A container flow collection method, device, storage medium and equipment

Abstract

The embodiment of the present application provides a container traffic collection method, device, storage medium and equipment. In this method, a client deployed on a Linux host obtains a collection strategy issued by a server, and according to the collection strategy, performs container traffic collection on the veth‑pair virtual network card of the container to be collected on the Linux host, and reports the collected container traffic to the detection system. In this way, not only various container deployment methods are supported, but also separate traffic collection rules are configured for each container to be collected, which makes the configuration more flexible and rich, and easy to standardize and commercialize.

Description

Technical Field

[0001] The present application relates to the field of container technology, and in particular to a container flow collection method, a container flow collection device, a storage medium, and an electronic device. Background Art

[0002] With the development of container technology, especially with the large-scale container cluster management system, such as kubernetes (K8S for short), which is called IT infrastructure, more and more business systems are deployed in containers. Traditional intrusion detection tools based on network traffic cannot collect container traffic, making container traffic a detection blind spot, threatening the security of business systems.

[0003] In related technologies, the way to collect container traffic is generally related to the container deployment method. For example, when deployed through Docker, the Docker0 virtual bridge is collected; when deployed through K8S, the virtual bridge created by the K8S network module, such as the Cni0 bridge, is used to capture packets. This method is not universal enough and is difficult to make into a standardized product. In addition, it is impossible to configure collection rules for a single container, which is not conducive to productization. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a container flow collection method, device, storage medium and equipment, aiming to solve the problems that the solutions for collecting container flow in the related art are not universal enough, cannot configure separate collection rules for a single container, and are difficult to standardize and commercialize.

[0005] In a first aspect, an embodiment of the present application provides a container traffic collection method, which is applied to a client deployed on a Linux host, where at least one container is running on the Linux host, and the method includes:

[0006] Obtaining the collection strategy issued by the server, wherein the collection strategy includes the container to be collected and the corresponding traffic collection rules;

[0007] According to the collection strategy, the corresponding traffic collection rule is applied to collect container traffic from the veth-pair virtual network card of the container to be collected;

[0008] The collected container flow is sent to the detection system.

[0009] In the above implementation process, the client deployed on the Linux host obtains the collection strategy issued by the server, and collects container traffic on the veth-pair virtual network card of the container to be collected on the Linux host according to the collection strategy, and reports the collected container traffic to the detection system. In this way, not only various container deployment methods are supported, but also separate traffic collection rules can be configured for each container to be collected, which makes the configuration more flexible and rich, and easy to standardize and productize.

[0010] Furthermore, in some embodiments, the collection strategy carries container asset information of the container to be collected, and the container asset information includes at least one of the following:

[0011] Container ID, container name, MAC address, IP address, and veth-pair virtual network card name.

[0012] In the above implementation process, the type of container asset information is limited to facilitate the client to determine the container to be collected.

[0013] Furthermore, in some embodiments, the container asset information is obtained by the server through an API provided by a container deployment platform; and / or, the container asset information is reported by the client to the server.

[0014] In the above implementation process, a specific method for collecting container asset information is provided to improve the integrity of the collected container asset information.

[0015] Further, in some embodiments, applying corresponding traffic collection rules to collect container traffic on the veth-pair virtual network card of the container to be collected according to the collection strategy includes:

[0016] Determine the veth-pair virtual network card of the container to be collected according to the container asset information;

[0017] The corresponding traffic collection rule is applied to collect the container traffic of the veth-pair virtual network card.

[0018] In the above implementation process, the veth-pair virtual network card corresponding to the container to be collected is determined according to the container asset information in the collection strategy, so as to collect the container traffic and implement the collection accurately according to the configuration.

[0019] Furthermore, in some embodiments, the traffic collection rule includes at least one of the following:

[0020] BPF filtering rules and rate limit thresholds.

[0021] In the above implementation process, the productization of the collection technology is facilitated by configuring the BPF filtering rules and / or the rate limit threshold.

[0022] Furthermore, in some embodiments, the method further comprises:

[0023] The container traffic of each container is counted, and the statistical result is reported to the server.

[0024] In the above implementation process, a statistical function for container traffic of each container is provided. After the client reports the statistical results to the server, it can provide a reference for the user to configure the collection strategy and provide data support for adjusting a more reasonable collection strategy.

