in a computer readable medium, a random access memory (RAM) and / or a non-volatile memory such as a read-only memory (ROM) or a flash memory (flash RAM), and the memory includes at least one memory chip.

[0103] The embodiment of the present application provides a computer readable storage medium, which stores a program, and the program is executed by a processor to realize the risk detection method.

[0104] The embodiment of the present application provides a processor, which is used for running a program, and the program is executed to perform the risk detection method.

[0105] The embodiment of the present application provides an electronic device, which comprises a processor, a memory and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: obtaining a calling event generated by a workload in a cloud computing system, and parsing the calling event to obtain a parsing result; determining a container ID of the workload used for executing the calling event according to the parsing result; obtaining a rule engine with the same engine ID and the container ID as a target rule engine, wherein the rule engine comprises a detection rule used for determining whether the calling event is at risk; obtaining an execution log associated with the calling event through the container ID to obtain a target execution log, and sending the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the calling event; obtaining the detection rule in the target rule engine, and detecting the target execution log through the detection rule to obtain a detection result of the calling event, wherein the detection result represents whether the calling event is a risk event. The device in the present application can be a server, a PC, a PAD, a mobile phone and the like.

[0106] The present application also provides a computer program product adapted to execute a program with the following method steps when executed on a data processing device: obtaining a calling event generated by a workload in a cloud computing system, and parsing the calling event to obtain a parsing result; determining a container ID of the workload used for executing the calling event according to the parsing result; obtaining a rule engine with the same engine ID and the container ID as a target rule engine, wherein the rule engine comprises a detection rule used for determining whether the calling event is at risk; obtaining an execution log associated with the calling event through the container ID to obtain a target execution log, and sending the target execution log to the target rule engine, wherein the execution log records log data generated by the workload when executing the calling event; obtaining the detection rule in the target rule engine, and detecting the target execution log through the detection rule to obtain a detection result of the calling event, wherein the detection result represents whether the calling event is a risk event.

[0107] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can adopt a computer program product in the form of a computer usable storage medium containing a computer usable program code, including but not limited to a disk memory, a CD-ROM, an optical memory and the like.

[0108] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps in one or more flow or blocks

[0109] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps in one or more flow or blocks

[0110] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps in one or more flow or blocks

[0111] In one typical configuration, the computing device includes one or more processors (CPU's), input / output interfaces, network interfaces, and memory.

[0112] The memory can include non-persistent memory and / or persistent memory, both of which can be volatile and / or non-volatile. Non-persistent memory can include, for example, a random access memory (RAM), which can be a volatile memory device that can require power to maintain its state. Non-persistent memory can also include, for example, a cache memory, a register found in a CPU, a ROM, etc. Persistent memory can include, for example, a read-only memory (ROM), a flash memory, a floppy disk, a compact disk (CD), a DVD, a hard disk drive, solid state drive, etc. The memory can be a computer-readable medium.

[0113] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0114] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0115] The above only is an embodiment of the present application, and is not used to limit the present application. For those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A risk detection method, characterized by, The method comprises the following steps: obtaining a call event generated by a workload in a cloud computing system, and parsing the call event to obtain a parsing result, and determining a container ID of a workload for executing the call event according to the parsing result; obtaining a rule engine with an engine ID same as the container ID to obtain a target rule engine, wherein the rule engine comprises a detection rule for determining whether the call event is a risk event; obtaining an execution log associated with the call event through the container ID to obtain a target execution log, and sending the target execution log to the target rule engine, wherein the execution log records log data generated by a workload when executing the call event; obtaining the detection rule in the target rule engine, and detecting the target execution log through the detection rule to obtain a detection result of the call event, wherein the detection result represents whether the call event is a risk event; determining the container ID of the workload for executing the call event according to the parsing result comprises: determining whether the target container for executing the call event is indicated in the parsing result; in the case that the target container for executing the call event is indicated in the parsing result, determining the ID of the target container as the container ID; in the case that the target container for executing the call event is not indicated in the parsing result, determining a host for executing the call event, obtaining a preset ID of the host for executing the call event, and determining the preset ID as the container ID.

