Method, device, medium, equipment and product for detecting malicious files in container images

Abstract

The present disclosure relates to a method, device, medium, equipment and product for detecting malicious files in container images. The method includes: matching the target container image to be detected for malicious files with a knowledge base of image detection results; the knowledge base of image detection results includes at least malicious file detection results of multiple base images; for the first object in the target container image that matches the malicious file detection result, reusing the malicious file detection result of the same object in the knowledge base of image detection results; performing malicious file detection on the second object in the target container image that does not match the malicious file detection result. In this way, the characteristic that there are a large number of identical image files between different container images can be utilized, and the knowledge base of image detection results can be pre-built at least based on the base image. Thus, the malicious file detection results of the same object in the knowledge base can be reused, thereby reducing repeated detection work, improving the detection efficiency of malicious files in container images, and reducing performance loss and time overhead.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method, device, medium, equipment and product for detecting malicious files in a container image. Background Art

[0002] With the increasing popularity of container technology, service deployment through containers has become more common, which has also significantly expanded the scope of container security issues. In the process of cloud-native continuous integration / continuous deployment and release, a large number of container images are frequently built. The detection of newly built container images is a very important checkpoint. The detection efficiency of malicious files in container images has a very important impact on the continuous integration / continuous deployment, testing, and production deployment stages. Among them, malicious file detection is different from other software detection. It requires that the detection content covers all files in the container image. At this stage, the commonly used detection method is to perform full detection on all files in the container image. However, container images usually contain multiple layers and multiple files. This detection method often consumes a lot of computing resources and time resources, which puts great pressure on business resources. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] In a first aspect, the present disclosure provides a method for detecting malicious files in a container image, comprising:

[0005] Matching the target container image to be subjected to malicious file detection with a preset image detection result knowledge base; wherein the image detection result knowledge base at least includes malicious file detection results of multiple base images;

[0006] For a first object in the target container image that matches a malicious file detection result, reuse the malicious file detection result of the same object in the image detection result knowledge base; and

[0007] Perform malicious file detection on the second object in the target container image that does not match the malicious file detection result.

[0008] In a second aspect, the present disclosure provides a device for detecting malicious files in a container image, comprising:

[0009] A matching module, used to match a target container image to be subjected to malicious file detection with a preset image detection result knowledge base; wherein the image detection result knowledge base at least includes malicious file detection results of multiple base images;

[0010] a multiplexing module, configured to reuse the malicious file detection result of the same object in the image detection result knowledge base for the first object matched with the malicious file detection result in the target container image; and

[0011] The detection module is used to perform malicious file detection on the second object in the target container image that does not match the malicious file detection result.

[0012] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the method for detecting malicious files in a container image provided in the first aspect of the present disclosure.

[0013] In a fourth aspect, the present disclosure provides an electronic device, including:

[0014] a storage device having a computer program stored thereon;

[0015] A processing device is used to execute the computer program in the storage device to implement the steps of the method for detecting malicious files in the container image provided by the first aspect of the present disclosure.

[0016] In a fifth aspect, the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method for detecting malicious files in a container image provided in the first aspect of the present disclosure.

[0017] In the above technical scheme, when malicious file detection is performed on the target container image, the target container image is first matched with a pre-set image detection result knowledge base; then, for the first object in the target container image that matches the malicious file detection result, the malicious file detection result of the same object in the image detection result knowledge base is reused, and malicious file detection is only performed on the second object in the target container image that does not match the malicious file detection result. In this way, the characteristic that there are a large number of identical image files between different container images can be utilized, and the image detection result knowledge base can be pre-built at least based on the basic image. Therefore, when malicious file detection is performed on the target container image, the malicious file detection results of the same object in the image detection result knowledge base can be reused to reduce repeated detection work, thereby improving the detection efficiency of malicious files in the container image and reducing performance loss and time overhead. In actual cloud native scenarios, the frequency of malicious file detection during the release of image packages is very high. The use of the detection method provided by the present disclosure is conducive to the rapid development and iteration of software in cloud native scenarios, and can maintain a faster package output speed while ensuring that the container image file has a certain degree of reliability.

[0018] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0020] Figure 1 The present invention is a flowchart of a method for detecting malicious files in a container image according to an exemplary embodiment.

[0021] Figure 2 The present invention is a process diagram of a method for detecting malicious files in a container image according to an exemplary embodiment.

[0022] Figure 3 The figure is a schematic diagram showing a method for building a knowledge base of image detection results according to an exemplary embodiment.

[0023] Figure 4 The present invention is a schematic diagram showing a process of matching a target container image with an image detection result knowledge base at an image granularity according to an exemplary embodiment.

[0024] Figure 5 The present invention is a schematic diagram showing a process of matching a target container image with an image detection result knowledge base at an image layer granularity according to an exemplary embodiment.

[0025] Figure 6 The present invention is a schematic diagram showing a process of matching a target container image with an image detection result knowledge base at an image file granularity according to an exemplary embodiment.

[0026] Figure 7 The present invention is a schematic diagram showing image file comparison between a target container image and a target version image according to an exemplary embodiment.

[0027] Figure 8 The present invention is a block diagram of a device for detecting malicious files in a container image according to an exemplary embodiment.

[0028] Fig. 9 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0029] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0030] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0031] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0032] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0033] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0034] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0035] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0036] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0037] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0038] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0039] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0040] Figure 1 FIG. 1 is a flow chart showing a method for detecting malicious files in a container image according to an exemplary embodiment. Figure 1 As shown, the method for detecting malicious files in the container image may include S101 to S103.

[0041] In S101, the target container image to be detected for malicious files is matched with a preset image detection result knowledge base.

[0042] In the present disclosure, a container image is a read-only file system snapshot containing an application and all its dependencies, which is used to create a consistent execution environment when the container is running. Among them, the container image can be a Union File System (Union File System, UnionFS), or other types of file systems such as a B-tree File System (Btrfs), an Extended File System (Ext), etc. Among them, UnionFS is a file system service that can mount multiple directories together to make it look like a single directory, thereby achieving the superposition and reuse of files and directories. A container image can include one or more image layers (layer), wherein each image layer can include one or more image files. Among them, the image layer refers to multiple independent layers contained in the container image, and each layer represents a set of file changes.

