Container risk detection methods, devices, equipment, media and program products

Abstract

This application relates to a container risk detection method, apparatus, device, medium, and program product. The method includes monitoring whether the number of target processes in a target container that call a target file descriptor exceeds a preset threshold. If the number of target processes exceeds the preset threshold, the method obtains target flag information corresponding to the target file descriptors called by each target process, and determines whether the target container is at risk of escape based on the target flag information. This method can help improve the detection rate of vulnerability exploits in which attackers use file descriptors to perform read and write operations on the host machine.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a container risk detection method, apparatus, device, medium, and program product. Background Art

[0002] As more and more businesses appear in the form of microservices, container technology, as a hosting environment, will also appear more and more in various information businesses. If the risk of container escape attacks cannot be detected in a timely manner, it will seriously threaten the security of the underlying infrastructure of the business. Therefore, it is of great significance to improve the timeliness and real-time detection capabilities of container escape risks.

[0003] Currently, risk detection for container escape attacks mainly relies on static scanning of risk items such as the container's startup configuration information, the component versions of the container management service, and the contents of the container image file. This method can only detect some common configuration and component vulnerability risks, but cannot detect deliberately hidden malicious behavior. Summary of the Invention

[0004] Based on this, it is necessary to provide a container risk detection method, device, equipment, medium and program product that can detect the risk of container escape in response to the above technical problems.

[0005] In a first aspect, the present application provides a container risk detection method. The method comprises: monitoring whether the number of target processes in a target container exceeds a preset threshold, wherein the target process is a process that calls a target file descriptor; if the number of target processes exceeds the preset threshold, obtaining target flag information corresponding to the target file descriptors called by each target process; and determining whether the target container has an escape risk based on the target flag information corresponding to the target file descriptors called by each target process.

[0006] In one embodiment, determining whether a target container has an escape risk is performed based on target flag information corresponding to a target file descriptor called by each target process, including: for each target process, determining a first vector based on an identifier of the target process, a target file descriptor, and target flag information; calculating a vector distance between the first vector and a preset vector; and determining that the container has an escape risk if the vector distance exceeds a preset vector distance threshold.

[0007] In one embodiment, before calculating the vector distance between the first vector and the preset vector, the method further includes: obtaining initial flag information corresponding to the target process calling the target file descriptor within the initial time period; and determining the preset vector based on the identifier of the target process, the target file descriptor, and the initial flag information.

[0008] In one embodiment, if the vector distance exceeds a preset vector distance threshold, before determining that the container has an escape risk, the method includes: obtaining normal flag information corresponding to the target file descriptor called by the normally running process in the target container during different monitoring periods; for each monitoring period, determining a reference vector based on the identifier of the normally running process, the target file descriptor, and the normal flag information; and determining the preset vector distance threshold based on the reference vector.

[0009] In one embodiment, the method further includes: determining whether each target process meets the inheritance conditions; if each target process meets the inheritance conditions, executing the step of determining whether the target container has an escape risk based on the target flag information of the file descriptor corresponding to each target process.

[0010] In one embodiment, judging whether each target process satisfies an inheritance condition according to each target process includes: determining the first process that first calls the target file descriptor from each target process; if it is determined that each target process except the first process is a child process of the first process, judging whether the inheritance control bit of the target file descriptor allows the child process to call; if the inheritance control bit of the target file descriptor allows the child process to call, then determining that each target process satisfies the inheritance condition.

[0011] In one embodiment, the method further includes: if each target process does not meet the inheritance condition, determining that the target container has an escape risk.

[0012] In one embodiment, the method further includes: if it is determined that the target container has an escape risk, determining the calling file of the target process according to the target file descriptor; and detecting and processing the calling file according to the type of the calling file.

[0013] In a second aspect, the present application also provides a container risk detection device. The device includes:

[0014] A monitoring module, configured to monitor whether the number of target processes in the target container exceeds a preset threshold, wherein the target process is the process that calls the target file descriptor;

[0015] An acquisition module is used to obtain target flag information corresponding to the target file descriptor called by each target process if the number of target processes exceeds a preset threshold;

[0016] The first determination module is used to determine whether the target container has an escape risk based on the target flag information corresponding to the target file descriptor called by each target process and the target flag information corresponding to each target process.

