A container image security detection method, device, equipment and storage medium

Abstract

The application discloses a container image security detection method and device, equipment and storage medium, including: performing static scanning on the executable file in the to-be-detected container image to obtain a to-be-detected sensitive feature in the executable file of the to-be-detected container image; the to-be-detected sensitive feature is a feature that has dynamic change possibility and has possibility of containing sensitive information; the to-be-detected container image is executed, and a target process is determined from the processes in the to-be-detected container execution process; the target process is a process containing the to-be-detected sensitive feature scanned out by the corresponding executable file; the target process is dynamically debugged, and whether the to-be-detected sensitive feature in the executable file of the to-be-detected container image indeed contains sensitive information is determined based on the dynamic debugging result. The application combines dynamic scanning on the basis of static scanning to deeply capture the sensitive information of the executable file in the container image, effectively improving the detection breadth and depth of the sensitive information.

Description

Technical Field

[0001] This invention relates to the field of mirror security technology, and in particular to a container mirror security detection method, apparatus, device, and storage medium. Background Technology

[0002] With the rise of microservice architecture, containerized deployment has become the most popular production method, and container security has naturally become a focus of industry attention. Containers are built on images, so the security of the container image directly determines the security of the container itself. In a real cloud-native environment, from a regulatory perspective, sensitive information needs to be stored in specific locations, such as the secret resource of the Kubernetes (k8s) orchestration system. Storing sensitive information directly within the container image poses a risk of leakage, creating security vulnerabilities. Therefore, ensuring that sensitive information in container images is not leaked is paramount in container image security testing and an essential step in promoting container security development. Currently, to prevent sensitive information leakage from container images due to improper developer operations, most existing technologies use regular expression matching on readable files. This method is simple and effective, but it only solves part of the problem and cannot perform deep scanning of container images to accurately identify sensitive information and provide developers with alerts.

[0003] Therefore, how to deeply capture sensitive information in container images is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a container image security detection method, apparatus, device, and storage medium, which can deeply capture sensitive information of executable files in container images, avoid missing hidden sensitive information, effectively improve the breadth and depth of sensitive information detection, and thus ensure the security of container images. The specific solution is as follows:

[0005] The first aspect of this application provides a container image security detection method, including:

[0006] A static scan is performed on the executable files in the container image to be detected to obtain the sensitive features to be detected in the executable files of the container image to be detected; wherein, the sensitive features to be detected are features that have the possibility of dynamic change and the possibility of containing sensitive information.

[0007] The container image to be detected is executed, and the target process is determined from the processes in the execution process of the container to be detected; wherein, the target process is the process containing the sensitive features to be detected that is statically scanned from the corresponding executable file;

[0008] The target process is dynamically debugged, and based on the results of the dynamic debugging, it is determined whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

[0009] Optionally, the executable file includes at least one of a binary executable file and a script file, and the sensitive feature to be detected includes at least one of a sensitive variable to be detected and a sensitive function to be detected.

[0010] Optionally, the executable file includes a binary executable file; the sensitive feature to be detected includes at least one of a sensitive variable to be detected and a sensitive function to be detected.

[0011] Perform a static scan on the binary executable file in the container image to be detected, including:

[0012] Static scanning is performed on each section of the binary executable file in the container image to be detected, and at least one of the sensitive variable to be detected and the sensitive function to be detected is extracted from the section.

[0013] Optionally, the executable file includes a script file; the sensitive feature to be detected includes at least one of a sensitive variable to be detected and a sensitive function to be detected.

[0014] Perform a static scan on the script files in the container image to be detected, including:

[0015] A static scan is performed on the script file in the container image to be detected, and the script file is parsed using a lexical analyzer and a function analyzer respectively to obtain at least one of the sensitive variables to be detected and the sensitive functions to be detected in the script file.

[0016] Optionally, after performing a static scan of the executable files in the container image to be detected, the method further includes:

[0017] The sensitive features to be detected obtained from static scanning are cached in the sensitive feature database;

[0018] Accordingly, executing the container image to be detected and determining the target process from the processes during the execution of the container image to be detected includes:

[0019] The container image to be detected is executed, and the process information during the execution process is traversed.

[0020] The sensitive features to be detected are read from the sensitive feature database by performing a static scan of the executable file, and the read information is matched with the traversed process information to determine the target process.

[0021] Optionally, the sensitive feature to be detected includes a sensitive function to be detected;

[0022] Accordingly, the step of dynamically debugging the target process and determining, based on the dynamic debugging results, whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information includes:

[0023] The target process is dynamically debugged, and the interface parameters of the sensitive function to be detected are obtained;

[0024] Based on the obtained interface parameters, determine whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

[0025] Optionally, the sensitive function to be detected includes at least one of a database interface function and a network communication interface function.