[0043] Malicious files refer to files that are specifically designed to damage, destroy, steal data, or access computer systems without authorization. Malicious files in this disclosure refer to malicious files stored in container images.

[0044] In cloud-native scenarios, most business images (where the target container image is a business image) are directly derived from an open-source base image or a custom image that is rebuilt based on an open-source base image. Therefore, there are usually a large number of identical image files between the business image and the open-source base image. Therefore, the open-source base image can be pre-detected for malicious files to build a knowledge base of image detection results, thereby accelerating malicious file detection using the knowledge base of image detection results. Among them, the base image is an image built on the basis of a computer operating system. It is a basic template for creating a container, which includes the data required to run the container. The business image is built on top of the base image, and includes the application and all its dependent images. It can be used directly to deploy the application, that is, the base image is used as a template to build a new business image.

[0045] The image detection result knowledge base includes at least the malicious file detection results of multiple base images, that is, the image detection result knowledge base is constructed at least based on the base image. Among them, the image detection result knowledge base may include the malicious file detection results of multiple base images, and may also include the malicious file scanning results of at least one business image. That is, the image detection result knowledge base includes the malicious file detection results of multiple reference images, and the multiple reference images include at least multiple base images. The multiple reference images may only include multiple base images, or include multiple base images and at least one business image at the same time.

[0046] In S102, for the first object in the target container image that matches the malicious file detection result, the malicious file detection result of the same object in the image detection result knowledge base is reused.

[0047] In S103, malicious file detection is performed on the second object in the target container image that does not match the malicious file detection result.

[0048] In the present disclosure, the first object is an identical image file between a target container image and a plurality of reference images, wherein the first object and the second object constitute the target container image.

[0049] In one implementation, the target container image is matched with an image detection result knowledge base, and malicious file detection results of some image files (i.e., the first object) in the target container image are obtained from the image detection result knowledge base. At this time, these malicious file detection results can be reused, and then the malicious file detection operation is performed only on the image files (i.e., the second object) in the target container image that do not match the malicious file detection results.

[0050] In another embodiment, the target container image is matched with the image detection result knowledge base, and the malicious file detection results of all image files in the target container image are obtained from the image detection result knowledge base. At this time, these malicious file detection results can be directly reused, that is, the malicious file detection results of all image files in the target container image can be directly obtained through the image detection result knowledge base. At this time, there is no need to perform malicious file detection operations.

[0051] In the above technical scheme, when malicious file detection is performed on the target container image, the target container image is first matched with a pre-set image detection result knowledge base; then, for the first object in the target container image that matches the malicious file detection result, the malicious file detection result of the same object in the image detection result knowledge base is reused, and malicious file detection is only performed on the second object in the target container image that does not match the malicious file detection result. In this way, the characteristic that there are a large number of identical image files between different container images can be utilized, and the image detection result knowledge base can be pre-built at least based on the basic image. Therefore, when malicious file detection is performed on the target container image, the malicious file detection results of the same object in the image detection result knowledge base can be reused to reduce repeated detection work, thereby improving the detection efficiency of malicious files in the container image and reducing performance loss and time overhead. In actual cloud native scenarios, the frequency of malicious file detection during the release of image packages is very high. The use of the detection method provided by the present disclosure is conducive to the rapid development and iteration of software in cloud native scenarios, and can maintain a faster package output speed while ensuring that the container image file has a certain degree of reliability.

[0052] The following is a detailed description of the method for constructing the above-mentioned image detection result knowledge base.

[0053] In actual application scenarios, most business environment images will directly use the base image, or create a custom business image based on the base image. Therefore, the image detection result knowledge base will cover most of the business environments that need to be detected. Based on this actual image application feature, the base image is pre-detected, thereby providing conditional support for image detection acceleration.

[0054] In one embodiment, if Figure 2 and Figure 3 As shown, the basic image provided by the open source image repository or the internal image repository of the enterprise is used as the image source to perform basic image detection, thereby building an image detection result knowledge base.

[0055] Since the open source image repository and the enterprise's internal image repository provide limited basic images, in order to improve the detection result coverage of the image detection result knowledge base, in another implementation, popular basic images in the open source community (e.g., Top1000) can be selected for detection.

[0056] Among them, the above-mentioned basic image can be an operating system (OS) image such as debain, centos, alpine, Ubuntu, etc., or it can be a middleware image such as MySQL, Nginx, Redis, MongoDB, Kafka, Httpd, etc.

[0057] like Figure 3 As shown, the base image detection can be performed in the following ways:

[0058] First, obtain the base image to be detected from the open source image repository or the image repository within the enterprise, or use the popular base image in the open source community as the base image to be detected; then, traverse and detect these base images to be detected, that is, perform full disk malicious file detection on the base images to be detected one by one, and finally obtain the malicious file detection results at the image granularity and the malicious file detection results at the image layer granularity; finally, store the malicious file detection results of the base image to be detected in the image detection result knowledge base, forming a detection result knowledge base of the base image. Among them, the malicious file detection result at the image granularity is the detection result obtained by the detection unit for one image, specifically including the malicious file detection results corresponding to each reference image; the malicious file detection result at the image layer granularity includes not only the malicious file detection results corresponding to each image layer in multiple reference images, but also specifically includes the malicious file detection results corresponding to each image file in the image layer in multiple reference images (that is, the malicious file detection results at the image file granularity).

[0059] To facilitate subsequent matching, the malicious file detection results at the image granularity (referred to as image detection results) can be stored with the image identifier as the index primary key, that is, in the image detection result knowledge base, the malicious file detection result of the reference image corresponds to the image identifier of the reference image; at the same time, the malicious file detection results at the image layer granularity (referred to as image layer detection results) can be stored with the image layer identifier as the index primary key, that is, in the image detection result knowledge base, the malicious file detection result of the image layer in the reference image corresponds to the image layer identifier of the image layer.

[0060] The image layer identifier is one of the attributes of the image layer, and is a unique identifier of the image layer, which is obtained by calculating the hash value of the image layer file. The image identifier is a unique identifier generated by combining the hash values ​​of each image layer in the image.

[0061] The above-mentioned open source image repository can be, for example, a Docker central repository (Docker Hub), wherein Docker Hub is an open source image repository for storing and sharing container images of the open source community.