[0017] In one embodiment, the first determination module is specifically used to determine a first vector for each target process based on the identifier of the target process, the target file descriptor, and the target flag information; calculate the vector distance between the first vector and a preset vector; if the vector distance exceeds a preset vector distance threshold, determine that the container has an escape risk.

[0018] In one embodiment, the first determining module is specifically configured to obtain initial flag information corresponding to a target process calling a target file descriptor within an initial period; and determine a preset vector according to an identifier of the target process, the target file descriptor, and the initial flag information.

[0019] In one embodiment, a second determination module is further included, which is used to obtain normal flag information corresponding to the target file descriptor called by the normally running process in the target container during different monitoring periods; for each monitoring period, a reference vector is determined based on the identifier of the normally running process, the target file descriptor, and the normal flag information; and a preset vector distance threshold is determined based on the reference vector.

[0020] In one embodiment, a judgment module is further included for judging whether each target process meets the inheritance conditions; if each target process meets the inheritance conditions, a step of determining whether the target container has an escape risk is executed based on the target flag information of the file descriptor corresponding to each target process.

[0021] In one embodiment, the judgment module is specifically used to determine the first process that first calls the target file descriptor from each target process; if it is determined that all processes except the first process in each target process are child processes of the first process, then determine whether the inheritance control bit of the target file descriptor allows child process calls; if the inheritance control bit of the target file descriptor allows child process calls, then determine that each target process meets the inheritance conditions.

[0022] In one embodiment, a third determination module is further included, which is used to determine that the target container has an escape risk if each target process does not meet the inheritance condition.

[0023] In one embodiment, a detection module is further included for determining the calling file of the target process based on the target file descriptor if it is determined that the target container has an escape risk; and detecting and processing the calling file based on the type of the calling file.

[0024] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements any container risk detection method described in the first aspect when executing the computer program.

[0025] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the container risk detection method described in any one of the first aspects.

[0026] In a fifth aspect, the present application further provides a computer program product, comprising a computer program that, when executed by a processor, implements the container risk detection method described in any one of the first aspects.

[0027] The container risk detection method, apparatus, device, medium, and program product described above monitor whether the number of target processes calling target file descriptors within a target container exceeds a preset threshold. If the number of target processes exceeds the preset threshold, the method obtains the target flag information corresponding to the target file descriptors called by each target process and, based on the target flag information, determines whether the target container is at risk of escape. By monitoring the calling of file descriptors and determining whether there is a container escape risk by calling file descriptors across processes based on the flag information of the file descriptors, the method helps improve the detection rate of vulnerability exploits in which attackers use file descriptors to perform read and write operations on the host machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flowchart of the current container risk detection method;

[0029] Figure 2 1 is a flow chart of a container risk detection method according to an embodiment;

[0030] Figure 3 Schematic diagram of a process for detecting container risk in another embodiment;

[0031] Figure 4 Schematic diagram of a process for detecting container risk in another embodiment;

[0032] Figure 5 Schematic diagram of a process for detecting container risk in another embodiment;

[0033] Figure 6 Schematic diagram of a process for detecting container risk in another embodiment;

[0034] Figure 7 Schematic diagram of a process for detecting container risk in another embodiment;

[0035] Figure 8 Schematic diagram of a process for detecting container risk in another embodiment;

[0036] Figure 9Schematic diagram of a process for detecting container risk in another embodiment;

[0037] Figure 10 is a structural block diagram of a container risk detection device in one embodiment;

[0038] Figure 11 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0040] Currently, if Figure 1 As shown in the figure, risk detection for container escape attacks mainly relies on static scanning of risk items on the container startup configuration information, component versions of container management services, and container image file contents. This method can only detect some common configuration and component vulnerability risks.