[0025] Furthermore, in some embodiments, the traffic collection rules are configured based on the following methods:

[0026] If the container traffic of any container to be collected is statistically greater than a first preset threshold, the BPF filtering rule configured for the container to be collected includes at least one of a specified IP address, a specified port, and a specified protocol;

[0027] If the container flow of any container to be collected is obtained by statistics and does not exceed the second preset threshold, the BPF filtering rule configured for the container to be collected is empty.

[0028] In the above implementation process, a specific method of adjusting the traffic collection rules according to the statistical results is provided to meet the balance between the data collection requirements and the bandwidth restrictions during container traffic detection, so that the adjusted collection strategy is more reasonable.

[0029] Furthermore, in some embodiments, the server provides a configuration interface, and the configuration interface is used for the user to configure the collection strategy.

[0030] In the above implementation process, users can configure the collection strategy on the server to realize personalized configuration of the collection strategy and meet user customization needs.

[0031] Furthermore, in some embodiments, sending the collected container flow to the detection system includes:

[0032] The collected container traffic is encapsulated into VXLAN format or GRE format and sent to the detection system.

[0033] In the above implementation process, the client performs VXLAN / GRE encapsulation on the collected container traffic so that the encapsulated container traffic can be transmitted to the detection system.

[0034] Furthermore, in some embodiments, the method further comprises:

[0035] When a new collection strategy sent by the server is obtained, the traffic collection rules in the new collection strategy are applied to collect container traffic for the veth-pair virtual network card of the container to be collected in the new collection strategy.

[0036] In the above implementation process, when the user configures a new collection strategy, the client collects container traffic according to the new collection strategy, which is convenient for the user to adjust the collection strategy and improve the user experience.

[0037] In a second aspect, an embodiment of the present application provides a container traffic collection device, which is applied to a client deployed on a Linux host, where at least one container is running, and the device includes:

[0038] An acquisition module is used to acquire a collection strategy issued by a server, wherein the collection strategy includes a container to be collected and corresponding traffic collection rules;

[0039] A collection module, used to collect container traffic from the veth-pair virtual network card of the container to be collected according to the collection strategy and applying corresponding traffic collection rules;

[0040] The sending module is used to send the collected container flow to the detection system.

[0041] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0042] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0043] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method as described in any one of the first aspects.

[0044] Other features and advantages disclosed in the present application will be described in the following description, or some features and advantages can be inferred or determined without doubt from the description, or can be learned by implementing the above-mentioned technology disclosed in the present application.

[0045] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A flow chart of a container flow collection method provided in an embodiment of the present application;

[0048] Figure 2 A schematic diagram of the overall architecture of a container flow collection system provided in an embodiment of the present application;

[0049] Figure 3 A block diagram of a container flow collection device provided in an embodiment of the present application;

[0050] Figure 4 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0052] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0053] As described in the background technology, the solution for collecting container flow in the related art has the problem of being difficult to standardize and commercialize. Based on this, the embodiment of the present application provides a solution for collecting container flow to solve this problem.

[0054] Next, the embodiments of the present application are introduced:

[0055] like Figure 1 As shown, Figure 1It is a flowchart of a container traffic collection method provided by an embodiment of the present application, and the method can be applied to a client deployed on a Linux host. The Linux host here can be a host configured with an operating system based on the Linux kernel, which can be a physical machine or a virtual machine; wherein the operating system based on the Linux kernel can be any one of CentOS, Debian, Ubuntu, etc. In this embodiment, at least one container is running on the Linux host, and a container contains a complete runtime environment. In addition to the application itself, the dependencies, class libraries, other binary files, and configuration files required by the application are all uniformly packed into a package called a container image. Through containerization, the differences caused by the operating system release version and other basic environments are abstracted away. When multiple containers are running on the Linux host, the processes in these containers are isolated from each other and cannot perceive each other. The upgrade or failure of one container will not affect other containers. The client here is an application that executes the method steps of this embodiment, which is used to collect container traffic.

[0056] The method comprises:

[0057] In step 101, a collection strategy issued by a server is obtained, wherein the collection strategy includes a container to be collected and corresponding traffic collection rules;

[0058] The server mentioned in this step can be a program corresponding to the client and providing services to the client. The server can be deployed on a container deployment platform to send services of corresponding collection strategies to each Linux host. The server can communicate with the client based on HTTP (Hyper Text Transfer Protocol) or other methods.

