Methods, systems, terminals, and storage media for detecting reverse shells within Docker containers

Abstract

This invention relates to the field of computer technology, specifically to a method, system, terminal, and storage medium for detecting reverse shells within Docker containers. The method includes the following steps: determining whether the current process is engaging in reverse shell behavior; determining whether the process engaging in reverse shell behavior contains containerd-shim; if so, it indicates that a reverse shell has occurred within a Docker container; and outputting an alarm signal indicating that the process engaging in reverse shell behavior within the container has occurred. This invention quickly detects reverse shell behavior within Docker containers by determining whether the current process is engaging in reverse shell behavior and then determining whether the process engaging in reverse shell behavior contains containerd-shim; if so, it indicates that a reverse shell has occurred within a Docker container. This method is simpler and more practical than more complex detection methods.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, system, terminal, and storage medium for detecting reverse shells within Docker containers. Background Technology

[0002] Docker is an open-source application container engine that allows developers to package their applications and dependencies into a portable image, which can then be deployed to machines running any popular Linux or Windows operating system, effectively achieving virtualization. Containers are completely sandboxed and have no interfaces with each other.

[0003] Reverse shells are currently a nightmare for computer data centers, and attacks targeting Docker containers are constantly increasing. Every year, a large number of enterprise or organization data centers are affected, damaging their fundamental interests. At present, there are relatively few detection methods for reverse shells within Docker containers on the market, and the existing technologies are also quite complex, so the interception effect is not ideal. Summary of the Invention

[0004] To address the technical problems existing in the prior art, this invention provides a method, system, terminal, and storage medium for detecting reverse shells within Docker containers. This method quickly detects reverse shell behavior within Docker containers and is simpler and more practical than more complex detection methods.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] In a first aspect, one embodiment of the present invention provides a method for detecting a reverse shell within a Docker container, the method comprising the following steps:

[0007] Determine if the current process is attempting a reverse shell.

[0008] Determine if the process that caused the reverse shell behavior contains containerd-shim; if so, it indicates that a reverse shell behavior has occurred inside the Docker container.

[0009] Output an alert signal indicating a reverse shell occurred within the process container.

[0010] As a further aspect of the present invention, determining whether the current process is a reverse shell operation includes the following steps:

[0011] Get the initial process ID and current process ID of the current process's process space;

[0012] Determine whether a process has engaged in reverse shell behavior by checking if the initial process ID and the current process ID are consistent.

[0013] As a further aspect of the present invention, the step of determining whether a process has engaged in reverse shell behavior based on whether the initial process ID and the current process ID are consistent includes:

[0014] Check if the initial process ID and the current process ID are the same. If they are not the same, check if an abnormal file has been generated. If it has, then the process has engaged in reverse shell behavior.

[0015] As a further embodiment of the present invention, the exception file is a socket, which is stored in a file under the / proc / pid / fd directory.

[0016] As a further aspect of the present invention, the step of determining whether the process in which the reverse shell behavior occurred contains containerd-shim, and if so, indicating that a reverse shell behavior within a Docker container has occurred, includes:

[0017] By checking the current process ID, you can view the current process status in / proc / pid / status. If the process status contains containerd-shim, it indicates that the current process has triggered a reverse shell within the Docker container.

[0018] As a further aspect of the present invention, the containerd in the Docker container is started and managed by containerd-shim.

[0019] Secondly, in another embodiment provided by the present invention, a detection system for reverse shell within a Docker container is provided, the system comprising: a first judgment module, a second judgment module, and an alarm module;

[0020] The first judgment module is used to determine whether the current process is a reverse shell operation;

[0021] The second judgment module is used to determine whether the process that caused the reverse shell behavior contains containerd-shim. If so, it means that a reverse shell behavior has occurred inside the Docker container.

[0022] The alarm module is used to output an alarm signal when a reverse shell occurs within a process container.

[0023] As a further embodiment of the present invention, the first judgment module includes a data acquisition unit and a judgment subunit;

[0024] The data acquisition unit is used to acquire the initial process ID and the current process ID of the process space of the current process;

[0025] The judgment subunit is used to determine whether a process has engaged in reverse shell behavior based on whether the initial process ID and the current process ID are consistent.