[0026] Optionally, the container image security detection method further includes:

[0027] The network communication packets generated during the monitoring and debugging process are used to determine whether the content of the network communication packets contains sensitive information.

[0028] Optionally, after executing the container image to be detected, the process further includes:

[0029] The environment variables during the execution of the container image to be tested are obtained and static analysis is performed on the environment variables to determine whether the environment variables in the container image to be tested contain sensitive information based on the static analysis results.

[0030] Optionally, the container image security detection method further includes:

[0031] A static scan is performed on all files in the container image to be detected to determine whether the container image to be detected contains sensitive information;

[0032] The static scanning includes at least one of the following methods:

[0033] A static scan is performed on the filename extensions of all files in the container image to be detected to determine whether the container image to be detected contains a key file.

[0034] Static scanning of all files is performed by matching keywords using regular expressions to determine whether the container image to be detected contains sensitive information.

[0035] A static scan is performed on the build commands of the container image to be detected to determine whether the container image to be detected contains sensitive information.

[0036] A second aspect of this application provides a container image security detection device, comprising:

[0037] The static scanning module is used to perform static scanning on the executable files in the container image to be detected, and to obtain the sensitive features to be detected in the executable files of the container image to be detected; wherein, the sensitive features to be detected are features that have the possibility of dynamic change and have the possibility of containing sensitive information.

[0038] The dynamic scanning module is used to execute the container image to be detected and determine the target process from the processes in the execution process of the container to be detected; wherein, the target process is the process containing the sensitive features to be detected that is statically scanned from the corresponding executable file;

[0039] The detection module is used to dynamically debug the target process and determine, based on the dynamic debugging results, whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

[0040] A third aspect of this application provides an electronic device including a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the aforementioned container image security detection method.

[0041] A fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the aforementioned container image security detection method.

[0042] In this application, a static scan is first performed on the executable files in the container image to be tested to obtain the sensitive features to be detected in the executable files of the container image to be tested. These sensitive features are those with the potential for dynamic change and the possibility of containing sensitive information. Then, the container image to be tested is executed, and a target process is determined from the processes during the execution of the container image to be tested. The target process is the process corresponding to the executable file that contains the sensitive features to be detected, as identified by the static scan. Finally, the target process is dynamically debugged, and the results of the dynamic debugging are used to determine whether the sensitive features to be detected in the executable files of the container image to be tested actually contain sensitive information. Therefore, this application, based on the static scanning of sensitive features in the executable files of the container image, further combines dynamic scanning to determine whether the sensitive features actually contain sensitive information. This enables deep capture of sensitive information in the executable files of the container image, avoiding missed detection of hidden sensitive information, effectively improving the breadth and depth of sensitive information detection, thereby ensuring the security of the container image. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0044] Figure 1 A flowchart of a container image security detection method provided in this application;

[0045] Figure 2 A flowchart of a specific container image static scanning method provided in this application;

[0046] Figure 3 This application provides a schematic diagram of a specific static scanning process for a binary executable file.

[0047] Figure 4 This application provides a schematic diagram of a specific script file static scanning process;

[0048] Figure 5 This application provides a schematic diagram of a specific process for acquiring a target.

[0049] Figure 6 A flowchart illustrating a specific container image security detection method provided in this application;

[0050] Figure 7This application provides a schematic diagram of a specific dynamic monitoring process for sensitive information.

[0051] Figure 8 This application provides a flowchart of a specific method for statically scanning all files of a container image.

[0052] Figure 9 This application provides a schematic diagram of the structure of a container image security detection device.

[0053] Figure 10 This application provides a structural diagram of an electronic device for container image security detection. Detailed Implementation

[0054] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] Existing methods for detecting sensitive information in container images only perform routine filename matching on readable files, resulting in incomplete scanning, high false positive rates, and false negatives. For example, they cannot effectively detect sensitive information and code files that have undergone base64 encoding or other transformations. Furthermore, direct deployment in a production environment carries the risk of exposing sensitive information directly to the environment. To address these shortcomings, this application provides a container image security detection solution that can deeply capture sensitive information in executable files within container images, avoiding missed detections of hidden sensitive information and effectively improving the breadth and depth of sensitive information detection, thereby ensuring the security of container images.

[0056] Figure 1 This is a flowchart illustrating a container image security detection method provided in an embodiment of this application. See also... Figure 1 As shown, the container image security detection method includes:

[0057] S11: Perform a static scan on the executable file in the container image to be detected to obtain the sensitive features to be detected in the executable file of the container image to be detected; wherein, the sensitive features to be detected are features that have the possibility of dynamic change and the possibility of containing sensitive information.