[0041] Due to the isolation mechanism of the container and the existing escape vulnerability principle, the existence of the host machine's mnt file namespace and the chroot process access directory access control security mechanism makes it often impossible for the container to write to some file programs controlled by the host machine due to the limitation of the file namespace when implementing the escape. However, the file descriptors opened by the running process are not subject to the control of this security mechanism and may become the focus of the escape vulnerability. Therefore, this application monitors the status of the file descriptor, analyzes the flag information of the file descriptor for the detected abnormal situation, and determines whether there is an abnormal cross-process access to the file descriptor risk behavior, which helps to improve the detection rate of the vulnerability exploitation behavior of the attacker using the file descriptor to perform host machine read and write operations.

[0042] like Figure 2 As shown, a container risk detection method is provided. This method is described using a terminal as an example. It is understood that the method can also be applied to a server, or to a system including a terminal and a server, and implemented through interaction between the terminal and the server. The method includes the following steps:

[0043] Step 201: monitor whether the number of target processes in the target container exceeds a preset threshold.

[0044] The target process is the process that calls the target file descriptor. The target container is the container running on the host machine to be tested for container escape risks. The target file descriptor is the file descriptor being monitored. Typically, processes access files through file descriptors. When different processes open the same file, they create different file descriptors. The number of processes calling the target file descriptor, i.e., target processes, is monitored to see if it exceeds a preset threshold. Optionally, the preset threshold is an integer greater than 2. This means that multiple target processes are monitored to see if they are accessing the same target file descriptor simultaneously.

[0045] Step 202: If the number of target processes exceeds a preset threshold, the target flag information corresponding to the target file descriptor called by each target process is obtained.

[0046] If there are more than two target processes, meaning there may be multiple target processes, accessing the same target file descriptor across multiple target processes poses a risk. Therefore, all target processes are considered suspicious. The target flag information is the file descriptor flag information corresponding to the target file descriptor called by the target process. Optionally, the flags may include inheritance control bits and access flags. Based on the target process's process ID, the process information for each target process, the file descriptor called by each target process, and the file descriptor flag information can be retrieved from the corresponding file directory on the host machine.

[0047] Step 203 : Determine whether the target container has an escape risk based on the target flag information corresponding to the target file descriptor called by each target process.

[0048] Among them, the container escape risk refers to the risk behavior that the target container can access the host's resources and obtain the host's permissions. Based on the target flag information obtained above, it can be determined whether the calling range of the target file descriptor exceeds the normal business request range. If it exceeds the normal business request range, it means that the target container may have an escape risk.

[0049] In the above embodiment, the number of target processes calling the target file descriptor within the target container is monitored to see if it exceeds a preset threshold. If the number of target processes exceeds the preset threshold, the target flag information corresponding to the target file descriptor called by each target process is obtained. Based on the target flag information, it is determined whether the target container is at risk of escape. By monitoring the calling of file descriptors and determining whether there is a container escape risk by calling file descriptors across processes based on the flag information of the file descriptors, this helps to improve the detection rate of vulnerability exploits in which attackers use file descriptors to perform read and write operations on the host machine.

[0050] In one embodiment, the step of determining whether the target container has an escape risk based on the target flag information corresponding to the target file descriptor called by each target process is as follows: Figure 3 As shown, including:

[0051] Step 301: For each target process, determine a first vector according to the target process identifier, target file descriptor, and target flag information.

[0052] For each target process, the target process identifier, target file descriptor and target flag information are vectorized.

[0053] Step 302: Calculate the vector distance between the first vector and the preset vector.

[0054] Calculate the vector distance between the first vector and the preset vector. Optionally, consider important flag information in the target flag information, such as the inheritance control bit and the access flag bit, as components with a large weight for the vector distance calculation. The preset vector may be a vector determined based on the target process identifier, the target file descriptor, and the target flag information after each target process has been running normally for a preset period of time.

[0055] Optionally, the default vector is calculated as Figure 4 As shown, including:

[0056] Step 401: Obtain initial flag information corresponding to the target file descriptor called by the target process within the initial period.