[0026] Thirdly, in another embodiment provided by the present invention, a terminal is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor loads and executes the computer program to implement the steps of a method for detecting a reverse shell within a Docker container.

[0027] Fourthly, in another embodiment of the present invention, a storage medium is provided storing a computer program, which, when loaded and executed by a processor, implements the steps of the method for detecting a reverse shell within the Docker container.

[0028] The technical solution provided by this invention has the following beneficial effects:

[0029] The present invention provides a method, system, terminal, and storage medium for detecting reverse shells within Docker containers. By determining whether the current process is engaging in reverse shell behavior, and then determining whether the process engaging in reverse shell behavior contains containerd-shim, it indicates that a reverse shell behavior has occurred within a Docker container. This method quickly detects reverse shell behavior within Docker containers and is relatively simple and practical compared to more complex detection methods.

[0030] These or other aspects of the invention will become more apparent from the following description of embodiments. It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating a method for detecting a reverse shell within a Docker container according to an embodiment of the present invention;

[0033] Figure 2This is a structural block diagram of a Docker container reverse shell detection system according to an embodiment of the present invention;

[0034] Figure 3 This is a structural block diagram of the first judgment module in a Docker container reverse shell detection system according to an embodiment of the present invention;

[0035] Figure 4 This is a structural block diagram of a terminal according to an embodiment of the present invention.

[0036] In the diagram: First judgment module-100, Second judgment module-200, Alarm module-300, Data acquisition unit-101, Judgment subunit-102, Processor-401, Communication interface-402, Memory-403, Communication bus-404. Detailed Implementation

[0037] Various embodiments and / or forms are described below with reference to the accompanying drawings. In the following description, numerous specific details are disclosed for illustrative purposes to provide a general understanding of more than one form. However, those skilled in the art will understand that these forms can be implemented without specific details. Specific examples of more than one form will be described in detail in the following description and drawings. However, these forms are merely illustrative and may utilize a portion of the principles and methods of various forms; the descriptions are intended to encompass all forms and their equivalents. Specifically, the terms "embodiment," "example," "form," "illustration," etc., as used in this specification can be interpreted as meaning that any form or design described may be better or more advantageous than other forms or designs.

[0038] Furthermore, various forms and characteristics can be embodied in systems that include more than one device, terminal, server, equipment, component, and / or module. It should be understood and recognized that various systems may include additional devices, terminals, servers, equipment, components, and / or modules, and / or may not include all of the multiple devices, terminals, servers, equipment, components, and modules shown in the figure.

[0039] The terms "computer program," "component," "module," and "system" used in this specification are used interchangeably, and "computer" refers to related entities, hardware, firmware, software, combinations of software and hardware, or the execution of software. For example, a component can be a process executing on a processor, a processor, an object, a thread of execution, a program, and / or a computer, but is not limited thereto. For example, it can be an application program executing on a computer device and / or all components of the computing device. More than one component can be installed within a processor and / or a thread of execution. A component can be localized within a single computer. A component can also be distributed between two or more computers.

[0040] Furthermore, these components can be executed by various computer-readable media constructed to internally store various data. These components, for example, can communicate locally and / or remotely based on signals having more than one data packet (e.g., data emitted by a component interacting with other components on a local system or a distributed system, and data transmitted to other systems via networks such as the Internet).

[0041] Hereinafter, regardless of the symbols used in the drawings, the same or similar constituent elements will be assigned the same symbols, and repeated descriptions of these elements will be omitted. Furthermore, when describing the embodiments disclosed in this specification, detailed descriptions of well-known technologies will be omitted if it is determined that such detailed descriptions would obscure the essence of the invention. Moreover, the accompanying drawings are only for easier understanding of the embodiments disclosed in this specification, and the technical concepts disclosed in this specification are not limited to the drawings.

[0042] The terminology used in this specification is for illustrative purposes and not for limiting the invention. Unless otherwise specified, the singular includes the plural. The use of “comprises” and / or “comprising” in this specification does not exclude the presence or addition of more than one other constituent element in addition to the mentioned constituent elements.