[0058] In this embodiment, a static scan is first performed on the executable files in the container image to be detected to obtain the sensitive features to be detected in the executable files of the container image to be detected. It is easy to understand that a container image is an image file (Docker image file), which needs to be downloaded from an image repository beforehand. The container image stores a large number of executable files, including at least one of binary executable files (ELF, Executable and Linkable Format) and script files. The binary executable file is also a binary format executable file under Linux. Some information in the executable files is non-sensitive in a static environment, but in a dynamic environment, changes such as sensitive information assignment and parameter passing may occur, leading to the leakage of sensitive information. This type of information is the sensitive feature to be detected, which has the potential to change dynamically and may contain sensitive information.

[0059] Specifically, the sensitive feature to be detected is at least one of a sensitive variable to be detected and a sensitive function to be detected. The sensitive variable to be detected includes variables such as user="" and passwd="", while the sensitive function to be detected is a function whose parameters or return values ​​may contain sensitive information during runtime, such as functions used to create or modify system passwords and usernames. Additionally, static scanning of the binary executable file may yield sensitive information strings such as the complete storage path of loaded resources. However, these sensitive information strings generally do not change in a dynamic environment, meaning they do not have the potential for dynamic change; therefore, they are not included in the sensitive features to be detected, nor is dynamic scanning necessary. This distinction is made to facilitate the monitoring of features that may cause sensitive information leakage during the execution of the container image to be detected, which is essentially a verification and in-depth analysis of the results obtained from the static scan.

[0060] In this embodiment, the sensitive information in the binary executable file is mostly in a variant data format, making it difficult to detect. Unlike the executable file, the script file may contain a large amount of sensitive information in plaintext format. Currently, there is no method to scan the sensitive information in the binary executable file and the script file. Given that the leakage of sensitive information in the binary executable file and the script file may pose a serious threat to the security of container images, this embodiment focuses on performing a static scan of the binary executable file and the script file in the container image to be detected, and then obtaining the sensitive variables and / or sensitive functions to be detected in the binary executable file and the script file.

[0061] S12: Execute the container image to be detected, and determine the target process from the processes in the execution process of the container to be detected; wherein, the target process is the process containing the sensitive features to be detected that is statically scanned from the corresponding executable file.

[0062] In this embodiment, after the static scan is completed, the container image to be detected is first executed. Virtual execution of the container image means running it in an independent environment. The static scan results are verified through dynamic execution, which runs the container image in an isolated environment, ensuring that it only accesses its own internal data. Then, the target process is identified from the processes running during the execution of the container image. The target process is the process containing the sensitive features identified by the static scan of the corresponding executable file. It is easy to understand that execution and focused monitoring are only meaningful if a process contains the sensitive features or its execution is related to them.

[0063] S13: Perform dynamic debugging on the target process, and determine, based on the dynamic debugging results, whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

[0064] In this embodiment, the sensitivity of the sensitive features to be detected during the execution of the target process is verified through dynamic debugging. Specifically, based on the dynamic debugging results, it is determined whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information. Dynamic debugging can be implemented by executing GDB, a debugging tool for UNIX and UNIX-like systems. GDB allows for the startup and execution of programs to be debugged in a customized manner, and also allows for setting breakpoints using specified locations and conditional expressions. Furthermore, it enables monitoring of values ​​when the program is paused and dynamically changing the program's execution environment.

[0065] It should be noted that dynamic execution may involve periods where variable assignment or modification is not triggered, function calls are not performed, or related network behaviors occur, potentially leading to false positives. Therefore, long-term monitoring within the development / testing environment is recommended to ensure more accurate and objective monitoring of changes. This involves dynamically monitoring the sensitive characteristics to be detected during the target process's execution for a period to obtain the final variable values. This allows for monitoring the changes in the sensitive characteristics in a dynamic environment, and based on the monitoring results, security checks are performed on the container image to determine if privacy leaks have occurred. For example, assigning a value of "passwd" to the sensitive variable to be detected using a user's password would expose that password to the public.

[0066] If a change in the sensitive feature to be detected is detected during dynamic execution and the change results in private data, it indicates that the sensitive feature to be detected obtained after static scanning contains real sensitive information, and the sensitive feature to be detected can be marked as sensitive. If no private data appears, it indicates that the sensitive feature to be detected obtained after static scanning does not contain real sensitive information, and the sensitive feature to be detected can be deleted, marked as non-sensitive, or marked as non-existent. This embodiment is only a process for detecting sensitive information. Whether it can ultimately be determined as sensitive information requires specific analysis based on the specific scenario. For example, the sensitive feature to be detected and the dynamic monitoring results can be fed back to relevant users, who can determine which information is sensitive and which is non-sensitive based on their own business needs, thereby further confirming whether the container image to be detected is in a secure state, and completing the security detection of the container image to be detected.