[0059] In this embodiment, the server sends a collection strategy to the client, and the collection strategy includes the container to be collected and the corresponding traffic collection rules. That is, the collection strategy here indicates the container to be collected and the specific rules for collecting the container traffic of the container. The container to be collected can be all or part of the containers on the Linux host. For example, when there are two containers running on the Linux host, the container to be collected can be these two containers or any one of them.

[0060] In order to facilitate the client to determine the container to be collected, in some embodiments, the collection strategy can carry the container asset information of the container to be collected, and the container asset information can include at least one of the following: container ID, container name, MAC address, IP address, veth-pair virtual network card name. Taking Docker as an example, when creating a container, Docker will automatically generate a random name for the container, create a container ID for the container, and use the IP address assigned to the container to generate a MAC address to avoid ARP conflicts; veth-pair is a pair of virtual device interfaces. In the Linux system, the network card of the container is created through the veth-pair virtual network device. The network card of the container is one end of the veth-pair. The Linux host has a virtual network card corresponding to the other end of the veth-pair. The network traffic sent and received when the container is running will pass through the veth-pair virtual network card corresponding to the Linux host. This embodiment uses this principle to collect the veth-pair virtual network card name as the container asset information, so as to determine the veth-pair virtual network card corresponding to the container to be collected, and then collect the container traffic. Of course, in other embodiments, the container asset information can also include other information, which is not limited by this application.

[0061] Furthermore, in some embodiments, the container asset information can be obtained by the server through the API provided by the container deployment platform; and / or, the container asset information is reported to the server by the client. The container deployment platform records some relevant information of the containers running on each Linux host. Therefore, the server can query and collect a certain degree of container asset information through the API provided by the container deployment platform. The client is deployed on the Linux host, and it can collect some relevant information of the container running on the Linux host. Therefore, the report from the client can also enable the server to obtain a certain degree of container asset information. Preferably, these two collection methods can be carried out simultaneously to improve the integrity of the collected container asset information. Of course, in other embodiments, other collection methods can also be used.

[0062] The traffic collection rules mentioned in this step are filtering rules and / or restriction rules when the client collects container traffic. In some embodiments, the traffic collection rules may include at least one of the following: BPF filtering rules and speed limit thresholds. BPF (Berkeley Packet Filter) is a primitive interface of the data link layer on a Unix-like system, which provides the sending and receiving of primitive link layer packets and supports filtering of data packets. The setting of BPF filtering rules allows the network device to only capture network data packets of interest to the user, such as data packets sent and received through a specified port, data packets based on a specified protocol, etc.; if the BPF filtering rules are not set, the network device will capture all types of data packets. The speed limit threshold is the critical value of the container traffic normally collected by the client. For containers with large traffic, the external network bandwidth limit sent to the detection system needs to be considered during the actual collection process. Therefore, the speed limit threshold is set. When the container traffic collected within a certain period of time reaches the speed limit threshold, the client reduces the frequency of collecting container traffic or even temporarily stops collecting container traffic. By configuring the BPF filtering rules and / or speed limit thresholds, the productization of the collection technology is facilitated. In addition, in other embodiments, the traffic collection rules may also include other contents, such as the collection interval time, etc.

[0063] In addition, in some embodiments, the server can provide a configuration interface, and the configuration interface can be used by the user to configure the collection strategy. That is to say, after the server collects the container asset information, the user can configure the collection strategy on the server, specify the container to be collected and the corresponding traffic collection rules. For example, there are three containers running on the Linux host, namely container 1, container 2 and container 3. The user can configure the server to collect only container 1 and container 3, and for container 1, only the data packets sent and received by the specified port can be configured as the traffic collection rule, and for container 3, only the data packets based on the specified protocol can be configured as the traffic collection rule. In this way, personalized configuration of the collection strategy is achieved to meet user customization needs.

[0064] In step 102, according to the collection strategy, the corresponding traffic collection rule is applied to collect container traffic from the veth-pair virtual network card of the container to be collected;

[0065] Container traffic refers to the network traffic sent and received when the container is running, and container traffic collection is to collect the data packets sent and received when the container is running. For the client, it cannot directly collect the network traffic sent and received by the network card in the container. However, this embodiment uses the principle that the network traffic sent and received when the container is running will pass through the corresponding veth-pair virtual network card, and applies the traffic collection rules in the collection strategy to collect container traffic from the veth-pair virtual network card of the collection container, thereby realizing universal container traffic collection.