[0043] The terms "first," "second," etc., can be used to describe various elements or components, but the elements or components are not limited to those terms. The terms are used to distinguish one element or component from others. Therefore, the first element or component mentioned below can also be a second element or component within the technical concept of this invention.

[0044] Unless otherwise defined, all terms used in this specification (including technical and scientific terms) are to be understood in the sense commonly understood by one of ordinary skill in the art to which this invention pertains. Furthermore, terms defined in commonly used dictionaries should not be interpreted ideally or excessively unless specifically defined otherwise.

[0045] Furthermore, the term "or" does not mean exclusive "or" but inclusive "or". That is, unless otherwise specific or contextually ambiguous, "X uses A or B" implies one of the natural connotations. That is, "X uses A or B" can be any of the above when X uses A or B; X uses B or X uses both A and B. And it should be understood that the term "and / or" as used in this specification refers to all possible combinations of more than one of the related items listed.

[0046] In addition, the terms “information” and “data” used in this specification are generally used interchangeably.

[0047] The suffixes “module” and “section” used in the following description of the constituent elements are merely assigned or used interchangeably for the convenience of writing the specification, and they do not have any distinguishing meaning or function in themselves.

[0048] Specifically, the embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0049] Please see Figure 1 , Figure 1 This is a flowchart of a method for detecting a reverse shell within a Docker container, as provided in an embodiment of the present invention. Figure 1 As shown, the method for detecting a reverse shell within a Docker container includes steps S10 to S30.

[0050] S10. Determine if the current process is a reverse shell operation;

[0051] In an embodiment of the present invention, step S10, determining whether the current process is a reverse shell operation, includes the following steps:

[0052] Get the initial process ID and current process ID of the current process's process space;

[0053] Determine whether a process has engaged in reverse shell behavior by checking if the initial process ID and the current process ID are consistent.

[0054] Specifically, each process has an initial namespace process ID when it is created.

[0055] In a Linux container environment, it's crucial to isolate processes and their associated resources, including the process's file system environment. This requires a separate file system environment within the container, which is shared by the processes within the container—that is, the container's own root file system environment.

[0056] Therefore, the kernel introduced the concept of the mnt namespace to achieve isolation of the file system environment.

[0057] We can determine whether the process is inside a Docker container by obtaining the current process's mnt namespace. If the namespace is not empty, the process is considered to be inside a Docker container; otherwise, the process is definitely not inside a Docker container.

[0058] The step of determining whether a process has engaged in reverse shell behavior based on whether the initial process ID and the current process ID are consistent includes:

[0059] Check if the initial process ID and the current process ID are the same. If they are not the same, check if an abnormal file has been generated. If it has, then the process has engaged in reverse shell behavior.

[0060] In an embodiment of the present invention, the exception file is a socket, which is stored in a file under the / proc / pid / fd directory.

[0061] S20. Determine whether the process that caused the reverse shell behavior contains containerd-shim. If so, it means that a reverse shell behavior has occurred inside the Docker container.

[0062] In an embodiment of the present invention, determining whether the process in which the reverse shell behavior occurred contains containerd-shim, and if so, indicating that a reverse shell behavior occurred within a Docker container, includes:

[0063] By checking the current process ID (PID) in / proc / pid / status, if the process status contains containerd-shim, it is determined that the current process has performed a reverse shell operation inside the Docker container.

[0064] In this Docker container, containerd is started and managed by containerd-shim.

[0065] containerd is an intermediary communication component between dockerd and runC.

[0066] In this invention, the management and operation of Docker containers are primarily accomplished through containerd. Examples include container lifecycle management and image management.

[0067] runC is a CLI tool that generates and runs containers according to the OCI (Open Container Standard) specification. It can control the destruction and creation of containers via command line.

[0068] S30: Output an alarm signal indicating a reverse shell occurred within the process container. This allows users to promptly detect any intrusion threats.

[0069] This invention determines whether the current process is engaging in reverse shell behavior, and then determines whether the process engaging in reverse shell behavior contains containerd-shim. If so, it indicates that reverse shell behavior has occurred within a Docker container. This method quickly detects reverse shell behavior within Docker containers and is relatively simple and practical compared to more complex detection methods.