[0067] As can be seen, this embodiment first performs a static scan on the executable files in the container image to be tested, obtaining the sensitive features to be detected in the executable files of the container image to be tested; wherein, the sensitive features to be detected are features that have the potential to change dynamically and have the potential to contain sensitive information; then, the container image to be tested is executed, and a target process is determined from the processes in the execution process of the container to be tested; wherein, the target process is the process that contains the sensitive features to be detected corresponding to the executable file identified by the static scan; finally, the target process is dynamically debugged, and based on the dynamic debugging results, it is determined whether the sensitive features to be detected in the executable files of the container image to be tested do indeed contain sensitive information. This embodiment, based on the static scanning of sensitive features in the executable files of the container image, further combines dynamic scanning to determine whether the sensitive features do indeed contain sensitive information, enabling deep capture of sensitive information in the executable files of the container image, avoiding missed detection of hidden sensitive information, effectively improving the breadth and depth of sensitive information detection, thereby ensuring the security of the container image.

[0068] Figure 2 This is a flowchart illustrating a specific container image security detection method provided in an embodiment of this application. See also... Figure 2 As shown, the container image security detection method includes:

[0069] S21: Perform a static scan of the binary executable files and / or script files in the container image to be detected to obtain the corresponding sensitive features to be detected.

[0070] In this embodiment, a static scan is performed on the binary executable files and / or script files in the container image to be detected to obtain the corresponding sensitive features to be detected. The scan can be performed on only the executable files or the script files in the container image to be detected, or both can be scanned. Scanning both ensures the completeness of the security detection of the container image to be detected.

[0071] In this embodiment, the process of statically scanning the binary executable file in the container image to be detected is as follows: Static scanning is performed on each section of the binary executable file in the container image to be detected, and at least one of the sensitive variables and sensitive functions to be detected is extracted from the sections. Since the program has been compiled into an ELF binary executable file, the analysis mainly focuses on specific sections in the ELF format, such as the section containing temporary variable names, the section containing external function calls, and the section containing global variables. The sensitive features to be detected are extracted from the above section information.

[0072] Specific reference Figure 3 This embodiment performs static scanning of the binary executable file while parsing the ELF format file. Specifically, it scans and extracts the sensitive variables to be detected stored in the ".data" section, scans and extracts the symbol table information in the ".symtab" section to obtain the sensitive functions to be detected, and scans and extracts the sensitive external reference functions from the shared library reference table in the ".got" section. These sensitive external reference functions are a type of the sensitive functions to be detected. Additionally, it can scan and extract the read-only string in the ".rodata" section to obtain the sensitive information string, which is then fed back to the user for judgment based on business requirements. It is understood that the ".data", ".rodata", ".symtab", and ".got" sections are components of the binary executable file. The ".rodata" section only stores read-only data, and the (statically linked) symbol table stored in the ".symtab" section stores all definitions and references to symbols in the current file. The definitions and functions of each section are described in the prior art and will not be repeated in this embodiment.

[0073] In this embodiment, the process of statically scanning the script file in the container image to be detected is as follows: Static scanning is performed on the script file in the container image to be detected, and the script file is parsed using a lexical analyzer and a function analyzer respectively to obtain at least one of the sensitive variables and sensitive functions to be detected in the script file. Although the script file is a text file, keyword searches may not yield truly comprehensive information. For example, in Python, if the fields `user=""` and `passwd=""` are defined and initialized to empty during initialization, directly matching these fields with regular expressions is meaningless. At most, it only tells the developer that sensitive variable names are used, but it doesn't reveal whether the username and password are actually stored in the program. Therefore, a thorough analysis of the program is necessary.

[0074] Specific reference Figure 4 In this embodiment, based on a static scan of the script file, a lexical analyzer and a function analyzer are used to parse the script file. The lexical analyzer identifies sensitive variables and macros, and the function analyzer identifies the names of the functions to be monitored, i.e., the names of the sensitive functions to be detected. To more accurately cover database and HTTP connection information, it is necessary to collect the SDK function names for database connections and HTTP connections using common programming languages ​​beforehand. This facilitates monitoring function calls during subsequent dynamic analysis to further determine whether user and password information is transmitted during function calls. Additionally, the script file can be identified by its filename extension.

[0075] S22: Cache the sensitive features to be detected obtained from static scanning into the sensitive feature database.