[0066] Specifically, in some embodiments, this step may include: determining the veth-pair virtual network card of the container to be collected according to the container asset information carried in the collection strategy; applying the corresponding traffic collection rules to collect the container traffic of the veth-pair virtual network card. In other words, the client can determine the container to be collected according to the container asset information carried in the collection strategy, and determine the veth-pair virtual network card corresponding to the container, and then apply the corresponding traffic collection rules to capture packets, thereby realizing the collection of container traffic. It should be noted that when the veth-pair virtual network card name is not included in the container asset information, the client can query the corresponding veth-pair virtual network card name according to other container asset information, such as the IP address of the container to be collected, and then determine the veth-pair virtual network card corresponding to the container to be collected.

[0067] The client collects data from the veth-pair virtual network cards of different containers according to the collection strategy, and applies different BPF filtering rules and / or rate limit thresholds. Using the previous example, after receiving the collection strategy, the client collects data from the veth-pair virtual network card of container 1, and only captures data packets sent and received by the specified port; does not collect data from the veth-pair virtual network card of container 2; collects data from the veth-pair virtual network card of container 3, and only captures data packets based on the specified protocol.

[0068] In this embodiment, the user configures the collection strategy on the server side, and the client collects container traffic according to the collection strategy. It does not rely on specific modules of the container deployment platform. Therefore, it is a universal container traffic collection method that supports various container deployment methods, including but not limited to Docker deployment and K8S deployment, and is therefore easy to standardize and productize.

[0069] In step 103, the collected container flow is sent to a detection system.

[0070] The detection system mentioned in this step is a tool for statistically analyzing network traffic and detecting malicious or suspicious traffic, thereby ensuring the security of the business system. Optionally, the detection system can be a NIDS (Network Intrusion Detection System). NIDS refers to a combination of software and hardware that detects behaviors that endanger the security of computer systems, such as collecting vulnerability information, causing access denial, and obtaining system control rights beyond the legal scope. After the client sends the collected container traffic to NIDS, NIDS provides these container traffic as data to its IDS analysis engine component, which uses statistics or rules to find possible intrusion behaviors and provides events to its response component, and then the response component takes corresponding actions, such as actively notifying the system administrator, interrupting the intruder's connection, and searching for intrusion information. Of course, in other embodiments, the detection system can also be other types of network traffic detection tools, and this application does not limit this.

[0071] Specifically, in some embodiments, this step may include: encapsulating the collected container traffic into VXLAN format or GRE format, and then sending it to the detection system. VXLAN (Virtual Extensible Local Area Network) format is a network data packet encapsulation format, and its message encapsulation is to encapsulate the Layer 2 Ethernet frame into a UDP packet, and then add a VXLAN header to identify different Layer 2 networks. GRE (Generic Routing Encapsulation) format is also a network data packet encapsulation format, which provides a mechanism for encapsulating messages of one protocol in messages of another protocol, and is a Layer 3 tunnel encapsulation technology. Every time a message is collected by the client, it is encapsulated by VXLAN / GRE so that the encapsulated message can be transmitted to the detection system. Of course, in other embodiments, other encapsulation formats may also be used, and this application does not limit this.

[0072] Furthermore, in some embodiments, the above method may also include: counting the container flow of each container, and reporting the statistical results to the server. That is, in addition to the function of collecting container flow, the client can also provide a statistical function for the container flow of each container. After the client reports the statistical results to the server, it can provide a reference for the user to configure the collection strategy. For example, for containers with large flow, a more stringent speed limit threshold can be set, and for containers with small flow, a more relaxed speed limit threshold can be set. In this way, data support is provided for adjusting a more reasonable collection strategy.

[0073] Furthermore, in some embodiments, the traffic collection rule can be configured based on the following method: if the container traffic of any container to be collected is obtained by statistics and exceeds the first preset threshold, the BPF filtering rule configured for the container to be collected includes at least one of a specified IP address, a specified port, and a specified protocol; if the container traffic of any container to be collected is obtained by statistics and does not exceed the second preset threshold, the BPF filtering rule configured for the container to be collected is empty. That is, when the container traffic of any container to be collected in the statistical results of the client exceeds the preset upper limit value, it indicates that the current traffic of the container to be collected is large. At this time, a more stringent filtering rule can be configured so that when the client collects the veth-pair virtual network card of the container to be collected, the original traffic can be filtered according to the specified IP address, the specified port, the specified protocol, etc.; and when the container traffic of any container to be collected in the statistical results of the client does not exceed the preset lower limit value, it indicates that the current traffic of the container to be collected is small. At this time, the corresponding BPF filtering rule can be configured to be empty, so that when the client collects the veth-pair virtual network card of the container to be collected, all types of data packets can be captured. In this way, the balance between data collection requirements and bandwidth limitations during container flow detection is met, making the adjusted collection strategy more reasonable. Among them, the first preset threshold and the second preset threshold can be set according to the needs of the specific scenario, and this application does not limit this.

