System call information determination method and apparatus, electronic device, and storage medium

Abstract

The application discloses a system call information determination method and device, electronic equipment and a storage medium, wherein the method comprises: processing a code file in a target container to obtain first system call information of the target container; inputting second system call information of the target container into a system call information model to obtain third system call information of the target container; the second system call information is part of the system call information of the target container; and a system call information set composed of the first system call information and the third system call information is determined as the system call information of the target container.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for determining system call information. Background Technology

[0002] With the development of container technology, containers, due to their lightweight nature, virtualization, and excellent portability, have become widely used applications in cloud platforms. Developers can port their applications and dependent environments to containers using a unified packaging method. Although container technology is quite mature, the shared kernel and weak isolation between containers and the host machine mean that the security performance of containers themselves cannot be fully guaranteed, posing data security risks and threats to users. To reduce the attack surface exposed by containers, attacks can be reduced from the perspective of system calls, blocking exploits that require privilege escalation through system calls, thereby improving container security and protecting user application and data security. However, currently, there is no way to solve the problem of insufficient access to application system call information. Summary of the Invention

[0003] To address the aforementioned technical problems, embodiments of this application provide a method, apparatus, electronic device, and storage medium for determining system call information.

[0004] In a first aspect, embodiments of this application provide a method for determining system call information, the method comprising:

[0005] The code files in the target container are processed to obtain the first system call information of the target container;

[0006] The second system call information of the target container is input into the system call information model to obtain the third system call information of the target container; the second system call information is a portion of the system call information of the target container.

[0007] The system call information set consisting of the first system call information and the third system call information is determined as the system call information of the target container.

[0008] In one optional embodiment of this application, the step of processing the code file in the target container to obtain the first system call information of the target container includes:

[0009] The code files in the target container are parsed to obtain the function call graph information of each function in the code files;

[0010] Based on the function call graph information of each function in the code file, the function information data of the code file is obtained;

[0011] Based on the function information data, the first system call information of the target container is obtained.

[0012] In one optional embodiment of this application, obtaining the function call graph information of each function in the code file includes:

[0013] Based on the application scenario of the target container, the function call graph information of each function in the code file is obtained.

[0014] In an optional embodiment of this application, before inputting the second system call information of the target container into the system call information model to obtain the third system call information of the target container, the method further includes:

[0015] The system call information model to be trained is obtained by using the fourth system call information of multiple containers; wherein, the fourth system call information of each of the multiple containers is a part of the system call information of that container.

[0016] In one optional embodiment of this application, the fourth system call information based on multiple containers is used to train the system call information model to be trained, thereby obtaining the system call information model, including:

[0017] The fourth system call information is processed using a sliding window method that changes the window length to obtain the first call sequence;

[0018] The first call sequence is encoded using the encoding network in the system call information model to be trained, to obtain the encoded information of the fourth system call information; the encoded information of the fourth system call information includes the semantic information of the fourth system call information;

[0019] The encoded information is decoded using the decoding network in the system call information model to be trained, to obtain a second call sequence corresponding to the fourth system call information;

[0020] The system call information model to be trained is trained based on the semantic information and the second call sequence to obtain the system call information model.

[0021] In an optional embodiment of this application, before encoding the first call sequence using the encoding network in the system call information model to be trained, the method further includes:

[0022] The fourth system call information is processed using a sliding window method with a fixed window length to obtain the third call sequence;

[0023] The third call sequence is encoded to obtain the encoded information of the third call sequence;

[0024] The encoded information of the third call sequence is input into the word vector model to obtain the word vector of the fourth system call information;

[0025] The word vectors are embedded when the embedding layer of the system call model to be trained is initialized.

[0026] In an optional embodiment of this application, the step of inputting the second system call information of the target container into the system call information model to obtain the third system call information of the target container includes:

[0027] The second system call information is processed using a sliding window method that changes the window length to obtain the fourth call sequence;

[0028] The fourth call sequence is input into the system call information model to obtain the third system call information of the target container.

[0029] In one optional embodiment of this application, the encoding network and decoding network of the system call information model include an attention structure; the masking mechanisms corresponding to the encoding network and the decoding network are different.

[0030] In one optional embodiment of this application, the method further includes:

[0031] The set of permissions for running the target container is determined based on the system call information of the target container;

[0032] When the target container receives an access message, it determines whether to allow the access message to access the target container based on the permission set.