[0062] The specific implementation method of matching the target container image to be detected for malicious files with a preset image detection result knowledge base in the above S101 is described in detail below.

[0063] In one implementation, the image detection result knowledge base may include malicious file detection results at three different granularities: image, image layer, and image file. At this time, the target container image may be matched with the image detection result knowledge base granularly in order from large to small granularity.

[0064] In the present disclosure, the first object includes at least one of an image, an image layer, and an image file.

[0065] like Figure 2 As shown, the target container image can be matched with the image detection result knowledge base granularity by granularity in the order of image granularity, image layer granularity, and image file granularity, so as to use historical detection records to accelerate malicious file detection, thereby obtaining the malicious file detection result of the first object from the image detection result knowledge base, and then the malicious file detection result of the same object in the image detection result knowledge base can be directly reused, that is, the malicious file detection result of the first object in the image detection result knowledge base is determined as the malicious file detection result of the first object in the target container image.

[0066] Specifically, we can first match the target container image with the image detection result knowledge base at the image granularity to determine whether there is a reference image that matches the target container image among multiple reference images (that is, determine whether there is a record in the image detection result knowledge base); if there is a reference image that matches the target container image among multiple reference images, it means that the malicious file detection result that matches the entire target container image has been matched, that is, based on the image detection result knowledge base, the malicious file detection results of all image files in the target container image are directly obtained. At this time, finer-grained matching such as image layer and image file will no longer be performed. Figure 2 and Figure 4 As shown, if there is no reference image matching the target container image among the multiple reference images, it means that there is no historical record matching the target container image in the image detection result knowledge base. At this time, you can try to match the target container image with the image detection result knowledge base at the image layer granularity. Specifically, for each target image layer in the target container image, you can match the target image layer with the image detection result knowledge base at the image layer granularity to determine whether there is an image layer matching the target image layer among the image layers of the multiple reference images. Figure 2 and Figure 5 As shown in the figure, if there is an image layer matching the target image layer among the image layers of multiple reference images, it indicates that the malicious file detection result matching the target image layer has been matched, that is, based on the image detection result knowledge base, the malicious file detection results of all image files in the target image layer are directly obtained. At this time, for the target image layer, the more fine-grained matching of image files will no longer be performed. Figure 2 and Figure 5 As shown, if there is no image layer matching the target image layer in the image layers of the multiple reference images, then an attempt is made to match the target image layer with the image detection result knowledge base at the image file granularity.

[0067] The following is a detailed description of the specific implementation method of matching the target container image with the image detection result knowledge base granularly in the order of granularity from large to small. Specifically, the step of matching the target container image with the image detection result knowledge base granularly in the order of granularity from large to small may include the following steps (11) and (12).

[0068] Step (11): Match the target container image with multiple reference images.

[0069] Step (12): If there is a reference image matching the target container image among the multiple reference images, the reference image matching the target container image is determined as the first object.

[0070] In the present disclosure, if there is a reference image that matches the target container image among multiple reference images, it means that the malicious file detection results of all image files in the target container image can be directly obtained from the image detection result knowledge base. At this time, the malicious file detection result of the reference image that matches the target container image can be determined as the malicious file detection result of the target container image, that is, these malicious file detection results are directly reused to achieve image granularity detection acceleration, and the image files that do not match the malicious file detection results are empty, and there is no need to perform malicious file detection operations.

[0071] The specific implementation method of matching the target container image with the multiple reference images in the above step (11) is described in detail below.

[0072] In one implementation, the target container image can be matched with multiple reference images based on the checksum and file size of the image. Specifically, the checksum and file size of the target container image can be obtained first; if there is a reference image with a checksum equal to the checksum of the target container image and a file size equal to the file size of the target container image among the multiple reference images, it is determined that there is a reference image that matches the target container image among the multiple reference images, and the reference image with a checksum equal to the checksum of the target container image and a file size equal to the file size of the target container image among the multiple reference images is determined as the reference image that matches the target container image; if there is no reference image with a checksum equal to the checksum of the target container image and a file size equal to the file size of the target container image among the multiple reference images, it is determined that there is no reference image that matches the target container image among the multiple reference images.

[0073] In another embodiment, in order to improve the matching efficiency, in the image detection result knowledge base, the malicious file detection result of the reference image corresponds to the image identifier of the reference image. At this time, the target image identifier of the target container image can be obtained first; if the target image identifier exists in the image detection result knowledge base, it is determined that there is a reference image matching the target container image among multiple reference images; if the target image identifier does not exist in the image detection result knowledge base, it is determined that there is no reference image matching the target container image among multiple reference images.

[0074] In the present disclosure, in the image detection result knowledge base, the malicious file detection result of the reference image corresponds to the image identifier of the reference image. At this time, the image identifier can be used as an index to determine whether there is a reference image that matches the target container image among multiple reference images. Figure 4As shown, the target image identifier of the target container image can be obtained first; then, based on the target image identifier, a matching query is performed with the image detection result in the image detection result knowledge base to determine whether the target image identifier exists in the image detection result knowledge base (specifically, the image detection result) (that is, determine whether the image detection result knowledge base has a record corresponding to the target image identifier). If the target image identifier exists in the image detection result knowledge base, it is determined that there is a reference image that matches the target container image among multiple reference images, and the image identifier among the multiple reference images is the reference image of the target image identifier, which is determined as the reference image that matches the target container image. If the target image identifier does not exist in the image detection result knowledge base, it is determined that there is no reference image that matches the target container image among the multiple reference images. At this time, an attempt can be made to match the target container image with the image detection result knowledge base from the image granularity.

[0075] When there is a reference image matching the target container image among multiple reference images, it indicates that based on the image detection result knowledge base, the malicious file detection results of all image files in the target container image can be directly obtained. At this time, the malicious file detection result corresponding to the target image identifier in the image detection result knowledge base can be determined as the malicious file detection result of the target container image.

[0076] In addition, the target image identifier of the target container image can be directly obtained based on the metadata information of the target container image.

[0077] In a possible implementation, the step of matching the target container image with the image detection result knowledge base granularly in descending order of granularity may also include the following steps (13) and (14):

[0078] Step (13): If there is no reference image matching the target container image among the multiple reference images, then for each target image layer in the target container image, the target image layer is matched with the image layers of the multiple reference images.