[0070] It should be understood that although the above description follows a certain order, these steps are not necessarily executed in that order. Unless otherwise expressly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, some steps in this embodiment may include multiple steps or multiple stages, which are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be performed alternately or in turn with other steps or at least a portion of the steps or stages in other steps.

[0071] In one embodiment, see Figure 2 As shown, an embodiment of the present invention also provides a detection system for reverse shells within a Docker container, the system comprising a first judgment module 100, a second judgment module 200, and an alarm module 300.

[0072] The first judgment module 100 is used to determine whether the current process is a reverse shell behavior.

[0073] See Figure 4 As shown, in an embodiment of the present invention, the first judgment module 100 includes a data acquisition unit 101 and a judgment subunit 102;

[0074] The data acquisition unit 101 is used to acquire the initial process ID and the current process ID of the process space of the current process;

[0075] The judgment subunit 102 is used to determine whether a process has engaged in reverse shell behavior based on whether the initial process ID and the current process ID are consistent.

[0076] The step of determining whether a process has engaged in reverse shell behavior based on whether the initial process ID and the current process ID are consistent includes:

[0077] Check if the initial process ID and the current process ID are the same. If they are not the same, check if an abnormal file has been generated. If it has, then the process has engaged in reverse shell behavior.

[0078] Specifically, each process has an initial namespace process ID when it is created.

[0079] In a Linux container environment, it's crucial to isolate processes and their associated resources, including the process's file system environment. This requires a separate file system environment within the container, which is shared by the processes within the container—that is, the container's own root file system environment.

[0080] Therefore, the kernel introduced the concept of the mnt namespace to achieve isolation of the file system environment.

[0081] We can determine whether the process is inside a Docker container by obtaining the current process's mnt namespace. If the namespace is not empty, the process is considered to be inside a Docker container; otherwise, the process is definitely not inside a Docker container.

[0082] In an embodiment of the present invention, the exception file is a socket, which is stored in a file under the / proc / pid / fd directory.

[0083] The second judgment module 200 is used to determine whether the process that caused the reverse shell behavior contains containerd-shim. If so, it means that a reverse shell behavior has occurred inside the Docker container.

[0084] In an embodiment of the present invention, the second judgment module 200 is used to view the current process status of / proc / pid / status through the current process identifier (PID), and if the process status contains containerd-shim, it is determined that the current process has performed a reverse shell behavior in the Docker container.

[0085] In this Docker container, containerd is started and managed by containerd-shim.

[0086] containerd is an intermediary communication component between dockerd and runC.

[0087] In this invention, the management and operation of Docker containers are primarily accomplished through containerd. Examples include container lifecycle management and image management.

[0088] runC is a CLI tool that generates and runs containers according to the OCI (Open Container Standard) specification. It can control the destruction and creation of containers via command line.

[0089] The alarm module 300 is used to output an alarm signal when a reverse shell occurs within a process container.

[0090] This invention determines whether the current process is engaging in reverse shell behavior, and then determines whether the process engaging in reverse shell behavior contains containerd-shim. If so, it indicates that reverse shell behavior has occurred within a Docker container. This method quickly detects reverse shell behavior within Docker containers and is relatively simple and practical compared to more complex detection methods.

[0091] In one embodiment, see Figure 4 As shown, an embodiment of the present invention also provides a terminal, including a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402 and the memory 403 communicate with each other through the communication bus 404.

[0092] Memory 403 is used to store computer programs;

[0093] Processor 401, when executing a computer program stored in memory 403, executes the method for detecting a reverse shell within a Docker container. When executing instructions, the processor implements the steps described in the above method embodiment:

[0094] S10. Determine if the current process is a reverse shell operation;

[0095] In an embodiment of the present invention, step S10, determining whether the current process is a reverse shell operation, includes the following steps:

[0096] Get the initial process ID and current process ID of the current process's process space;

[0097] Determine whether a process has engaged in reverse shell behavior by checking if the initial process ID and the current process ID are consistent.