[0076] In this embodiment, after obtaining the corresponding sensitive features to be detected, the sensitive features obtained from static scanning are cached in a sensitive feature database. To facilitate dynamic scanning, after statically scanning the binary executable files and / or script files in the image layer of the container image to be detected to obtain the scan results, i.e., the corresponding sensitive features to be detected, the specific sensitive variables and sensitive functions to be detected can be stored in the pre-built sensitive feature database. Of course, sensitive information strings can also be stored. The sensitive feature database stores a large number of sensitive features, and each sensitive feature is labeled with which sensitive characteristic belongs to which scanning stage, so as to subsequently determine the processes that need to be monitored, i.e., the processes related to the sensitive feature.

[0077] S23: Execute the container image to be detected and iterate through the process information during the execution process.

[0078] S24: Read the sensitive features to be detected obtained by static scanning of the executable file from the sensitive feature database, and match the read information with the traversed process information to determine the target process.

[0079] In this embodiment, after the container runs in a secure, isolated environment, the dynamic scan focuses only on the static scan results of the binary executable file and / or the script file. The dynamic scan process involves identifying the target process related to the sensitive variables and sensitive functions obtained from the static scan of the binary executable file and / or the script file. First, the container image to be detected is executed. Then, the process information during execution is traversed, that is, all process information during the execution of the container image to be detected is traversed, and the process from which the sensitive information to be detected has been extracted is identified as the target process. Based on storing the static scan results in the sensitive feature database, the sensitive features to be detected obtained from the static scan of the binary executable file are read from the sensitive feature database, and the read information is matched with the traversed process information to determine the target process. To improve matching accuracy, after determining the target process, it is determined whether the execution entity of the target process is a script program or a binary program. If it is a script program, it is determined whether the target process contains the sensitive features to be detected corresponding to the script; if it is a binary program, it is determined whether the target process contains the sensitive features to be detected corresponding to the binary program. If all are included, the matching result is accurate. The specific matching process described above is as follows: Figure 5 As shown.

[0080] S25: Perform dynamic debugging on the target process, and determine, based on the dynamic debugging results, whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

[0081] In this embodiment, the specific process of step S24 can be referred to the corresponding content disclosed in the previous embodiments, and will not be repeated here.

[0082] As can be seen, this application caches the sensitive features to be detected obtained by statically scanning the binary executable files and / or script files in the container image to be detected into a sensitive feature database. When determining the target process, the target process is determined by matching the sensitive features to be detected from the sensitive feature database with the traversed process information, which improves matching efficiency and data standardization. At the same time, sensitive features to be detected are extracted from the sections of the binary executable files by statically scanning them and / or obtained by statically scanning the script files and parsing them using a lexical analyzer and a function analyzer, respectively. This increases the in-depth analysis of the binary executable files and script files, effectively improving the ability to detect sensitive information inside the image.

[0083] Figure 6 This is a flowchart illustrating a specific container image security detection method provided in an embodiment of this application. See also... Figure 6 As shown, the container image security detection method includes:

[0084] S31: Perform a static scan on the executable files in the container image to be detected to obtain the sensitive functions to be detected in the executable files of the container image to be detected.

[0085] S32: Execute the container image to be detected, and determine the target process from the processes in the execution process of the container to be detected.

[0086] In this embodiment, a static scan of the executable file is performed to obtain the corresponding sensitive functions to be detected. These sensitive functions include at least one of a database interface function and a network communication interface function. The specific process for detecting the sensitive functions and determining the target process can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0087] S33: Perform dynamic debugging on the target process and obtain the interface parameters of the sensitive function to be detected.

[0088] S34: Based on the obtained interface parameters, determine whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

[0089] In this embodiment, after dynamically debugging the target process, the interface parameters of the sensitive function to be detected are obtained. Finally, based on the obtained interface parameters, it is determined whether the sensitive feature to be detected in the executable file of the container image to be detected actually contains sensitive information. Regarding the database interface function and the network communication interface function during the execution of the target process, it is necessary to dynamically monitor the changes in the database interface parameters and network communication interface parameters during execution. The network communication can be HTTP, and correspondingly, the network communication interface parameters are HTTP network communication interface parameters. Furthermore, the changes in the corresponding HTTP message content during execution can also be dynamically monitored. The specific details of the above dynamic monitoring process are as follows: Figure 7 As shown.