2. The method of claim 1, wherein, obtaining the rule engine with the engine ID same as the container ID to obtain the target rule engine comprises: determining whether there is a rule engine with the engine ID same as the container ID in a plurality of rule engines; in the case that there is a rule engine with the engine ID same as the container ID, determining the rule engine corresponding to the engine ID as the target rule engine; in the case that there is no rule engine with the engine ID same as the container ID, generating an initial rule engine, obtaining a workload associated with the container ID from a first comparison table, and obtaining a detection rule for detecting the associated workload, adding the obtained detection rule to the initial rule engine to obtain the target rule engine, wherein the first comparison table comprises a plurality of workloads and attribute information of each workload.

3. The method of claim 2, wherein, obtaining the workload associated with the container ID from the first comparison table comprises: obtaining a target container corresponding to the container ID from the first comparison table, and obtaining attribute information of the target container; parsing the attribute information of the target container to obtain a target host for running the target container and a target cluster where the target host is located; determining the target container, the target host and the target cluster as the workload associated with the container ID.

4. The method of claim 2, wherein, obtaining the detection rule for detecting the associated workload comprises: In a case where the associated workload comprises a container, a first detection rule for detecting the container is acquired from a rule feature library, wherein the rule feature library stores detection rules for detecting different types of workloads; and / or In a case where the associated workload comprises a host, a second detection rule for detecting the container is acquired from the rule feature library; and / or In a case where the associated workload comprises a cluster, a third detection rule for detecting the cluster is acquired from the rule feature library; At least one of the first detection rule, the second detection rule, and the third detection rule is determined as a detection rule for detecting the associated workload.

5. The method of claim 2, wherein, The target execution log is obtained by acquiring an execution log associated with the invocation event through the container ID, comprising: A target container corresponding to the container ID is acquired, and an execution log of the target container is acquired to obtain a first execution log, wherein the first execution log comprises a container file system mounting point and whether the container is abnormally started; A target host where the target container is located is determined according to attribute information of the target container, and an execution log of the target host is acquired to obtain a second execution log, wherein the second execution log comprises process, user, file, and network behavior of an operating system of the host; The first execution log, the second execution log, and the attribute information of the target container are combined into the target execution log.

6. The method of claim 3, wherein, The method further comprises: detecting an operation of deleting a container and / or an operation of changing attribute information of a container; In a case where the operation of deleting the container is detected, a deleted container is determined, attribute information of the deleted container in the first correspondence table is deleted, and a rule engine corresponding to a container ID of the deleted container is deleted; and / or In a case where the operation of changing the attribute information of the container is detected, a container with changed attribute information is determined, and attribute information of the container with changed attribute information in the first correspondence table is updated.

7. A risk detection apparatus characterized by comprising: Comprise: A first acquisition unit is configured to acquire an invocation event generated by a workload in a cloud computing system, parse the invocation event to obtain a parsing result, and determine a container ID of a workload used to execute the invocation event according to the parsing result; A second acquisition unit is configured to acquire a rule engine with an engine ID same as the container ID to obtain a target rule engine, wherein the rule engine comprises a detection rule for determining whether the invocation event is at risk; A sending unit is configured to acquire an execution log associated with the invocation event through the container ID to obtain a target execution log, and send the target execution log to the target rule engine, wherein the execution log records log data generated by a workload when executing the invocation event; A first detection unit is configured to acquire the detection rule in the target rule engine, detect the target execution log through the detection rule, and obtain a detection result of the invocation event, wherein the detection result represents whether the invocation event is a risk event. The first obtaining unit comprises: a second judging submodule, configured to judge whether a target container for executing the calling event is indicated in the analysis result; a third determining submodule, configured to determine the ID of the target container as the container ID in the case that the target container for executing the calling event is indicated in the analysis result; and a fourth determining submodule, configured to determine a host for executing the calling event, obtain a preset ID of the host for executing the calling event, and determine the preset ID as the container ID in the case that the target container for executing the calling event is not indicated in the analysis result.

8. A computer storage medium, characterized in that The computer storage medium is configured to store a program, and the program is configured to control a device in which the computer storage medium is located to execute the risk detection method in any one of claims 1 to 6 when the program is executed.

9. An electronic device, comprising: The device comprises one or more processors and a memory, and the memory is configured to store one or more programs, and the one or more programs are configured to enable the one or more processors to implement the risk detection method in any one of claims 1 to 6 when the one or more programs are executed by the one or more processors.

Images