[0033] Secondly, embodiments of this application provide a system call information determination device, the device comprising:

[0034] The first processing unit is used to process the code files in the target container to obtain the first system call information of the target container;

[0035] The second processing unit is used to input the second system call information of the target container into the system call information model to obtain the third system call information of the target container; the second system call information is a portion of the system call information of the target container.

[0036] The determining unit is configured to determine the system call information set consisting of the first system call information and the third system call information as the system call information of the target container.

[0037] In one optional embodiment of this application, the first processing unit is specifically configured to: parse the code file in the target container to obtain function call graph information of each function in the code file; obtain function information data of the code file based on the function call graph information of each function in the code file; and obtain the first system call information of the target container based on the function information data.

[0038] In an optional embodiment of this application, the first processing unit is further specifically used to: obtain function call graph information of each function in the code file based on the application scenario of the target container.

[0039] In an optional embodiment of this application, before the second processing unit inputs the second system call information of the target container into the system call information model to obtain the third system call information of the target container, the apparatus further includes:

[0040] The training unit is used to train the system call information model to be trained based on the fourth system call information of multiple containers to obtain the system call information model; wherein, the fourth system call information of each of the multiple containers is a part of the system call information of that container.

[0041] In an optional embodiment of this application, the training unit is specifically configured to: process the fourth system call information using a sliding window processing method with varying window length to obtain a first call sequence; encode the first call sequence using the encoding network in the system call information model to be trained to obtain encoded information of the fourth system call information; the encoded information of the fourth system call information includes semantic information of the fourth system call information; decode the encoded information using the decoding network in the system call information model to be trained to obtain a second call sequence corresponding to the fourth system call information; and train the system call information model to be trained based on the semantic information and the second call sequence to obtain the system call information model.

[0042] In an optional embodiment of this application, before the training unit encodes the first call sequence using the encoding network in the system call information model to be trained, the apparatus further includes:

[0043] The third processing unit is used to process the fourth system call information using a sliding window processing method with a fixed window length to obtain a third call sequence; to encode the third call sequence to obtain the encoding information of the third call sequence; to input the encoding information of the third call sequence into a word vector model to obtain the word vector of the fourth system call information; and to embed the word vector while initializing the embedding layer of the system call model to be trained.

[0044] In one optional embodiment of this application, the second processing unit is specifically used to: process the second system call information using a sliding window processing method with varying window length to obtain a fourth call sequence; and input the fourth call sequence into the system call information model to obtain the third system call information of the target container.

[0045] In one optional embodiment of this application, the encoding network and decoding network of the system call information model include an attention structure; the masking mechanisms corresponding to the encoding network and the decoding network are different.

[0046] In one optional embodiment of this application, the apparatus further includes:

[0047] The fourth processing unit is configured to, upon receiving an access message, determine, based on the permission set, whether to allow the access message to access the target container.

[0048] Thirdly, embodiments of this application provide an electronic device, which includes a memory and a processor. The memory stores computer-executable instructions, and the processor can implement the methods described in the above embodiments when it executes the computer-executable instructions in the memory.

[0049] Fourthly, embodiments of this application provide a computer storage medium storing executable instructions, which, when executed by a processor, implement the methods described in the above embodiments.

[0050] The technical solution of this application, by processing the code files in the target container, obtains the first system call information of the target container. This system call information can be obtained statically, but this method may result in some static code failing to obtain the system call information required for actual code execution. This application obtains the third system call information of the target container by inputting the second system call information of the target container into a system call information model. The second system call information is a portion of the system call information of the target container, and can be obtained dynamically. This dynamic method supplements the statically obtained system call information. This application's scheme, by determining the system call information set composed of the first and third system call information as the system call information of the target container, obtains more comprehensive and complete system call information for the target container. Based on the system call information set obtained dynamically and statically, this application can reduce the attack surface exposed by the container and improve container security when using system call management for container security protection. Attached Figure Description

[0051] Figure 1 A flowchart illustrating the system call information determination method provided in this application embodiment;

[0052] Figure 2 A flowchart illustrating an exemplary method for obtaining system call information using a static approach, provided for embodiments of this application;

[0053] Figure 3 A schematic diagram illustrating the training of the system call information model and the generation of derived system call information provided in this application embodiment;

[0054] Figure 4 This is a schematic diagram of the system call information model provided in an embodiment of this application;

[0055] Figure 5 This is a comparative diagram of different container system calls provided in the embodiments of this application;

[0056] Figure 6 A block diagram illustrating the method for determining system function call information provided in an embodiment of this application;

[0057] Figure 7 A schematic diagram of the structural composition of the system call information determination device provided in the embodiments of this application;

[0058] Figure 8 This is a schematic diagram of the structural composition of the electronic device provided in the embodiments of this application. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0060] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be defined and explained in subsequent figures.