[0079] Step (14): If there is an image layer matching the target image layer among the image layers of the multiple reference images, the image layer matching the target image layer is determined as the first object.

[0080] like Figure 5 As shown, if there is no reference image matching the target container image among multiple reference images, the target container image can be analyzed by image layer to obtain the image layer contained in the target container image (hereinafter referred to as the target image layer), and then the target container image can be matched with the image detection result knowledge base from the image layer granularity.

[0081] Specifically, for each target image layer in the target container image, the target image layer can be matched with the image layers of multiple reference images; if there is an image layer matching the target image layer among the image layers of multiple reference images, it indicates that the malicious file detection results of all image files in the target image layer can be directly obtained through the image detection result knowledge base. At this time, the malicious file detection result of the image layer matching the target image layer can be determined as the malicious file detection result of the first object, thereby realizing image layer granularity detection acceleration, wherein the first object includes the image layer matching the target image layer.

[0082] The specific implementation method of matching the target image layer with the image layers of multiple reference images in the above step (13) is described in detail below.

[0083] In one implementation, the target image layer can be matched with the image layers of multiple reference images based on the checksum and file size of the image layer. Specifically, the checksum and file size of the target image layer can be obtained first; if there is an image layer whose checksum is equal to the checksum of the target image layer and whose file size is equal to the file size of the target image layer among the image layers of multiple reference images, it is determined that there is an image layer matching the target image layer among the image layers of multiple reference images, and the image layer whose checksum is equal to the checksum of the target image layer and whose file size is equal to the file size of the target image layer among the image layers of multiple reference images is determined as the image layer matching the target image layer. If there is no image layer whose checksum is equal to the checksum of the target image layer and whose file size is equal to the file size of the target image layer among the image layers of multiple reference images, it is determined that there is no image layer matching the target image layer among the image layers of multiple reference images.

[0084] In another implementation, in order to improve matching efficiency, in the image detection result knowledge base, the malicious file detection result of the image layer in the reference image corresponds to the image layer identifier of the image layer. At this time, the target image layer identifier of the target image layer can be obtained first; if the target image layer identifier exists in the image detection result knowledge base, it is determined that there is an image layer matching the target image layer in the image layers of multiple reference images; if the target image layer identifier does not exist in the image detection result knowledge base, it is determined that there is no image layer matching the target image layer in the image layers of multiple reference images.

[0085] In the present disclosure, in the image detection result knowledge base, the malicious file detection result of the image layer in the reference image corresponds to the image layer identifier of the image layer. At this time, the image layer identifier can be used as an index (such as Figure 5 As shown), determine whether there is an image layer matching the target image layer among the image layers of the multiple reference images. Specifically, Figure 5As shown, the target image layer identifier of the target image layer can be obtained first; then, based on the target layer image identifier, a matching query is performed with the image layer detection result in the image detection result knowledge base to determine whether there is a record corresponding to the target image layer identifier in the image detection result knowledge base (specifically, the image layer detection result) (i.e., determine whether there is a record); if the target image layer identifier exists in the image detection result knowledge base, it is determined that there is an image layer matching the target image layer in the image layers of multiple reference images, and the image layer in the image layers of the multiple reference images is identified as the image layer with the target image layer identifier, and is determined as the image layer matching the target image layer. If the target image layer identifier does not exist in the image detection result knowledge base, it is determined that there is no image layer matching the target image layer in the image layers of multiple reference images.

[0086] When there is an image layer matching the target image layer in the image layers of multiple reference images, the malicious file detection results of all image files in the target image layer can be directly obtained based on the image detection result knowledge base. At this time, the malicious file detection result corresponding to the target image layer identifier in the image detection result knowledge base can be determined as the malicious file detection result of the target container image.

[0087] In addition, the target image layer identifier of the target image layer may be directly obtained based on the metadata information of the target image layer.

[0088] In a possible implementation, the step of matching the target container image with the image detection result knowledge base granularly in descending order of granularity may also include the following steps (15) to (17):

[0089] Step (15): If there is no image layer matching the target image layer in the image layers of the multiple reference images, determine whether there is a historical version image of the target container image in the multiple reference images.

[0090] like Figure 5 As shown, if there is no image layer matching the target image layer in the image layers of multiple reference images, that is, there is no historical detection record of the target image layer in the image knowledge base, then you can try to match the target image layer with the image detection result knowledge base at the image file granularity.

[0091] In actual scenarios, the same business image with different version numbers usually contains a large number of duplicate files, especially the image file overlap rate between adjacent versions of container images of the same application is extremely high. Among them, in the cloud native scenario, the differences between different versions of the same application image are mostly the differences in the application programs developed by themselves, such as: the compiled main program binaries are different, and other configuration files, data files, etc. are generally not likely to change. Therefore, in order to improve the detection result coverage of the image detection result knowledge base, after malicious file detection is performed on the business image, the detection results can be added to the image detection result knowledge base, so that the image detection result knowledge base not only does not contain the malicious file detection results of the basic image, but also contains the malicious file detection results of these business images, wherein the above-mentioned multiple reference images include both the basic image and the business image. Therefore, it is possible to try to match the target image layer with the historical version image of the target container image in the image detection result knowledge base from the image file granularity, so as to reuse the malicious file detection results of the same image file in the image layer corresponding to the historical version image of the target container image, and realize the detection acceleration of the image file granularity.

[0092] Step (16): If there is a historical version image in the multiple reference images, for each target image file in the target image layer, the target image file is matched with the image file in the reference image layer.

[0093] In the present disclosure, the reference image layer is an image layer in a target version image that has the same layer position as the target image layer, and the target version image is an image in a historical version image that is closest to the target container image version.

[0094] The image detection result knowledge base may contain malicious file detection results of one or more historical version images of the target container image. In a container image with multiple iterations, the closer the versions are, the higher the image file overlap rate between the container images. Therefore, when malicious file detection results of multiple historical version images of the target container image exist in the image detection result knowledge base, the image that is closest to the target container image version among the multiple historical version images can be determined as the target version image for matching. Among them, based on the version information of the multiple historical version images, the image that is closest to the target container image version, that is, the target version image, can be determined from the multiple historical version images. Figure 6 As shown, the version of the target container image is V1.1, and the version of the target version image is V1.0.