[0057] The initial period is a period of normal operation of the target process, and the flag information corresponding to the target file descriptor called by the target process during the normal operation period is obtained as the initial flag information.

[0058] Step 402: Determine a preset vector according to the target process identifier, the target file descriptor, and the initial flag information.

[0059] Obtain the identifier of the target process, the target file descriptor, and the initial flag information within the initial time period to form a relationship table of the target process, the target file descriptor, and the initial flag information. Then, perform statistics and vectorization on the above relationship table. Since the initial flag information will change with time, several vectors can be obtained. Optionally, the vectors of the initial time period of several vectors can be determined as preset vectors, or the centers of several vectors can be determined based on several vectors, and the vector at the center position can be determined as the preset vector.

[0060] Step 303: If the vector distance exceeds a preset vector distance threshold, it is determined that the container has an escape risk.

[0061] The preset vector distance threshold is a baseline value of the vector distance determined based on the container's historical normal operation period. The baseline value may optionally be a vector distance range or an optional value. When the vector distance calculated based on the first vector exceeds the preset vector distance threshold, i.e., the vector distance exceeds the normal vector distance range or optional value, i.e., exceeds the normal service request range, the container may be determined to be at risk of escape.

[0062] In the above embodiment, by vectorizing the target file descriptor and the target flag information and calculating the vector distance, it is determined whether the target file descriptor call under the target process exceeds the normal business request range, thereby improving the accuracy of container escape behavior judgment.

[0063] In one embodiment, the step of determining the preset vector distance threshold is as follows: Figure 5 As shown, including:

[0064] Step 501: During different monitoring periods, obtain normal flag information corresponding to a target file descriptor called by a process running normally in a target container.

[0065] During different monitoring periods, since the flag information changes dynamically, the normal flag information corresponding to the target file descriptor called by the normally running process in the target container is obtained.

[0066] Step 502: For each monitoring period, a reference vector is determined according to the identifier of the normally running process, the target file descriptor, and the normal flag information.

[0067] The identifier of the normally running process, the target file descriptor, and the normal flag information are vectorized to obtain several reference vectors. The reference vectors all meet the normal service request range of the file descriptor call during the normal operation process.

[0068] Step 503: Determine a preset vector distance threshold according to the reference vector.

[0069] Relatively important flag information, such as the inheritance control bit and the access flag bit, in the reference vector is used as a heavily weighted component to calculate the vector distance between the reference vectors, and a preset vector threshold is determined based on the calculation result. Optionally, the maximum value of the multiple calculated vector distances can be used as an optional value to determine the preset vector threshold, or a vector distance range can be determined based on the multiple calculated vector distances, and the vector distance range can be determined as the preset vector threshold.

[0070] In the embodiment of the present application, according to the common business call experience, when multiple processes call the same file descriptor, it is mainly because the previous process copies the child process for subsequent calls. Therefore, the inheritance relationship of multiple processes is first determined, such as Figure 6As shown, the steps include:

[0071] Step 601: Determine whether each target process meets the inheritance conditions.

[0072] Optionally, the steps for determining whether each target process meets the inheritance conditions are as follows: Figure 7 As shown, including:

[0073] Step 701: Determine the first process that first calls the target file descriptor from among the target processes.

[0074] The process that first calls the target file descriptor is determined according to the process number of each target process, and the process is determined to be the first process.

[0075] Step 702: If it is determined that all target processes except the first process are child processes of the first process, it is determined whether the inheritance control bit of the target file descriptor is to allow child process calls.

[0076] The other target processes are judged against the first process to determine whether the other target processes are all child processes copied from the first process, and simultaneously determine whether the inheritance control bit in the flag information of the target file descriptor is to allow child process calls.

[0077] Step 703: If the inheritance control bit of the target file descriptor is to allow child process calls, it is determined that each target process meets the inheritance conditions.

[0078] If the inheritance control bit of the target file descriptor is to allow the child process to call, that is, the target process meets the inheritance conditions. If the inheritance control bit of the target file descriptor is to not allow the child process to call, then the child process and the first process should not call the same target file descriptor, that is, each target process does not meet the inheritance conditions.