[0061] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0062] Please see Figure 1 , Figure 1 A flowchart illustrating the system call information determination method provided in this application embodiment is shown below. Figure 1 As shown in the embodiments of this application, the system call information determination method includes:

[0063] S101: Process the code file in the target container to obtain the first system call information of the target container.

[0064] The target container includes the application and the environment it depends on. In computer operating systems, taking Linux as an example, most container attacks require obtaining certain system privileges through system calls when attacking the container. Based on this attack characteristic, this application embodiment can obtain the relevant system call information required for the normal operation of the application within the target container by compiling and processing the relevant code files of the application within the target container.

[0065] In an optional embodiment of this application, step S101 is implemented through the following steps:

[0066] A1: Parse the code files in the target container to obtain the function call graph information of each function in the code files.

[0067] A2: Based on the function call graph information of each function in the code file, obtain the function information data of the code file.

[0068] A3: Based on the function information data, obtain the first system call information of the target container.

[0069] This application embodiment compiles and processes the relevant code files of the application within the target container to construct a function information database corresponding to the application's relevant code files. The function information database includes files, function information trees, and function call graphs. By combining the data in the function information database, the relevant system call information required for the normal operation of the application can be obtained.

[0070] In this application embodiment, an exemplary flowchart of a method for obtaining system call information using a static approach is shown below. Figure 2 As shown:

[0071] S21: Parse the code file in the target container to obtain the function call graph information of each function in the code file.

[0072] Specifically, the application source code files in the target container are first parsed one by one according to the file path tree structure using Doxygen (an open-source, cross-platform documentation system similar to JavaDoc, a tool for generating program files that can convert specific comments in the program into documentation files) and Graphviz (an open-source toolkit for drawing graphs of DOT language script descriptions) to obtain the function call graph files of each function in each node file of the application source code files.

[0073] S22: Based on the function call graph information of each function in the code file, obtain the function information data of the code file.

[0074] Specifically, based on the path tree structure of the source code files, the data in the function call graph file of each function is integrated to obtain a tree-like function graph database for each function.

[0075] S23: Based on the function information data, obtain the first system call information of the target container.

[0076] Specifically, the call graph information of each child node of each function is finally scanned recursively to determine whether it contains system call information. If not, the call graph information of each child node of each function is scanned recursively to determine whether it contains system call information. If it does, the system call information is retrieved from the system call information database.

[0077] It should be noted that, based on the path tree structure of the source code file, the data in the function call graph file of each function is integrated to obtain the tree-like function graph database of each function. Then, function call graph information and file information can be obtained from the tree-like function graph database of each function.

[0078] according to Figure 2 As shown in the flowchart of obtaining system call information, this embodiment first generates a corresponding function call graph for each function in each code file by modifying the Doxygen application and combining it with Graphviz according to the folder tree structure of the application source code files, and stores the function call graph information of the function in a local file; then, it further extracts and aggregates information from the generated function call graph files in a certain way to build a function information database in the form of a trie; finally, it retrieves system call related information from the function information database through information retrieval and graph search, and stores it locally in the form of a database.

[0079] In one optional embodiment of this application, the code file in the target container is parsed, and the function call graph information of each function in the code file can be obtained by further combining the application scenario of the target container.

[0080] The application's source code files contain the relevant system call information required for privilege escalation during normal application operation. For example, in the ngx_epoll_module.c file of the nginx container's source code, three functions are defined: io_getevents, io_setup, and io_destroy, which correspond to the three system calls SYS_io_getevents, SYS_io_setup, and SYS_io_destroy, respectively. These system calls may be called during nginx runtime, may not be called, or may not be called due to business scope factors. Therefore, it is necessary to generate a function call graph corresponding to the code files in the target program based on the actual application scenario of the target container, and then use the function call graph scanning to determine the system call information required by the target container during actual runtime.