[0090] Furthermore, the above processes all describe methods for analyzing process memory. Often, for convenience and to enable multiple processes within a container to share data, developers configure sensitive information as environment variables for use by multiple processes. Storing sensitive information within environment variables poses a security risk, therefore runtime scanning of environment variables is necessary. Thus, during process execution, environment variables from the configuration file can be retrieved, and then static analysis can be performed on these environment variables during the execution of the container image under test. During container runtime, not only are environment variables configured within the Dockerfile loaded, but also those from the configuration files within the image. To obtain complete environment variable information, the image needs to be deployed as a container, and the command `[docker exec image_name env]` executed to retrieve the environment variable information within the container. Then, based on the static analysis results of the retrieved container environment variable information, it can be determined whether the environment variables in the container image under test contain sensitive information.

[0091] As can be seen, this application embodiment determines sensitive information by analyzing the interface parameters of the sensitive function to be detected, dynamically acquires and analyzes the environment variables during the execution of the container image to be detected, and realizes scanning analysis at both the process memory and environment variable levels, thereby further improving the ability to detect sensitive information.

[0092] Figure 8 This is a flowchart illustrating a static scanning method for container image files provided in an embodiment of this application. See also... Figure 8 As shown, the static scanning method for container image files includes:

[0093] S41: Perform a static scan of the filename extensions of all files in the container image to be tested to determine whether the container image to be tested contains a key file.

[0094] In addition to the executable file, the container image to be tested also contains many other types of files. To improve the accuracy of container image security detection, besides performing security detection based on the information of the executable file, a static scan is also required based on all other files in the container image to be tested. This process may include any one or more of the three steps; this embodiment does not limit the scan type or scan order.

[0095] In this embodiment, a static scan can be performed on the filename extensions of all files in the container image to be detected to determine whether the container image contains a key file. Simultaneously, by performing a static scan on the filename extensions of the files in the container image to be detected, the binary executable file, the script file, the key file, and other file types can be identified. Based on this, it can be determined which types of files to scan more deeply and mine for sensitive information.

[0096] The binary executable file has the extension ".exe", and the script file has the extension ".py", ".JS", etc. The key file can be a private key storage file containing private key information, and its extension covers common X.509 certificate format file extensions. X.509 is the format standard for public key certificates in cryptography. Common extensions include, but are not limited to, ".key", ".der", ".rsa", ".pem / .cer / .crt", ".cer / .crt", ".bks", ".pfx / .p12", ".jks / ks / .keystore", ".jce", ".pvk / .spc", ".kdb", etc. It should be noted that the accuracy of identifying the private key storage file containing private key information using the above-listed extensions is already quite high. However, to further improve accuracy, for some filenames, the extension can be further identified by judging the inherent format of the file. For example, the format "'BEGINRSA PRIVATE KEY'" corresponds to a RAS private key, "'BEGIN DSA PRIVATE KEY'" corresponds to a DSA private key, and "'BEGINPGP PRIVATE KEY'" corresponds to a PGP private key.

[0097] S42: Perform a static scan of all files for sensitive keywords by matching keywords using regular expressions to determine whether the container image to be detected contains sensitive information.

[0098] In this embodiment, a static scan of all files is performed using regular expressions to match keywords, in order to determine whether the container image to be detected contains sensitive information. This step mainly identifies some keyword information and performs regular expression keyword matching, which is usually strongly related to the actual internal business. The most common requirement is to avoid database connection passwords and authentication credentials. Regular expression matching uses regular expressions (also known as rule expressions) to retrieve and replace text that matches a certain pattern or rule. For URL matching, the database connection password is matched as mysql: / / username:password@, and for command line matching, it is matched as mysql-up. The authentication credentials are credentials issued by the system after a user logs in, allowing the system to track their identity and perform operations that conform to the corresponding business logic. Authentication credential keywords can be api_key=xxxx, token=xxx, passwd=xxxx, password=xxx, etc.

[0099] S43: Perform a static scan on the build command of the container image to be detected to determine whether the container image to be detected contains sensitive information.

[0100] In this embodiment, in addition to identifying the key file, database connection password, and authentication credentials, it is also necessary to pay attention to the build history of the container image to be tested, which may contain relevant sensitive information. That is, a static scan of the build commands of the container image to be tested is performed to determine whether the container image contains sensitive information. Specifically, the build commands executed when building the container image to be tested can be obtained by calling the `docker history` command. These build commands are then stored as a file, and the historical operation records (Dockerfile) of the container image to be tested are viewed using regular expressions to match keywords. A Dockerfile is a text file used to build an image, containing instructions and descriptions required for building the image, i.e., the build commands. After the entire static scan process is completed, the detected information can be cached in a sensitive feature database so that it can be fed back to the relevant users along with the final sensitivity determination results of the sensitive features to be tested.

[0101] As can be seen, the static scanning process in this application embodiment scans all files in addition to scanning file name suffixes, file content, and build history, thereby conducting comprehensive and multi-dimensional detection of sensitive information in the container image to meet the security requirements of the container image.