[0095] The number of image layers contained in multiple iterations of a container image is usually the same. When updating a container image, the last image layer of the container image is usually updated (such as Figure 7Therefore, in container images of different iterations, the image files in the image layers with the same layer position are mostly the same. Therefore, after obtaining the target version image, the target image layer can be matched with the image layer with the same layer position as the target image layer in the target version image at the image file granularity, that is, matching the image files in the same image layer (such as Figure 6 As shown in the figure), the detection results of the same image layer are reused to accelerate the detection of image file granularity.

[0096] Specifically, if there are historical version images in multiple reference images, for each target image file in the target image layer, the target image file can be matched with an image file of an image layer in the target version image with the same layer position as the target image layer.

[0097] For example, Figure 7 As shown, the version of the target container image is V1.1, and the version of the target version image is V1.0, wherein the image layer identifiers of the layer1 image layer of the target container image and the layer1 image layer of the target version image are both "1f9d2a1...", indicating that the layer1 image layer of the target container image is the same as the layer1 image layer of the target version image; the image layer identifiers of the layer2 image layer of the target container image and the layer2 image layer of the target version image are both "bde4058...", indicating that the layer2 image layer of the target container image is the same as the layer2 image layer of the target version image; the layer3 image layer of the target container image is the target image layer, wherein the layer position of the layer3 image layer of the target version image is the same as the layer position of the target image layer, that is, the layer3 image layer of the target version image is the reference image layer.

[0098] like Figure 7 As shown, the layer3 image layer of the target container image and the layer3 image layer of the target version image both include two image files, file1 and file2. At this time, for file1 in the layer3 image layer of the target container image, it can be matched with file1 and file2 in the layer3 image layer of the target version image and the target version image. At the same time, for file2 in the layer3 image layer of the target container image, it can be matched with file1 and file2 in the layer3 image layer of the target version image and the target version image.

[0099] If there is no historical version image in the multiple reference images, it means that the matching fails. At this time, it can be determined that the target image layer does not match the malicious file detection result, that is, all image files in the target image layer are determined as image files that do not match the malicious file detection result.

[0100] Step (17): If there is an image file matching the target image file in the image file of the reference image layer, the image file matching the target image file is determined as the first object.

[0101] like Figure 6 As shown, if there is an image file matching the target image file in the image file of the reference image layer, it indicates that the malicious file detection result of the target image file can be directly obtained through the image detection result knowledge base. At this time, the image file matching the target image file can be determined as the first object, that is, the malicious file detection result of the image file matching the target image file can be determined as the malicious file detection result of the first object in the target container image. If there is no image file matching the target image file in the image file of the reference image layer, it is determined that the target image file does not match the malicious file detection result. At this time, the target image file can be determined as an image file that does not match the malicious file detection result, that is, the target image file is determined as the second object.

[0102] like Figure 6 As shown, after each target image file in each target image layer of the target container image is matched with the target historical version, the image files that do not match the malicious file detection results can be obtained, and then malicious file detection is performed on the image files that do not match the malicious file detection results.

[0103] The following describes in detail the specific implementation method of determining whether there is a historical version image of the target container image in the multiple reference images in the above step (15).

[0104] Specifically, the target image name of the target container image can be obtained first; if there is a reference image with the target image name among multiple reference images, it is determined that there is a historical version image among the multiple reference images, and the reference image with the target image name is determined as the historical version image.

[0105] The following is a detailed description of the specific implementation method of matching the target image file with the image file in the reference image layer in the above step (16). Specifically, it can be implemented through a variety of implementation methods. In one implementation method, the target hash value of the target image file and the hash value of each image file in the reference image layer can be calculated; if there is an image file with a hash value equal to the target hash value in the reference image layer, it is determined that there is an image file matching the target image file in the image file of the reference image layer, and the image file with a hash value equal to the target hash value in the reference image layer is determined as the matching image file; if there is no image file with a hash value equal to the target hash value in the reference image layer, it is determined that there is no image file matching the target image file in the image file of the reference image layer.

[0106] In another embodiment, it is possible to determine whether there is an image file matching the target image file in the image file of the reference image layer according to the file characteristics of the target image file (e.g., checksum, file size). Specifically, the target checksum and target file size of the target image file can be obtained first. If there is an image file in the reference image layer whose checksum is equal to the target checksum and whose file size is the target file size, it is determined that there is an image file matching the target image file in the image file of the reference image layer, and the image file in the reference image layer whose checksum is equal to the target checksum and whose file size is the target file size is determined as the matching image file; if there is no image file in the reference image layer whose checksum is equal to the target checksum and whose file size is the target file size, it is determined that there is no image file matching the target image file in the image file of the reference image layer.

[0107] In addition, the tarball of the image file usually contains file features such as the checksum and file size of the image file. Therefore, the target checksum and target file size of the target image file can be obtained through the tarball of the target image file.

[0108] For example, the header structure of the tarball of the image file is as follows:

[0109]

[0110] For example, Figure 7As shown, for file1 in the layer3 image layer of the target container image, it is matched with file1 and file2 in the layer3 image layer of the target version image (i.e., in the reference image). It can be seen that the checksum of file1 in the layer3 image layer of the target container image is the same as the checksum of file1 in the layer3 image layer of the target version image, and the sizes of the two are the same. Therefore, it can be determined that there is an image file in the image file of the reference image layer that matches file1 in the layer3 image layer of the target container image. At this time, the image file that matches file1 in the layer3 image layer of the target container image is file1 in the layer3 image layer of the target version image. At the same time, for file2 in the layer3 image layer of the target container image, it is matched with file1 and file2 in the layer3 image layer of the target version image (i.e., in the reference image). It can be seen that the checksum of file2 in the layer3 image layer of the target container image is different from the checksum of file1 in the layer3 image layer of the target version image, and their sizes are also different. Moreover, the checksum of file2 in the layer3 image layer of the target container image is different from the checksum of file2 in the layer3 image layer of the target version image, and their sizes are also different. Therefore, it can be determined that there is no image file in the image file of the reference image layer that matches file2 in the layer3 image layer of the target container image.