[0081] S102: Input the second system call information of the target container into the system call information model to obtain the third system call information of the target container.

[0082] In this embodiment of the application, the second system call information is a portion of the system call information in the target container's system call information.

[0083] By performing static analysis on the source code files of the application in the target container using step 101, the application's file-function information tree and function call graph can be obtained. The application's function call graph provides relevant system call information, thereby revealing all possible privilege escalations in the static code files of the application within the target container. However, during the actual operation of the application in the target container, some static code still lacks the system call information required for actual code execution, necessitating supplementation through dynamic collection of system call information. Given the current abundance and number of containers, manually collecting container system call information is not only inefficient and costly but also requires substantial storage space, making it difficult to meet the needs of actual application deployment on the user side. This application proposes using artificial intelligence to learn and derive system call sequences from normal containers, rapidly expanding container system call information with significantly less storage space required than manual collection. This approach is highly practical, low-cost, and easy to deploy.

[0084] To achieve Figure 3 To rapidly generate system call information for a target container, this application embodiment first collects tens of gigabytes of system call sequence data from different containers, with a training set to test set sample ratio of 8:2. Second, a system call information model is constructed. The encoder in the model extracts the semantic information of the system call sequence context, and the decoder is used to generate the system call sequence, thus completing the training of the system call information model. Finally, the trained system call information model is used in conjunction with relevant search algorithms (such as beam search) to generate derived system call sequences of limited length or semantic meaning based on the input short system call sequence.

[0085] Figure 3 This is a schematic diagram illustrating the training of the system call information model and the generation of derived system call information provided in an embodiment of this application. Figure 3The system call information model consists of three parts: pre-training, construction and training of the model, and generation of derived system call data. The first part captures semantic information of a given small number of system call sequences at a fixed length through pre-training, thereby accelerating the convergence speed of the system call information model construction and training process in the second part and improving the accuracy of the generated model. The second part encodes the given small number of system call sequences to extract deeper semantic information, and combines this with a decoder to achieve complete training of the system call information model, enabling it to fully capture the semantic information of the input small number of system call sequences. The third part, based on the trained system call information model, generates derived system call information frame by frame using the given short sequence of system call information.

[0086] In one optional embodiment of this application, before performing step S103 above, it is necessary to first determine the system call information model. In one embodiment, the system call information model can be obtained through the following steps:

[0087] B1: The fourth system call information based on multiple containers is used to train the system call information model to be trained, thus obtaining the system call information model.

[0088] In this embodiment of the application, the fourth system call information of each of the plurality of containers is a portion of the system call information of that container.

[0089] In this embodiment, system call sequence data from different containers can be collected to form a training sample set and a test sample set. The training sample set is used to train the system call model to be trained, and the test sample set is used to test the accuracy of the derived system call sequence generated by the trained system call model.

[0090] In an optional embodiment of this application, step B1 above can be implemented through the following steps:

[0091] B11: The fourth system call information is processed using a sliding window method that changes the window length to obtain the first call sequence;

[0092] B12: Encode the first call sequence using the encoding network in the system call information model to be trained to obtain the encoded information of the fourth system call information; the encoded information of the fourth system call information includes the semantic information of the fourth system call information;

[0093] B13: Use the decoding network in the system call information model to be trained to decode the encoded information to obtain a second call sequence corresponding to the fourth system call information;

[0094] B14: The system call information model to be trained is trained based on the semantic information and the second call sequence to obtain the system call information model.

[0095] To improve the performance of the system call information model, this application embodiment modifies the form of the input data for the system call information model. Before training the system call information model to be trained, a small number of given system call sequences are processed using a variable window sliding window processing method. The window length can be randomly sampled. While ensuring a certain degree of overlap between windows, this enables the finally trained system call information model to handle variable-length data and allows the system call information model to fully utilize the contextual semantic information of the input data to predict the context of the input data, thereby improving the practicality and generalization of the system call information model.

[0096] In one optional embodiment of this application, the encoding network and decoding network of the system call information model include an attention structure; the masking mechanisms corresponding to the encoding network and the decoding network are different.

[0097] By adding attention architectures to the decoding and encoding networks of the system call information model, and using different mask mechanisms for the encoding and encoding networks, the ability of the system call information model to extract contextual semantic information from the data can be further improved.