[0079] Step 602: If each target process meets the inheritance condition, a step of determining whether the target container has an escape risk is executed based on the target flag information of the file descriptor corresponding to each target process.

[0080] If each target process meets the inheritance conditions, the target flag information of the file descriptor corresponding to each target process is obtained, the flag vector distance is calculated, and then the step of determining whether the target container has an escape risk is executed based on the vector distance and the preset vector distance threshold.

[0081] Optionally, if each target process does not meet the inheritance condition, it is determined that the target container has an escape risk.

[0082] If the target processes do not meet the inheritance conditions, it may be an attack in which the attacker deliberately copies the child process to call the file descriptor, which means that the target container is at risk of escape.

[0083] In the embodiment of the present application, after determining the escape risk of the target container, the processing operation performed on the target container is as follows: Figure 8 As shown, including:

[0084] Step 801: If it is determined that the target container has an escape risk, the calling file of the target process is determined according to the target file descriptor.

[0085] When it is determined that the target container has an escape risk, the repeatedly called file descriptor is addressed to a specific file on the host machine.

[0086] Step 802: Detect and process the called file according to the type of the called file.

[0087] Optionally, after identifying the calling file, observe the file's morphology to determine its type. If the calling file is a binary program or script with executable permissions, extract and process the file sample, then perform malicious code detection such as backdoor detection and sandbox test analysis for further confirmation. If the calling file is a normal data file, perform a data audit to check for dirty data that may contaminate the business logic.

[0088] In the above embodiment, after determining that the target container has an escape risk, a processing method is determined according to the calling file type of the target process to avoid the attack risk caused by the container escape.

[0089] In the examples of this application, please refer to Figure 9 , which shows a flow chart of a container risk detection method provided by an embodiment of the present application, the container risk detection method includes the following steps:

[0090] Step 901: During different monitoring periods, obtain normal flag information corresponding to a target file descriptor called by a process running normally in a target container.

[0091] Step 902: For each monitoring period, a reference vector is determined according to the identifier of the normally running process, the target file descriptor, and the normal flag information.

[0092] Step 903: Determine a preset vector distance threshold according to the reference vector.

[0093] Step 904: monitor whether the number of target processes in the target container exceeds a preset threshold.

[0094] Step 905: If the number of target processes exceeds a preset threshold, the target flag information corresponding to the target file descriptor called by each target process is obtained.

[0095] Step 906: Determine whether each target process meets the inheritance conditions.

[0096] Step 907: If each target process meets the inheritance condition, a step of determining whether the target container has an escape risk is executed based on the target flag information of the file descriptor corresponding to each target process.

[0097] Step 908: For each target process, determine a first vector according to the target process identifier, the target file descriptor, and the target flag information.

[0098] Step 909: Calculate the vector distance between the first vector and the preset vector.

[0099] Step 910: If the vector distance exceeds a preset vector distance threshold, it is determined that the container has an escape risk.

[0100] Step 911: If it is determined that the target container has an escape risk, the calling file of the target process is determined according to the target file descriptor.

[0101] Step 912: Detect and process the called file according to the type of the called file.

[0102] After determining the calling file, observe the file morphology to determine the type of the calling file. If the calling file is a binary program or script file with executable permissions, the file sample should be extracted and processed, and then malicious code detection such as backdoor detection and sandbox trial run analysis should be performed for further confirmation.

[0103] If the called file is a normal data file, it is recommended to perform a data audit to check whether there is dirty data that pollutes the business logic.

[0104] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0105] Based on the same inventive concept, embodiments of the present application also provide a container risk detection device for implementing the aforementioned container risk detection method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more container risk detection device embodiments provided below can be found in the above-described limitations of the container risk detection method and will not be further elaborated here.