[0074] In addition, in actual applications, users often have the need to change collection strategies. Therefore, in some embodiments, the above method may also include: when a new collection strategy issued by the server is obtained, the traffic collection rules in the new collection strategy are applied to collect container traffic for the veth-pair virtual network card of the container to be collected in the new collection strategy. In other words, when the user configures a new collection strategy, such as adding a need to collect container traffic for a certain container, the client replaces the original collection strategy with the new collection strategy, and then collects container traffic according to the new collection strategy. In this way, it is convenient for users to adjust the collection strategy and improve the user experience.

[0075] In the embodiment of the present application, the client deployed on the Linux host obtains the collection strategy issued by the server, and according to the collection strategy, the container traffic is collected on the veth-pair virtual network card of the container to be collected on the Linux host, and the collected container traffic is reported to the detection system. In this way, not only various container deployment methods are supported, but also separate traffic collection rules are configured for each container to be collected, which makes the configuration more flexible and rich, and easy to standardize and productize.

[0076] In order to explain the solution of this application in more detail, a specific embodiment is introduced below:

[0077] like Figure 2 As shown, Figure 2 It is a schematic diagram of the overall architecture of a container traffic collection system provided in an embodiment of the present application, wherein the system includes a Linux host 21, a collection control server 22 and a NIDS 23, wherein three containers are running on the Linux host 21, namely, container 1, container 2 and container 3 (numbered 241, 242, 243 in the figure), and each container has a corresponding veth-pair virtual network card on the Linux host (numbered 251, 252, 253 in the figure); a collector 26 is also running on the Linux host 21.

[0078] Specifically, the workflow of the system for collecting container traffic includes:

[0079] S201, the collection control server 22 collects container asset information, including the container ID, name, MAC address, IP address, veth-pair virtual network card name, etc.;

[0080] There are many methods for the collection control server 22 to collect container asset information, including but not limited to obtaining through API, reporting by the collector 26, etc.;

[0081] S202, the user configures a collection strategy on the collection control server 22, where the collection strategy includes the container to be collected and the corresponding BPF filtering rules, rate limit threshold, etc.;

[0082] The container to be collected can be all or part of the three containers. Different containers can correspond to different BPF filtering rules and different rate limit thresholds.

[0083] S203, the collection control server 22 sends the collection strategy to the collector 26;

[0084] S204, the collector 26 collects the veth-pair virtual network cards of different containers according to the collection strategy, and applies different BPF filtering rules and speed limit thresholds, etc.;

[0085] S205, after the collector 26 collects the container traffic, it performs VXLAN / GRE encapsulation and then sends it to NIDS23.

[0086] As can be seen from the above, the embodiment of the present application provides a general container traffic collection method, which collects the veth-pair virtual network card of each container on the Linux host, and supports various container deployment methods. Moreover, the user can configure the collection rules based on the container granularity, such as setting BPF filtering rules and speed limit thresholds for specific container collection. The configuration is more flexible and rich, and easier to standardize and productize.

[0087] Corresponding to the embodiments of the aforementioned method, the present application also provides embodiments of a container flow collection device and a terminal used therein:

[0088] like Figure 3 As shown, Figure 3 : is a block diagram of a container traffic collection device provided in an embodiment of the present application, the device is applied to a client deployed on a Linux host, at least one container is running on the Linux host, and the device includes:

[0089] An acquisition module 31 is used to acquire a collection strategy issued by a server, wherein the collection strategy includes a container to be collected and a corresponding flow collection rule;

[0090] A collection module 32 is used to collect container traffic from the veth-pair virtual network card of the container to be collected according to the collection strategy and the corresponding traffic collection rule;

[0091] The sending module 33 is used to send the collected container flow to the detection system.

[0092] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0093] This application also provides an electronic device, see Figure 4 , Figure 4 A block diagram of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 410, a communication interface 420, a memory 430, and at least one communication bus 440. The communication bus 440 is used to realize direct connection and communication between these components. The communication interface 420 of the electronic device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 410 may be an integrated circuit chip with signal processing capabilities.

[0094] The processor 410 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 410 can also be any conventional processor, etc.