[0098] In one optional implementation of this application, the system call information model can be specifically as follows: Figure 4 In one implementation of the network structure shown, the system call information model can be a Seq2Seq model. A Seq2Seq model is a sequence-to-sequence model where both input and output are sequences. The Seq2Seq model performs well for data generation tasks with large datasets.

[0099] In one optional embodiment of this application, before performing step B12 above, the following steps may also be performed:

[0100] C1: The fourth system call information is processed using a sliding window method with a fixed window length to obtain the third call sequence;

[0101] C2: Encode the third call sequence to obtain the encoding information of the third call sequence;

[0102] C3: Input the encoded information of the third call sequence into the word vector model to obtain the word vector of the fourth system call information;

[0103] C4: Embed the word vectors while initializing the embedding layer of the system call model to be trained.

[0104] For complex model architectures, training the model from scratch requires a long training time and may not achieve the expected convergence performance. Pre-trained word embedding weights allow the model to acquire certain semantic information during the initialization phase and select a better direction for the system call information model on the high-dimensional loss plane, effectively improving the model's convergence efficiency. Figure 3 As can be seen, this embodiment first uses a fixed-length sliding window to partially truncate the given system call sequence. To reduce the impact of semantic loss in the truncated portion, a certain overlap is maintained between windows. The system call sequence is encoded and then input into a word vector model (such as the Word2Vec model) for training. After training, the training results are verified, and the better training results are saved. This embodiment initializes the embedding of the system call information model to be trained by using the trained word vector model, enabling the system call information model to obtain semantic information between the given system call sequences, which can accelerate the convergence of the system call information model to be trained.

[0105] In an optional embodiment of this application, step S102 can be implemented through the following steps:

[0106] D1: The second system call information is processed using a sliding window method that changes the window length to obtain the fourth call sequence;

[0107] D2: Input the fourth call sequence into the system call information model to obtain the third system call information of the target container.

[0108] For a given small number of system call sequences, after sliding window processing, the trained system call information model is used to derive the system call sequence frame by frame. Each system call sequence is generated until a specified length is reached or a terminator is encountered. Finally, all generated system call sequences are aggregated to form system call information.

[0109] In this embodiment, the trained system call information model has already learned the semantic information in the given system call sequence data quite well. Since the given system call sequence data is normal operation data of multiple types of containers, according to… Figure 5As can be seen, the system calls used by different containers have varying degrees of similarity, depending on the specific functions that the containers can perform. This application's embodiments, by collecting data from different types of containers, enable the trained system call information model to quickly derive more system call sequences for the target container based on its functional attributes and using only a small portion of the target container's system call data.

[0110] S103: The system call information set consisting of the first system call information and the third system call information is determined as the system call information of the target container.

[0111] In one optional embodiment of this application, after determining the system call information of the target container, the following steps may be performed further:

[0112] E1: Determine the set of permissions for the target container to run based on the system call information of the target container;

[0113] E2: If the target container receives an access message, determine whether to allow the access message to access the target container based on the permission set.

[0114] In this embodiment, step 101 allows for the static acquisition of system call information for the target container. However, this method may result in some static code failing to obtain the system call information required for actual code execution. Step 102 allows for the dynamic acquisition of system call information for the target container, which complements the static acquisition method. By combining the system call information obtained through both methods, a more comprehensive and complete set of system call information for the target container can be obtained. Configuring seccomp based on the system call information obtained through both methods can reduce the attack surface of the target container and improve its security.

[0115] Seccomp is a security mechanism. In operating systems, numerous system calls are directly exposed to user-space programs. However, not all system calls are necessary, and unsafe code abusing system calls can pose a security threat. Seccomp restricts a program's use of certain system calls, thus reducing the system's exposure surface and putting the program into a "safe" state.

[0116] Please see Figure 6 , Figure 6 A block diagram illustrating the method for determining system function call information provided in an embodiment of this application; Figure 6The process comprises three parts. The first and second parts involve dynamically obtaining the derived system call sequences of container m, while the third part involves statically obtaining the system call data of container m. When dynamically obtaining the derived system call sequences of container m, the first step involves training a system call information model using the system call sequences of n containers to obtain a system call information model for system call sequence derivation. Then, the second part uses the trained system call information model to derive a small amount of system call information from container m, resulting in the derived system call sequences. The second part involves statically analyzing the source code files of container m to obtain its system call data. Combining the derived system call sequences obtained in the second part with the system call data obtained in the third part yields a more complete set of system call information for container m. Finally, configuring seccomp based on this system call information set reduces the attack surface of container m and improves its security.