[0111] In the above implementation, the high similarity of iterative version images is utilized. By comparing the files in the same layer of iterative version images, the same files are screened out to reuse the previous detection results, and only different files are re-detected, thereby significantly reducing repeated detection and realizing accelerated detection of image file layers.

[0112] In a possible implementation, the above method may further include:

[0113] The malicious file detection result of the second object that is not matched to the malicious file detection result and the malicious file detection result in the reused image detection result knowledge base are merged to obtain the malicious file detection result of the target container image.

[0114] In the present disclosure, after performing malicious file detection on the second object that does not match the malicious file detection result in the target container image through the above S103, the malicious file detection result of the second object that does not match the malicious file detection result can be obtained, and then it can be integrated with the malicious file detection result in the reused image detection result knowledge base (that is, the malicious file detection result of the first object) according to the image layer, that is, the detection content is integrated to complete the detection (such as Figure 6 As shown), the malicious file detection result of the target container image is obtained.

[0115] In a possible implementation, the above method may further include:

[0116] Update the malicious file detection results of the target container image to the image detection result knowledge base.

[0117] like Figure 4 , Figure 5 as well as Figure 6 As shown, after obtaining the malicious file detection result of the target container image, it can be updated to the image detection result knowledge base to continuously expand the image detection result knowledge base, so as to improve the detection result coverage of the image detection result knowledge base and improve the detection efficiency of malicious files in subsequent business images.

[0118] Figure 8 is a block diagram of a device for detecting malicious files in a container image according to an exemplary embodiment. Figure 8 As shown, the device 200 includes:

[0119] A matching module 201 is used to match a target container image to be subjected to malicious file detection with a preset image detection result knowledge base; wherein the image detection result knowledge base at least includes malicious file detection results of multiple base images;

[0120] A reuse module 202 is used to reuse the malicious file detection result of the same object in the image detection result knowledge base for the first object matched with the malicious file detection result in the target container image; and

[0121] The detection module 203 is used to perform malicious file detection on the second object in the target container image that does not match the malicious file detection result.

[0122] In the above technical scheme, when malicious file detection is performed on the target container image, the target container image is first matched with a pre-set image detection result knowledge base; then, for the first object in the target container image that matches the malicious file detection result, the malicious file detection result of the same object in the image detection result knowledge base is reused, and malicious file detection is only performed on the second object in the target container image that does not match the malicious file detection result. In this way, the characteristic that there are a large number of identical image files between different container images can be utilized, and the image detection result knowledge base can be pre-built at least based on the basic image. Therefore, when malicious file detection is performed on the target container image, the malicious file detection results of the same object in the image detection result knowledge base can be reused to reduce repeated detection work, thereby improving the detection efficiency of malicious files in the container image and reducing performance loss and time overhead. In actual cloud native scenarios, the frequency of malicious file detection during the release of image packages is very high. The use of the detection method provided by the present disclosure is conducive to the rapid development and iteration of software in cloud native scenarios, and can maintain a faster package output speed while ensuring that the container image file has a certain degree of reliability.

[0123] Optionally, the image detection result knowledge base includes malicious file detection results at three different granularities: image, image layer, and image file;

[0124] The matching module 201 is used to match the target container image with the image detection result knowledge base granularly in order from large to small granularity;

[0125] The first object includes at least one of an image, an image layer, and an image file.

[0126] Optionally, the image detection result knowledge base includes malicious file detection results of multiple reference images, and the multiple reference images at least include the multiple base images;

[0127] The matching module 201 includes:

[0128] A first matching submodule, configured to match the target container image with the multiple reference images;

[0129] The first determining submodule is configured to determine, if there is a reference image matching the target container image among the multiple reference images, the matching reference image as the first object.

[0130] Optionally, in the image detection result knowledge base, the malicious file detection result of the reference image corresponds to the image identifier of the reference image;

[0131] The first matching submodule includes:

[0132] A first acquisition submodule, used to acquire a target image identifier of the target container image;

[0133] The second determination submodule is configured to determine whether a reference image matching the target container image exists in the plurality of reference images if the target image identifier exists in the image detection result knowledge base.

[0134] Optionally, the matching module 201 further includes:

[0135] A second matching submodule is configured to match each target image layer in the target container image with an image layer of the multiple reference images if the matching reference image does not exist in the multiple reference images;

[0136] The third determining submodule is configured to determine, if there is an image layer matching the target image layer among the image layers of the multiple reference images, the matching image layer as the first object.

[0137] Optionally, in the image detection result knowledge base, the malicious file detection result of the image layer in the reference image corresponds to the image layer identifier of the image layer;

[0138] The second matching submodule includes:

[0139] The second acquisition submodule is used to obtain the target image layer identifier of the target image layer;

[0140] The fourth determining submodule is configured to determine whether an image layer matching the target image layer exists in the image layers of the multiple reference images if the target image layer identifier exists in the image detection result knowledge base.

[0141] Optionally, the matching module 201 further includes:

[0142] a fifth determination submodule, configured to determine whether a historical version image of the target container image exists in the multiple reference images if the matching image layer does not exist in the image layers of the multiple reference images;

[0143] a third matching submodule, configured to match, for each target image file in the target image layer, the target image file with the image file in the reference image layer if the historical version image exists in the multiple reference images, wherein the reference image layer is an image layer in the target version image that has the same layer position as the target image layer, and the target version image is an image in the historical version image that is most adjacent to the target container image version;

[0144] The sixth determining submodule is configured to determine the matching image file as the first object if there is an image file matching the target image file in the image file of the reference image layer.

[0145] Optionally, the fifth determining submodule includes:

[0146] A third acquisition submodule is used to obtain the target image name of the target container image;

[0147] The seventh determination submodule is used to determine that the historical version image exists in the multiple reference images if a reference image with the image name being the target image name exists in the multiple reference images, and determine the reference image with the image name being the target image name as the historical version image.

[0148] Optionally, the third matching submodule includes:

[0149] The fourth acquisition submodule is used to obtain the target checksum and target file size of the target image file;

[0150] an eighth determination submodule, for determining, if an image file whose checksum is equal to the target checksum and whose file size is the target file size exists in the reference image layer, that an image file matching the target image file exists in the image files of the reference image layer, and determining the image file whose checksum is equal to the target checksum and whose file size is the target file size in the reference image layer as the matching image file.