[0098] Specifically, each process has an initial namespace process ID when it is created.

[0099] In a Linux container environment, it's crucial to isolate processes and their associated resources, including the process's file system environment. This requires a separate file system environment within the container, which is shared by the processes within the container—that is, the container's own root file system environment.

[0100] Therefore, the kernel introduced the concept of the mnt namespace to achieve isolation of the file system environment.

[0101] We can determine whether the process is inside a Docker container by obtaining the current process's mnt namespace. If the namespace is not empty, the process is considered to be inside a Docker container; otherwise, the process is definitely not inside a Docker container.

[0102] The step of determining whether a process has engaged in reverse shell behavior based on whether the initial process ID and the current process ID are consistent includes:

[0103] Check if the initial process ID and the current process ID are the same. If they are not the same, check if an abnormal file has been generated. If it has, then the process has engaged in reverse shell behavior.

[0104] In an embodiment of the present invention, the exception file is a socket, which is stored in a file under the / proc / pid / fd directory.

[0105] S20. Determine whether the process that caused the reverse shell behavior contains containerd-shim. If so, it means that a reverse shell behavior has occurred inside the Docker container.

[0106] In an embodiment of the present invention, determining whether the process in which the reverse shell behavior occurred contains containerd-shim, and if so, indicating that a reverse shell behavior occurred within a Docker container, includes:

[0107] By checking the current process ID (PID) in / proc / pid / status, if the process status contains containerd-shim, it is determined that the current process has performed a reverse shell operation inside the Docker container.

[0108] In this Docker container, containerd is started and managed by containerd-shim.

[0109] containerd is an intermediary communication component between dockerd and runC.

[0110] In this invention, the management and operation of Docker containers are primarily accomplished through containerd. Examples include container lifecycle management and image management.

[0111] runC is a CLI tool that generates and runs containers according to the OCI (Open Container Standard) specification. It can control the destruction and creation of containers via command line.

[0112] S30: Output an alarm signal indicating a reverse shell occurred within the process container. This allows users to promptly detect any intrusion threats.

[0113] This invention determines whether the current process is engaging in reverse shell behavior, and then determines whether the process engaging in reverse shell behavior contains containerd-shim. If so, it indicates that reverse shell behavior has occurred within a Docker container. This method quickly detects reverse shell behavior within Docker containers and is relatively simple and practical compared to more complex detection methods.

[0114] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0115] The communication interface is used for communication between the aforementioned terminal and other devices.

[0116] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0117] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0118] The terminal includes user equipment and network equipment. The user equipment includes, but is not limited to, computers, smartphones, and PDAs. The network equipment includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing, which is a type of distributed computing consisting of a super virtual computer composed of a group of loosely coupled computers. The terminal can operate independently to implement this invention, or it can connect to a network and interact with other terminals on the network to implement this invention. The network in which the terminal is located includes, but is not limited to, the Internet, wide area network (WAN), metropolitan area network (MAN), local area network (LAN), and VPN network.

[0119] It should also be understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0120] In one embodiment of the present invention, a storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps in the above method embodiments:

[0121] S10. Determine if the current process is a reverse shell operation;

[0122] In an embodiment of the present invention, step S10, determining whether the current process is a reverse shell operation, includes the following steps:

[0123] Get the initial process ID and current process ID of the current process's process space;

[0124] Determine whether a process has engaged in reverse shell behavior by checking if the initial process ID and the current process ID are consistent.

[0125] Specifically, each process has an initial namespace process ID when it is created.

[0126] In a Linux container environment, it's crucial to isolate processes and their associated resources, including the process's file system environment. This requires a separate file system environment within the container, which is shared by the processes within the container—that is, the container's own root file system environment.

[0127] Therefore, the kernel introduced the concept of the mnt namespace to achieve isolation of the file system environment.

[0128] We can determine whether the process is inside a Docker container by obtaining the current process's mnt namespace. If the namespace is not empty, the process is considered to be inside a Docker container; otherwise, the process is definitely not inside a Docker container.