[0117] The technical solution of this application embodiment can, through a combination of dynamic and static approaches, learn and derive the system call sequence of a normal container using artificial intelligence, thereby rapidly expanding the container's system call information. On the other hand, by compiling and processing the relevant code files of the application within the container, it can obtain the relevant system call information required for the normal operation of the application within the container. Combining the above two aspects, complete system call information for the normal operation of the application in the container can be obtained, thereby reducing the attack surface exposed by the container and improving the security of the container through system call management.

[0118] Please see Figure 7 , Figure 7 This is a schematic diagram of a system call information determination device provided in an embodiment of this application, as shown below. Figure 7 The apparatus shown includes:

[0119] The first processing unit 701 is used to process the code file in the target container to obtain the first system call information of the target container;

[0120] The second processing unit 702 is used to input the second system call information of the target container into the system call information model to obtain the third system call information of the target container; the second system call information is a portion of the system call information of the target container.

[0121] The determining unit 703 is used to determine the system call information set composed of the first system call information and the third system call information as the system call information of the target container.

[0122] In an optional embodiment of this application, the first processing unit 701 is specifically configured to: parse the code file in the target container to obtain function call graph information of each function in the code file; obtain function information data of the code file based on the function call graph information of each function in the code file; and obtain the first system call information of the target container based on the function information data.

[0123] In an optional embodiment of this application, the first processing unit 701 is further specifically used to: obtain function call graph information of each function in the code file based on the application scenario of the target container.

[0124] In an optional embodiment of this application, before the second processing unit 702 inputs the second system call information of the target container into the system call information model to obtain the third system call information of the target container, the device further includes:

[0125] Training unit 704 is used to train the system call information model to be trained based on the fourth system call information of multiple containers to obtain the system call information model; wherein, the fourth system call information of each of the multiple containers is a part of the system call information of that container.

[0126] In an optional embodiment of this application, the training unit 704 is specifically configured to: process the fourth system call information using a sliding window processing method with varying window length to obtain a first call sequence; encode the first call sequence using the encoding network in the system call information model to be trained to obtain the encoded information of the fourth system call information; the encoded information of the fourth system call information includes the semantic information of the fourth system call information; decode the encoded information using the decoding network in the system call information model to be trained to obtain a second call sequence corresponding to the fourth system call information; and train the system call information model to be trained based on the semantic information and the second call sequence to obtain the system call information model.

[0127] In an optional embodiment of this application, before the training unit 704 encodes the first call sequence using the encoding network in the system call information model to be trained, the apparatus further includes:

[0128] The third processing unit 705 is used to process the fourth system call information using a sliding window processing method with a fixed window length to obtain a third call sequence; to encode the third call sequence to obtain the encoding information of the third call sequence; to input the encoding information of the third call sequence into a word vector model to obtain the word vector of the fourth system call information; and to embed the word vector while initializing the embedding layer of the system call model to be trained.

[0129] In one optional embodiment of this application, the second processing unit 702 is specifically used to: process the second system call information using a sliding window processing method with varying window length to obtain a fourth call sequence; and input the fourth call sequence into the system call information model to obtain the third system call information of the target container.

[0130] In one optional embodiment of this application, the encoding network and decoding network of the system call information model include an attention structure; the masking mechanisms corresponding to the encoding network and the decoding network are different.

[0131] In one optional embodiment of this application, the apparatus further includes:

[0132] The fourth processing unit 706 is used to determine the set of permissions for the target container to run based on the system call information of the target container; and, when the target container receives an access message, to determine whether to allow the access message to access the target container based on the set of permissions.

[0133] Those skilled in the art should understand that Figure 7 The functions of each unit in the system call information determination device shown can be understood by referring to the relevant description of the aforementioned system call information determination method. Figure 7 The functions of each unit in the system call information determination device shown can be implemented by a program running on a processor or by specific logic circuits.