[0095] The memory 430 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electric erasable programmable read-only memory (EEPROM), etc. The memory 430 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 410, the electronic device can execute the above-mentioned Figure 1 The method embodiment involves various steps.

[0096] Optionally, the electronic device may further include a storage controller and an input / output unit.

[0097] The memory 430, storage controller, processor 410, peripheral interface, input and output unit components are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses 440. The processor 410 is used to execute executable modules stored in the memory 430, such as software function modules or computer programs included in the electronic device.

[0098] The input and output unit is used to provide users with the task creation and to create a start optional time period or preset execution time for the task to realize the interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0099] Understandably, Figure 4 The structure shown is for illustration only, and the electronic device may also include Figure 4 More or fewer components as shown, or with Figure 4 Different configurations shown. Figure 4 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0100] An embodiment of the present application further provides a storage medium having instructions stored thereon. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described here.

[0101] The present application also provides a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0102] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0104] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0105] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0106] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0107] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A container flow collection method, characterized in that: Applied to a client deployed on a Linux host, where at least one container is running, the method includes: Obtaining a collection strategy issued by a server, wherein the collection strategy includes a container to be collected and a corresponding flow collection rule; the server provides a configuration interface, wherein the configuration interface is used for a user to configure the collection strategy; According to the collection strategy, the corresponding traffic collection rules are applied to collect container traffic from the veth-pair virtual network card of the container to be collected; the veth-pair virtual network card of the container to be collected is one end of the veth-pair; the veth-pair is a pair of virtual device interfaces, and the Linux host has a virtual network card corresponding to the other end of the veth-pair; the network traffic sent and received when the container is running passes through the veth-pair virtual network card corresponding to the Linux host; The collected container flow is sent to the detection system.

2. The method according to claim 1, characterized in that The collection strategy carries the container asset information of the container to be collected, and the container asset information includes at least one of the following: Container ID, container name, MAC address, IP address, and veth-pair virtual network card name.

3. The method according to claim 2, characterized in that The container asset information is obtained by the server through an API provided by a container deployment platform; and / or, the container asset information is reported to the server by the client.

4. The method according to claim 2, characterized in that: The step of applying corresponding traffic collection rules to collect container traffic on the veth-pair virtual network card of the container to be collected according to the collection strategy includes: Determine the veth-pair virtual network card of the container to be collected according to the container asset information; The corresponding traffic collection rule is applied to collect the container traffic of the veth-pair virtual network card.

5. The method according to claim 1, characterized in that The traffic collection rule includes at least one of the following: BPF filtering rules and rate limit thresholds.

6. The method according to claim 5, characterized in that The method further comprises: The container traffic of each container is counted, and the statistical result is reported to the server.

7. The method according to claim 6, characterized in that The traffic collection rules are configured based on the following: If the container traffic of any container to be collected is statistically greater than a first preset threshold, the BPF filtering rule configured for the container to be collected includes at least one of a specified IP address, a specified port, and a specified protocol; If the container flow of any container to be collected is obtained by statistics and does not exceed the second preset threshold, the BPF filtering rule configured for the container to be collected is empty.

8. The method according to claim 1, characterized in that The step of sending the collected container flow to the detection system includes: The collected container traffic is encapsulated into VXLAN format or GRE format and sent to the detection system.

9. The method according to claim 1, characterized in that: The method further comprises: When a new collection strategy sent by the server is obtained, the traffic collection rules in the new collection strategy are applied to collect container traffic for the veth-pair virtual network card of the container to be collected in the new collection strategy.

10. A container flow collection device, characterized in that: Applied to a client deployed on a Linux host, where at least one container is running, the device comprises: An acquisition module is used to acquire a collection strategy issued by a server, wherein the collection strategy includes a container to be collected and corresponding traffic collection rules; the server provides a configuration interface, wherein the configuration interface is used for a user to configure the collection strategy; A collection module is used to collect container traffic from the veth-pair virtual network card of the container to be collected according to the collection strategy and the corresponding traffic collection rules; the veth-pair virtual network card of the container to be collected is one end of the veth-pair; the veth-pair is a pair of virtual device interfaces, and the Linux host has a virtual network card corresponding to the other end of the veth-pair; the network traffic sent and received when the container is running passes through the veth-pair virtual network card corresponding to the Linux host; The sending module is used to send the collected container flow to the detection system.

11. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

12. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 9 when executing the computer program.

Images