[0151] Optionally, the third matching submodule includes:

[0152] A calculation submodule, used to calculate a target hash value of the target image file and a hash value of each image file in the reference image layer;

[0153] A ninth determination submodule is configured to determine, if an image file whose hash value is equal to the target hash value exists in the reference image layer, that an image file that matches the target image file exists in the image files of the reference image layer, and determine the image file whose hash value is equal to the target hash value in the reference image layer as the matching image file.

[0154] Optionally, the device 200 further includes:

[0155] A merging module is used to merge the malicious file detection result of the second object and the malicious file detection result in the reused image detection result knowledge base to obtain the malicious file detection result of the target container image.

[0156] Optionally, the device 200 further includes:

[0157] An update module is used to update the malicious file detection result of the target container image into the image detection result knowledge base.

[0158] In addition, the present disclosure also provides a computer-readable medium on which a computer program is stored. When the computer program is executed by a processing device, the steps of the method for detecting malicious files in the container image provided by the present disclosure are implemented.

[0159] In addition, the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method for detecting malicious files in the container image provided by the present disclosure.

[0160] Reference below Fig. 9 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0161] like Fig. 9 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0162] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Fig. 9The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0163] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0164] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0165] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0166] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0167] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: matches the target container image to be subjected to malicious file detection with a preset image detection result knowledge base; wherein the image detection result knowledge base includes at least malicious file detection results of multiple base images; reuses the malicious file detection result of the same object in the image detection result knowledge base for the first object in the target container image that matches the malicious file detection result; and performs malicious file detection on the second object in the target container image that does not match the malicious file detection result.

[0168] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0169] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0170] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the detection module may also be described as "a module for performing malicious file detection on the second object in the target container image that does not match the malicious file detection result".

[0171] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0172] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0173] According to one or more embodiments of the present disclosure, Example 1 provides a method for detecting malicious files in a container image, comprising: matching a target container image to be detected for malicious files with a pre-set image detection result knowledge base; wherein the image detection result knowledge base includes at least malicious file detection results of multiple base images; for a first object in the target container image that matches the malicious file detection result, reusing the malicious file detection result of the same object in the image detection result knowledge base; and performing malicious file detection on a second object in the target container image that does not match the malicious file detection result.

[0174] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein the image detection result knowledge base includes malicious file detection results of three different granularities: image, image layer, and image file; matching the target container image to be subjected to malicious file detection with a pre-set image detection result knowledge base includes: matching the target container image with the image detection result knowledge base granularly in order from large to small granularity; wherein the first object includes at least one of an image, an image layer, and an image file.

[0175] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, wherein the image detection result knowledge base includes malicious file detection results of multiple reference images, and the multiple reference images include at least the multiple base images; the target container image is matched with the image detection result knowledge base in order of granularity from large to small, including: matching the target container image with the multiple reference images; if there is a reference image among the multiple reference images that matches the target container image, determining the matching reference image as the first object.

[0176] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 3, wherein in the image detection result knowledge base, the malicious file detection result of the reference image corresponds to the image identifier of the reference image; matching the target container image with the multiple reference images includes: obtaining the target image identifier of the target container image; if the target image identifier exists in the image detection result knowledge base, determining that there is a reference image among the multiple reference images that matches the target container image.

[0177] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 3, which matches the target container image with the image detection result knowledge base granularly in order from large to small granularity, and also includes: if the matching reference image does not exist in the multiple reference images, then for each target image layer in the target container image, the target image layer is matched with the image layers of the multiple reference images; if there is an image layer that matches the target image layer in the image layers of the multiple reference images, then the matching image layer is determined as the first object.

[0178] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 5, wherein in the image detection result knowledge base, the malicious file detection result of the image layer in the reference image corresponds to the image layer identifier of the image layer; matching the target image layer with the image layers of the multiple reference images includes: obtaining the target image layer identifier of the target image layer; if the target image layer identifier exists in the image detection result knowledge base, determining that there is an image layer in the image layers of the multiple reference images that matches the target image layer.

[0179] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 5, wherein the target container image is matched granularly with the image detection result knowledge base in order of granularity from large to small, and further includes: if the matching image layer does not exist in the image layers of the multiple reference images, determining whether there is a historical version image of the target container image in the multiple reference images; if the historical version image exists in the multiple reference images, for each target image file in the target image layer, matching the target image file with the image file in the reference image layer, wherein the reference image layer is an image layer in the target version image with the same layer position as the target image layer, and the target version image is the image in the historical version image that is closest to the target container image version; if there is an image file in the image file of the reference image layer that matches the target image file, determining the matching image file as the first object.

[0180] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 7, wherein determining whether there is a historical version image of the target container image among the multiple reference images comprises: obtaining the target image name of the target container image; if there is a reference image with the image name being the target image name among the multiple reference images, determining that there is the historical version image among the multiple reference images, and determining the reference image with the image name being the target image name as the historical version image.

[0181] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 7, wherein matching the target image file with the image file in the reference image layer includes: obtaining a target checksum and a target file size of the target image file; if there is an image file in the reference image layer whose checksum is equal to the target checksum and whose file size is the target file size, determining that there is an image file matching the target image file in the image files of the reference image layer, and determining the image file in the reference image layer whose checksum is equal to the target checksum and whose file size is the target file size as the matching image file.

[0182] According to one or more embodiments of the present disclosure, Example 10 provides the method of Example 7, wherein matching the target image file with the image file in the reference image layer includes: calculating a target hash value of the target image file and a hash value of each image file in the reference image layer; if there is an image file in the reference image layer whose hash value is equal to the target hash value, determining that there is an image file in the image file of the reference image layer that matches the target image file, and determining the image file in the reference image layer whose hash value is equal to the target hash value as the matching image file.

[0183] According to one or more embodiments of the present disclosure, Example 11 provides the method described in any one of Examples 1-10, wherein the method further includes: merging the malicious file detection result of the second object and the malicious file detection result in the reused image detection result knowledge base to obtain the malicious file detection result of the target container image.