[0134] This application also provides an electronic device. Figure 8 This is a schematic diagram of the hardware structure of the electronic device according to an embodiment of this application, such as... Figure 8 As shown, the electronic device includes: a communication component 803 for data transmission, at least one processor 801, and a memory 802 for storing computer programs capable of running on the processor 801. The various components in the terminal are coupled together via a bus system 804. It is understood that the bus system 804 is used to implement communication between these components. In addition to a data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in… Figure 8The general labeled all buses as Bus System 804.

[0135] Wherein, when the processor 801 executes the computer program, it performs at least the following: Figure 1 The steps of the method shown.

[0136] It is understood that memory 802 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 802 described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0137] The methods disclosed in the embodiments of this application can be applied to or implemented by processor 801. Processor 801 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 801 or by instructions in software form. The processor 801 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 801 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 802. Processor 801 reads the information in memory 802 and combines its hardware to complete the steps of the aforementioned method.

[0138] In an exemplary embodiment, the electronic device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned call recording method.

[0139] This application also provides a computer-readable storage medium storing a computer program thereon, characterized in that the program, when executed by a processor, is at least used to perform... Figure 1 The steps of the method are shown. The computer-readable storage medium may specifically be a memory. The memory may be, for example... Figure 8 The memory 802 shown.

[0140] The technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0141] In the several embodiments provided in this application, it should be understood that the disclosed methods and smart devices can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0142] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0143] In addition, each functional unit in the various embodiments of this application can be integrated into a second processing unit, or each unit can be a separate unit, or two or more units can be integrated into a unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0144] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for determining system call information, characterized in that, The method includes: The code files in the target container are processed to obtain the first system call information of the target container; the first system call information is the system call information required for the normal operation of the application in the target container, obtained based on static analysis; The second system call information of the target container is input into the system call information model to obtain the third system call information of the target container; the second system call information is a portion of the system call information of the target container obtained by dynamic acquisition; the third system call information is extended system call information derived from the second system call information. The system call information set consisting of the first system call information and the third system call information is determined as the system call information of the target container.

2. The method according to claim 1, characterized in that, The process of processing the code files in the target container to obtain the first system call information of the target container includes: The code files in the target container are parsed to obtain the function call graph information of each function in the code files; Based on the function call graph information of each function in the code file, the function information data of the code file is obtained; Based on the function information data, the first system call information of the target container is obtained.

3. The method according to claim 2, characterized in that, The process of obtaining the function call graph information for each function in the code file includes: Based on the application scenario of the target container, the function call graph information of each function in the code file is obtained.

4. The method according to claim 1, characterized in that, Before inputting the second system call information of the target container into the system call information model to obtain the third system call information of the target container, the method further includes: The system call information model to be trained is obtained by using the fourth system call information of multiple containers; wherein, the fourth system call information of each of the multiple containers is a part of the system call information of that container.

5. The method according to any one of claims 1 to 4, characterized in that, The step of inputting the second system call information of the target container into the system call information model to obtain the third system call information of the target container includes: The second system call information is processed using a sliding window method that changes the window length to obtain the fourth call sequence; The fourth call sequence is input into the system call information model to obtain the third system call information of the target container.

6. The method according to any one of claims 1 to 4, characterized in that, The system call information model includes an attention structure in its encoding and decoding networks; the masking mechanisms corresponding to the encoding and decoding networks are different.

7. The method according to any one of claims 1 to 4, characterized in that, The method further includes: The set of permissions for running the target container is determined based on the system call information of the target container; When the target container receives an access message, it determines whether to allow the access message to access the target container based on the permission set.

8. A system call information determination device, characterized in that, The device includes: The first processing unit is used to process the code files in the target container to obtain the first system call information of the target container; the first system call information is the system call information required for the normal operation of the application in the target container, obtained based on static analysis. The second processing unit is used to input the second system call information of the target container into the system call information model to obtain the third system call information of the target container; the second system call information is a portion of the system call information of the target container obtained by dynamic acquisition; the third system call information is extended system call information derived from the second system call information. The determining unit is configured to determine the system call information set consisting of the first system call information and the third system call information as the system call information of the target container.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, wherein the memory stores computer-executable instructions, and the processor, when executing the computer-executable instructions in the memory, can implement the method of any one of claims 1 to 7.

10. A computer storage medium, characterized in that, The storage medium stores executable instructions that, when executed by a processor, implement the method of any one of claims 1 to 7.

Images