[0102] See Figure 9 As shown in the figure, this application also discloses a container image security detection device, including:

[0103] The static scanning module 11 is used to perform static scanning on the executable file in the container image to be detected, and to obtain the sensitive features to be detected in the executable file of the container image to be detected; wherein, the sensitive features to be detected are features that have the possibility of dynamic change and the possibility of containing sensitive information.

[0104] The dynamic scanning module 12 is used to execute the container image to be detected and determine the target process from the processes in the execution process of the container to be detected; wherein, the target process is the process containing the sensitive features to be detected that is statically scanned from the corresponding executable file;

[0105] The detection module 13 is used to dynamically debug the target process and determine, based on the dynamic debugging results, whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

[0106] As can be seen, this embodiment first performs a static scan on the executable files in the container image to be tested, obtaining the sensitive features to be detected in the executable files of the container image to be tested; wherein, the sensitive features to be detected are features that have the potential to change dynamically and have the potential to contain sensitive information; then, the container image to be tested is executed, and a target process is determined from the processes in the execution process of the container to be tested; wherein, the target process is the process that contains the sensitive features to be detected corresponding to the executable file identified by the static scan; finally, the target process is dynamically debugged, and based on the dynamic debugging results, it is determined whether the sensitive features to be detected in the executable files of the container image to be tested do indeed contain sensitive information. This embodiment, based on the static scanning of sensitive features in the executable files of the container image, further combines dynamic scanning to determine whether the sensitive features do indeed contain sensitive information, enabling deep capture of sensitive information in the executable files of the container image, avoiding missed detection of hidden sensitive information, effectively improving the breadth and depth of sensitive information detection, thereby ensuring the security of the container image.

[0107] In some specific embodiments, the static scanning module 11 specifically includes:

[0108] A binary executable file scanning unit is used to perform static scanning on each section of the binary executable file in the container image to be detected, and extract at least one of the sensitive variable to be detected and the sensitive function to be detected from the section.

[0109] The script file scanning unit is used to perform static scanning on the script file in the container image to be detected, and to parse the script file using a lexical analyzer and a function analyzer respectively, to obtain at least one of the sensitive variable to be detected and the sensitive function to be detected in the script file.

[0110] In some specific embodiments, the static scanning module 11 further includes:

[0111] The file extension scanning unit is used to perform a static scan of the file name extensions of all files in the container image to be detected, in order to determine whether the container image to be detected contains a key file.

[0112] The keyword scanning unit is used to perform static scanning of sensitive keywords in all files by matching keywords with regular expressions, in order to determine whether the container image to be detected contains sensitive information.

[0113] The build command scanning unit is used to perform a static scan of the build commands of the container image to be detected in order to determine whether the container image to be detected contains sensitive information.

[0114] In some specific embodiments, the container image security detection device further includes:

[0115] The caching module is used to cache the sensitive features to be detected obtained by static scanning to the sensitive feature database;

[0116] Accordingly, in some specific embodiments, the dynamic scanning module 12 specifically includes:

[0117] The execution traversal unit is used to execute the container image to be detected and traverse the process information during the execution process;

[0118] The matching unit is used to read the sensitive features to be detected obtained by static scanning of the executable file from the sensitive feature database, and to match the read information with the traversed process information to determine the target process.

[0119] In some specific embodiments, when the sensitive feature to be detected includes a sensitive function to be detected, the detection module 13 specifically includes:

[0120] The debugging acquisition unit is used to dynamically debug the target process and acquire the interface parameters of the sensitive function to be detected.

[0121] The determining unit is used to determine, based on the obtained interface parameters, whether the sensitive feature to be detected in the executable file of the container image to be detected actually contains sensitive information.

[0122] In some specific embodiments, the container image security detection device further includes:

[0123] The message monitoring module is used to monitor network communication messages generated during the debugging process to determine whether the message content of the network communication messages contains sensitive information.

[0124] The environment variable scanning module is used to obtain the environment variables during the execution of the container image to be tested and perform static analysis on the environment variables to determine whether the environment variables in the container image to be tested contain sensitive information based on the static analysis results.

[0125] Furthermore, embodiments of this application also provide an electronic device. Figure 10 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0126] Figure 10 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the container image security detection method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a server.

[0127] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0128] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222 and data 223, etc., and the storage method can be temporary storage or permanent storage.

[0129] The operating system 221 manages and controls the various hardware devices and computer programs 222 on the electronic device 20 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system 221 can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the container image security detection method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks. The data 223 may include sensitive information collected by the electronic device 20.

[0130] Furthermore, this application also discloses a storage medium storing a computer program. When the computer program is loaded and executed by a processor, it implements the container image security detection method steps disclosed in any of the foregoing embodiments.