[0129] The step of determining whether a process has engaged in reverse shell behavior based on whether the initial process ID and the current process ID are consistent includes:

[0130] Check if the initial process ID and the current process ID are the same. If they are not the same, check if an abnormal file has been generated. If it has, then the process has engaged in reverse shell behavior.

[0131] In an embodiment of the present invention, the exception file is a socket, which is stored in a file under the / proc / pid / fd directory.

[0132] S20. Determine whether the process that caused the reverse shell behavior contains containerd-shim. If so, it means that a reverse shell behavior has occurred inside the Docker container.

[0133] In an embodiment of the present invention, determining whether the process in which the reverse shell behavior occurred contains containerd-shim, and if so, indicating that a reverse shell behavior occurred within a Docker container, includes:

[0134] By checking the current process ID (PID) in / proc / pid / status, if the process status contains containerd-shim, it is determined that the current process has performed a reverse shell operation inside the Docker container.

[0135] In this Docker container, containerd is started and managed by containerd-shim.

[0136] containerd is an intermediary communication component between dockerd and runC.

[0137] In this invention, the management and operation of Docker containers are primarily accomplished through containerd. Examples include container lifecycle management and image management.

[0138] runC is a CLI tool that generates and runs containers according to the OCI (Open Container Standard) specification. It can control the destruction and creation of containers via command line.

[0139] S30: Output an alarm signal indicating a reverse shell occurred within the process container. This allows users to promptly detect any intrusion threats.

[0140] This invention determines whether the current process is engaging in reverse shell behavior, and then determines whether the process engaging in reverse shell behavior contains containerd-shim. If so, it indicates that reverse shell behavior has occurred within a Docker container. This method quickly detects reverse shell behavior within Docker containers and is relatively simple and practical compared to more complex detection methods.

[0141] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Furthermore, any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory.

[0142] It should be understood that, as used herein, the singular form "a" is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, "and / or" refers to any and all possible combinations of one or more of the associatedly listed items. The embodiment numbers disclosed above are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0143] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of the invention, technical features of the above embodiments or different embodiments can be combined, and many other variations of different aspects of the invention exist, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.

Claims

1. A method for detecting a shell-rebound within a docker container, characterized in that, The method comprises: obtaining an initial process number and a current process number of a process space of a current process; determining whether the initial process number and the current process number are consistent, and if not, determining whether an abnormal file is generated, and if so, determining that a process has a rebound shell behavior; determining whether the process having the rebound shell behavior contains containerd-shim, and if so, indicating that a docker container rebound shell behavior occurs; outputting an alarm signal of the process container rebound shell behavior.

2. The method of claim 1, wherein the docker container inside shell-rebound detection method is characterized by, The abnormal file is a socket stored in a file in a / proc / pid / fd directory.

3. The method of claim 1, wherein the docker container inside shell-rebound detection method is characterized by, The determination of whether the process having the rebound shell behavior contains containerd-shim, and if so, indicating that a docker container rebound shell behavior occurs, comprises: checking a current process state of / proc / pid / status through a current process identifier, and if the process state contains containerd-shim, it is determined that the current process has a rebound shell behavior in a docker container.

4. The method of claim 3, wherein the docker container internal shell-reverse- connection detection method is characterized by, The containerd in the docker container starts and manages runC through containerd-shim.

5. A system for detecting a shell-rebound within a docker container, the system comprising: The system comprises a first determination module, a second determination module, and an alarm module. The first determination module is configured to obtain an initial process number and a current process number of a process space of a current process, determine whether the initial process number and the current process number are consistent, and if not, determine whether an abnormal file is generated, and if so, determine that a process has a rebound shell behavior. The second determination module is configured to determine whether the process having the rebound shell behavior contains containerd-shim, and if so, indicate that a docker container rebound shell behavior occurs. The alarm module is configured to output an alarm signal of the process container rebound shell behavior. 6.A terminal comprising a memory and a processor, wherein the memory stores a computer program, and the processor loads and executes the computer program to implement the steps of the detection method of the docker container rebound shell according to any one of claims 1-4. 7.A storage medium storing a computer program, wherein the computer program is loaded and executed by a processor to implement the steps of the detection method of the docker container rebound shell according to any one of claims 1-4.

Images