[0106] In one embodiment, Figure 10 As shown, a container risk detection device 1000 is provided, comprising: a monitoring module 1001, an acquisition module 1002 and a first determination module 1003, wherein:

[0107] The monitoring module 1001 is used to monitor whether the number of target processes in the target container exceeds a preset threshold, wherein the target process is the process that calls the target file descriptor;

[0108] The acquisition module 1002 is used to acquire target flag information corresponding to the target file descriptor called by each target process if the number of target processes exceeds a preset threshold;

[0109] The first determining module 1003 is configured to determine whether a target container has an escape risk based on target flag information corresponding to a target file descriptor called by each target process and target flag information corresponding to each target process.

[0110] In one embodiment, the first determination module 1003 is specifically used to determine a first vector for each target process based on the identifier of the target process, the target file descriptor, and the target flag information; calculate the vector distance between the first vector and a preset vector; if the vector distance exceeds a preset vector distance threshold, determine that the container has an escape risk.

[0111] In one embodiment, the first determining module 1003 is specifically configured to obtain initial flag information corresponding to the target process calling the target file descriptor within an initial period; and determine a preset vector according to the target process identifier, the target file descriptor, and the initial flag information.

[0112] In one embodiment, a second determination module is further included, which is used to obtain normal flag information corresponding to the target file descriptor called by the normally running process in the target container during different monitoring periods; for each monitoring period, determine a reference vector based on the identifier of the normally running process, the target file descriptor, and the normal flag information; and determine a preset vector distance threshold based on the reference vector.

[0113] In one embodiment, a judgment module is further included for judging whether each target process meets the inheritance conditions; if each target process meets the inheritance conditions, a step of determining whether the target container has an escape risk based on the target flag information of the file descriptor corresponding to each target process is executed.

[0114] In one embodiment, the judgment module is specifically used to determine the first process that first calls the target file descriptor from each target process; if it is determined that all processes except the first process in each target process are child processes of the first process, then determine whether the inheritance control bit of the target file descriptor allows child process calls; if the inheritance control bit of the target file descriptor allows child process calls, then determine that each target process meets the inheritance conditions.

[0115] In one embodiment, a third determination module is further included, configured to determine that the target container has an escape risk if each target process does not meet the inheritance condition.

[0116] In one embodiment, a detection module is further included for determining the calling file of the target process according to the target file descriptor if it is determined that the target container has an escape risk; and detecting and processing the calling file according to the type of the calling file.

[0117] Each module in the container risk detection device described above may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor within a computer device in hardware form, or may be stored in a computer device memory in software form, allowing the processor to call and execute the corresponding operations of each module.

[0118] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 11As shown. The computer device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via wired or wireless means, and the wireless means can be implemented via Wi-Fi, a mobile cellular network, NFC (near-field communication), or other technologies. When executed by the processor, the computer program implements a container risk detection method. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0119] Those skilled in the art will understand that Figure 11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0120] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented: monitoring whether the number of target processes in a target container exceeds a preset threshold, wherein the target process is a process that calls a target file descriptor; if the number of target processes exceeds the preset threshold, obtaining target flag bit information corresponding to the target file descriptor called by each target process; and determining whether the target container has an escape risk based on the target flag bit information corresponding to the target file descriptor called by each target process.

[0121] In one embodiment, when executing the computer program, the processor further implements the following steps: for each target process, determining a first vector based on the identifier of the target process, the target file descriptor, and the target flag information; calculating a vector distance between the first vector and a preset vector; and determining that the container has an escape risk if the vector distance exceeds a preset vector distance threshold.

[0122] In one embodiment, when executing the computer program, the processor further implements the following steps: obtaining initial flag information corresponding to the target process calling the target file descriptor within the initial period; and determining a preset vector according to the identifier of the target process, the target file descriptor, and the initial flag information.

[0123] In one embodiment, when executing the computer program, the processor further implements the following steps: obtaining normal flag information corresponding to a target file descriptor called by a normally running process in a target container during different monitoring periods; determining a reference vector for each monitoring period based on an identifier of the normally running process, the target file descriptor, and the normal flag information; and determining a preset vector distance threshold based on the reference vector.