[0131] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0132] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0133] The container image security detection method, apparatus, device, and storage medium provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for security detection of container images, characterized in that, include: A static scan is performed on the executable files in the container image to be detected to obtain the sensitive features to be detected in the executable files of the container image to be detected; wherein, the sensitive features to be detected are features that have the possibility of dynamic change and the possibility of containing sensitive information. The container image to be detected is executed, and the target process is determined from the processes in the execution process of the container to be detected; wherein, the target process is the process containing the sensitive features to be detected that is statically scanned from the corresponding executable file; The target process is dynamically debugged, and based on the results of the dynamic debugging, it is determined whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

2. The container image security detection method according to claim 1, characterized in that, The executable file includes at least one of a binary executable file and a script file, and the sensitive feature to be detected includes at least one of a sensitive variable to be detected and a sensitive function to be detected.

3. The container image security detection method according to claim 1, characterized in that, The executable file includes a binary executable file; the sensitive feature to be detected includes at least one of a sensitive variable to be detected and a sensitive function to be detected; Perform a static scan on the binary executable file in the container image to be detected, including: Static scanning is performed on each section of the binary executable file in the container image to be detected, and at least one of the sensitive variable to be detected and the sensitive function to be detected is extracted from the section.

4. The container image security detection method according to claim 1, characterized in that, The executable file includes a script file; the sensitive feature to be detected includes at least one of a sensitive variable to be detected and a sensitive function to be detected. Perform a static scan on the script files in the container image to be detected, including: A static scan is performed on the script file in the container image to be detected, and the script file is parsed using a lexical analyzer and a function analyzer respectively to obtain at least one of the sensitive variables to be detected and the sensitive functions to be detected in the script file.

5. The container image security detection method according to claim 1, characterized in that, After performing a static scan of the executable files in the container image to be tested, the process also includes: The sensitive features to be detected obtained from static scanning are cached in the sensitive feature database; Accordingly, executing the container image to be detected and determining the target process from the processes during the execution of the container image to be detected includes: The container image to be detected is executed, and the process information during the execution process is traversed. The sensitive features to be detected are read from the sensitive feature database by performing a static scan of the executable file, and the read information is matched with the traversed process information to determine the target process.

6. The container image security detection method according to claim 1, characterized in that, The sensitive feature to be detected includes the sensitive function to be detected; Accordingly, the step of dynamically debugging the target process and determining, based on the dynamic debugging results, whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information includes: The target process is dynamically debugged, and the interface parameters of the sensitive function to be detected are obtained; Based on the obtained interface parameters, determine whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

7. The container image security detection method according to claim 6, characterized in that, The sensitive function to be detected includes at least one of a database interface function and a network communication interface function.

8. The container image security detection method according to claim 1, characterized in that, Also includes: The network communication packets generated during the monitoring and debugging process are used to determine whether the content of the network communication packets contains sensitive information.

9. The container image security detection method according to any one of claims 1 to 8, characterized in that, After executing the container image to be detected, the process also includes: The environment variables during the execution of the container image to be tested are obtained and static analysis is performed on the environment variables to determine whether the environment variables in the container image to be tested contain sensitive information based on the static analysis results.

10. The container image security detection method according to any one of claims 1 to 8, characterized in that, The method further includes: A static scan is performed on all files in the container image to be detected to determine whether the container image to be detected contains sensitive information; The static scanning includes at least one of the following methods: A static scan is performed on the filename extensions of all files in the container image to be detected to determine whether the container image to be detected contains a key file. Static scanning of all files is performed by matching keywords using regular expressions to determine whether the container image to be detected contains sensitive information. A static scan is performed on the build commands of the container image to be detected to determine whether the container image to be detected contains sensitive information.

11. A container mirror security detection device, characterized in that, include: The static scanning module is used to perform static scanning on the executable files in the container image to be detected, and to obtain the sensitive features to be detected in the executable files of the container image to be detected; wherein, the sensitive features to be detected are features that have the possibility of dynamic change and have the possibility of containing sensitive information. The dynamic scanning module is used to execute the container image to be detected and determine the target process from the processes in the execution process of the container to be detected; wherein, the target process is the process containing the sensitive features to be detected that is statically scanned from the corresponding executable file; The detection module is used to dynamically debug the target process and determine, based on the dynamic debugging results, whether the sensitive features to be detected in the executable file of the container image to be detected actually contain sensitive information.

12. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the container image security detection method as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, Used to store computer-executable instructions, which, when loaded and executed by a processor, implement the container image security detection method as described in any one of claims 1 to 10.

Images