[0184] According to one or more embodiments of the present disclosure, Example 12 provides the method described in any one of Examples 1-10, wherein the method further includes: updating the malicious file detection result of the target container image into the image detection result knowledge base.

[0185] According to one or more embodiments of the present disclosure, Example 13 provides a device for detecting malicious files in a container image, comprising: a matching module, used to match a target container image to be detected for malicious files with a pre-set image detection result knowledge base; wherein the image detection result knowledge base includes at least malicious file detection results of multiple base images; a multiplexing module, used to reuse the malicious file detection result of the same object in the image detection result knowledge base for a first object in the target container image that matches the malicious file detection result; and a detection module, used to perform malicious file detection on a second object in the target container image that does not match the malicious file detection result.

[0186] According to one or more embodiments of the present disclosure, Example 14 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-12 when executed by a processing device.

[0187] According to one or more embodiments of the present disclosure, Example 15 provides an electronic device, comprising: a storage device on which a computer program is stored; and a processing device for executing the computer program in the storage device to implement the steps of any one of the methods described in Examples 1-12.

[0188] According to one or more embodiments of the present disclosure, Example 16 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-12 when executed by a processor.

[0189] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0190] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0191] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A method for detecting malicious files in a container image, characterized in that: include: Matching the target container image to be subjected to malicious file detection with a preset image detection result knowledge base; wherein the image detection result knowledge base at least includes malicious file detection results of multiple base images; For a first object in the target container image that matches a malicious file detection result, reuse the malicious file detection result of the same object in the image detection result knowledge base; and Perform malicious file detection on a second object in the target container image that does not match the malicious file detection result; The image detection result knowledge base includes malicious file detection results at three different granularities: image, image layer, and image file. The matching of the target container image to be detected for malicious files with a preset image detection result knowledge base includes: Matching the target container image with the image detection result knowledge base granularly in descending order of granularity; The first object includes at least one of an image, an image layer, and an image file.

2. The method according to claim 1, characterized in that The image detection result knowledge base includes malicious file detection results of multiple reference images, and the multiple reference images at least include the multiple base images; The step of matching the target container image with the image detection result knowledge base granularly in descending order of granularity includes: Matching the target container image with the multiple reference images; If there is a reference image matching the target container image among the multiple reference images, the matching reference image is determined as the first object.

3. The method according to claim 2, characterized in that In the image detection result knowledge base, the malicious file detection result of the reference image corresponds to the image identifier of the reference image; The matching the target container image with the multiple reference images includes: Obtain a target image identifier of the target container image; If the target image identifier exists in the image detection result knowledge base, it is determined that there is a reference image matching the target container image among the multiple reference images.

4. The method according to claim 2, characterized in that: The step of matching the target container image with the image detection result knowledge base granularly in descending order of granularity also includes: If the matching reference image does not exist in the multiple reference images, for each target image layer in the target container image, matching the target image layer with the image layers of the multiple reference images; If there is an image layer matching the target image layer among the image layers of the multiple reference images, the matching image layer is determined as the first object.

5. The method according to claim 4, characterized in that In the image detection result knowledge base, the malicious file detection result of the image layer in the reference image corresponds to the image layer identifier of the image layer; The matching the target image layer with the image layers of the multiple reference images includes: Get the target image layer identifier of the target image layer; If the target image layer identifier exists in the image detection result knowledge base, it is determined that there is an image layer matching the target image layer in the image layers of the multiple reference images.

6. The method according to claim 4, characterized in that The step of matching the target container image with the image detection result knowledge base granularly in descending order of granularity also includes: If the matching image layer does not exist in the image layers of the multiple reference images, determining whether a historical version image of the target container image exists in the multiple reference images; If the historical version image exists in the multiple reference images, for each target image file in the target image layer, the target image file is matched with the image file in the reference image layer, wherein the reference image layer is an image layer in the target version image that has the same layer position as the target image layer, and the target version image is an image in the historical version image that is closest to the target container image version; If there is an image file matching the target image file in the image file of the reference image layer, the matching image file is determined as the first object.

7. The method according to claim 6, characterized in that The determining whether there is a historical version image of the target container image in the multiple reference images includes: Obtain the target image name of the target container image; If a reference image with the target image name exists among the multiple reference images, it is determined that the historical version image exists among the multiple reference images, and the reference image with the target image name is determined as the historical version image.

8. The method according to claim 6, characterized in that The matching of the target image file with the image file in the reference image layer includes: Obtain the target checksum and target file size of the target image file; If there is an image file in the reference image layer whose checksum is equal to the target checksum and whose file size is the target file size, it is determined that there is an image file matching the target image file in the image file of the reference image layer, and the image file in the reference image layer whose checksum is equal to the target checksum and whose file size is the target file size is determined as the matching image file.

9. The method according to claim 6, characterized in that The matching of the target image file with the image file in the reference image layer includes: Calculate a target hash value of the target image file and a hash value of each image file in the reference image layer; If there is an image file in the reference image layer whose hash value is equal to the target hash value, it is determined that there is an image file matching the target image file in the image files of the reference image layer, and the image file in the reference image layer whose hash value is equal to the target hash value is determined as the matching image file.

10. The method according to any one of claims 1 to 9, characterized in that The method further comprises: The malicious file detection result of the second object and the malicious file detection result in the reused image detection result knowledge base are combined to obtain the malicious file detection result of the target container image.

11. The method according to any one of claims 1 to 9, characterized in that The method further comprises: The malicious file detection result of the target container image is updated to the image detection result knowledge base.

12. A device for detecting malicious files in a container image, characterized in that: include: A matching module, used to match a target container image to be subjected to malicious file detection with a preset image detection result knowledge base; wherein the image detection result knowledge base at least includes malicious file detection results of multiple base images; a multiplexing module, configured to reuse the malicious file detection result of the same object in the image detection result knowledge base for the first object matched with the malicious file detection result in the target container image; and A detection module, configured to perform malicious file detection on a second object in the target container image that does not match the malicious file detection result; The image detection result knowledge base includes malicious file detection results at three different granularities: image, image layer, and image file. The matching module is specifically used to match the target container image with the image detection result knowledge base granularly in order from large to small granularity; The first object includes at least one of an image, an image layer, and an image file.

13. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 11 are implemented.

14. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 11.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images