[0124] In one embodiment, when executing the computer program, the processor further implements the following steps: determining whether each target process meets the inheritance conditions; if each target process meets the inheritance conditions, executing the step of determining whether the target container has an escape risk based on the target flag bit information of the file descriptor corresponding to each target process.

[0125] In one embodiment, when the processor executes the computer program, the following steps are further implemented: determining the first process that first calls the target file descriptor from each target process; if it is determined that all processes except the first process in each target process are child processes of the first process, then determining whether the inheritance control bit of the target file descriptor allows child process calls; if the inheritance control bit of the target file descriptor allows child process calls, then determining that each target process meets the inheritance conditions.

[0126] In one embodiment, when executing the computer program, the processor further implements the following steps: if each target process does not meet the inheritance condition, determining that the target container has an escape risk.

[0127] In one embodiment, when executing the computer program, the processor further implements the following steps: if it is determined that the target container has an escape risk, determining the calling file of the target process based on the target file descriptor; and detecting and processing the calling file based on the type of the calling file.

[0128] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: monitoring whether the number of target processes in a target container exceeds a preset threshold, wherein the target process is a process that calls a target file descriptor; if the number of target processes exceeds the preset threshold, obtaining target flag bit information corresponding to the target file descriptors called by each target process; and determining whether the target container has an escape risk based on the target flag bit information corresponding to the target file descriptors called by each target process.

[0129] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented: for each target process, determining a first vector based on an identifier of the target process, a target file descriptor, and target flag information; calculating a vector distance between the first vector and a preset vector; and determining that the container has an escape risk if the vector distance exceeds a preset vector distance threshold.

[0130] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: obtaining initial flag information corresponding to the target process calling the target file descriptor within the initial period; and determining a preset vector based on the identifier of the target process, the target file descriptor, and the initial flag information.

[0131] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: during different monitoring periods, normal flag information corresponding to a target file descriptor called by a normally running process in a target container is obtained; for each monitoring period, a reference vector is determined based on an identifier of the normally running process, the target file descriptor, and the normal flag information; and a preset vector distance threshold is determined based on the reference vector.

[0132] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: determining whether each target process meets the inheritance conditions; if each target process meets the inheritance conditions, executing the step of determining whether the target container has an escape risk based on the target flag bit information of the file descriptor corresponding to each target process.

[0133] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the first process that first calls the target file descriptor from each target process; if it is determined that all processes except the first process in each target process are child processes of the first process, then determining whether the inheritance control bit of the target file descriptor allows child process calls; if the inheritance control bit of the target file descriptor allows child process calls, then determining that each target process meets the inheritance conditions.

[0134] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if each target process does not meet the inheritance condition, it is determined that the target container has an escape risk.

[0135] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if it is determined that the target container has an escape risk, the calling file of the target process is determined based on the target file descriptor; and the calling file is detected and processed based on the type of the calling file.

[0136] In one embodiment, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the following steps: monitoring whether the number of target processes in a target container exceeds a preset threshold, wherein the target process is a process that calls a target file descriptor; if the number of target processes exceeds the preset threshold, obtaining target flag bit information corresponding to the target file descriptors called by each target process; and determining whether the target container has an escape risk based on the target flag bit information corresponding to the target file descriptors called by each target process.

[0137] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented: for each target process, determining a first vector based on an identifier of the target process, a target file descriptor, and target flag information; calculating a vector distance between the first vector and a preset vector; and determining that the container has an escape risk if the vector distance exceeds a preset vector distance threshold.

[0138] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: obtaining initial flag information corresponding to the target process calling the target file descriptor within the initial period; and determining a preset vector based on the identifier of the target process, the target file descriptor, and the initial flag information.

[0139] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: during different monitoring periods, normal flag information corresponding to a target file descriptor called by a normally running process in a target container is obtained; for each monitoring period, a reference vector is determined based on an identifier of the normally running process, the target file descriptor, and the normal flag information; and a preset vector distance threshold is determined based on the reference vector.

[0140] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: determining whether each target process meets the inheritance conditions; if each target process meets the inheritance conditions, executing the step of determining whether the target container has an escape risk based on the target flag bit information of the file descriptor corresponding to each target process.

[0141] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the first process that first calls the target file descriptor from each target process; if it is determined that all processes except the first process in each target process are child processes of the first process, then determining whether the inheritance control bit of the target file descriptor allows child process calls; if the inheritance control bit of the target file descriptor allows child process calls, then determining that each target process meets the inheritance conditions.

[0142] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if each target process does not meet the inheritance condition, it is determined that the target container has an escape risk.

[0143] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if it is determined that the target container has an escape risk, the calling file of the target process is determined based on the target file descriptor; and the calling file is detected and processed based on the type of the calling file.

[0144] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0145] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0146] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0147] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A container risk detection method, characterized in that: The method comprises: Monitoring whether the number of target processes in the target container exceeds a preset threshold, wherein the target process is a process that calls the target file descriptor; If the number of the target processes exceeds the preset threshold, obtaining target flag information corresponding to the target file descriptor called by each target process; Determining whether the target container has an escape risk according to target flag information corresponding to the target file descriptor called by each target process; The determining, based on the target flag information corresponding to the target file descriptor called by each target process, whether the target container has an escape risk includes: For each target process, determining a first vector according to an identifier of the target process, the target file descriptor, and the target flag bit information; Obtaining initial flag information corresponding to the target file descriptor called by the target process within an initial period; Determining a preset vector according to the identifier of the target process, the target file descriptor, and the initial flag bit information; Calculating a vector distance between the first vector and the preset vector; If the vector distance exceeds a preset vector distance threshold, it is determined that the container has an escape risk.

2. The method according to claim 1, characterized in that If the vector distance exceeds a preset vector distance threshold, before determining that the container has an escape risk, the method includes: During different monitoring periods, obtaining normal flag information corresponding to calls to the target file descriptor by a process running normally in the target container; For each monitoring period, determining a reference vector according to the identifier of the normally running process, the target file descriptor, and the normal flag bit information; The preset vector distance threshold is determined according to the reference vector.

3. The method according to claim 1, characterized in that The method further comprises: Determining whether each target process meets the inheritance condition; If each target process meets the inheritance condition, a step of determining whether the target container has an escape risk is performed based on the target flag bit information of the file descriptor corresponding to each target process.

4. The method according to claim 3, characterized in that The step of determining, based on each target process, whether each target process satisfies an inheritance condition includes: Determining a first process that first calls the target file descriptor from among the target processes; If it is determined that all processes except the first process in the target processes are child processes of the first process, determining whether the inheritance control bit of the target file descriptor is set to allow child process calls; If the inheritance control bit of the target file descriptor is to allow child process calls, it is determined that each target process meets the inheritance condition.

5. The method according to claim 3, characterized in that The method further comprises: If each of the target processes does not satisfy the inheritance condition, it is determined that the target container has an escape risk.

6. The method according to claim 1, characterized in that The method further comprises: If it is determined that the target container has an escape risk, determining the calling file of the target process according to the target file descriptor; According to the type of the called file, the called file is detected and processed.

7. A container risk detection device, characterized in that: The device comprises: A monitoring module, configured to monitor whether the number of target processes in the target container exceeds a preset threshold, wherein the target process is a process that calls the target file descriptor; an acquisition module, configured to acquire target flag information corresponding to the target file descriptor called by each target process if the number of the target processes exceeds the preset threshold; A first determining module is configured to determine whether the target container has an escape risk based on target flag information corresponding to the target file descriptor called by each target process and target flag information corresponding to each target process; The first determination module is specifically configured to determine, for each target process, a first vector based on the target process identifier, the target file descriptor, and the target flag information; obtain initial flag information corresponding to the target file descriptor called by the target process within an initial period; determine a preset vector based on the target process identifier, the target file descriptor, and the initial flag information; calculate a vector distance between the first vector and the preset vector; and determine that the container has an escape risk if the vector distance exceeds a preset vector distance threshold.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images