Container behavior risk identification method and device, equipment and medium

Abstract

The invention discloses a container behavior risk identification method and device, equipment and a medium, and relates to the technical field of cloud computing, and the method comprises the steps: obtaining a first behavior stage feature of a to-be-identified container and a second behavior stage feature of a host where the to-be-identified container is located in real time; performing feature rule matching on the first behavior stage feature and the second behavior stage feature according to a preset feature matching rule to obtain a first risk identification result; if the suspected risk result matched with the intelligence library label exists in the first risk identification result, executing an intelligence library collision process to obtain a second risk identification result; if the second risk identification result is a security result and the first risk identification result has a suspected risk result matched with an unknown risk tag, executing a heuristic scanning process to obtain a third risk identification result; and determining the behavior risk of the to-be-identified container according to the first risk identification result, the second risk identification result and the third risk identification result. And potential risks in container behaviors can be found.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a container behavior risk identification method, device, equipment and medium. Background Art

[0002] In the current complex cloud-native network security environment, hosts and containers face multiple threats from malware (such as viruses, Trojans, and ransomware). The complexity of the operating system and services in the host environment increases the difficulty of security protection, which means that as the functions of the host system continue to enrich and expand, its internal structure and operation mechanism become more complex, making the task of security protection more arduous. For example, complex systems may have more vulnerabilities and security risks, and traditional security protection methods may be difficult to fully cover and effectively deal with these problems. Traditional antivirus software is difficult to deal with new threats. Although the container environment provides a lightweight and portable deployment method, it also brings new security challenges, such as container image contamination. The container image is the basis for container operation. If the image is contaminated by malware, the malware may be introduced into the system when the container is deployed. For example, an attacker may implant malicious code in the image or tamper with the software package in the official image, thereby launching an attack after the container is started. In addition, dynamicity also brings monitoring difficulties. The dynamic characteristics of the container make its life cycle short, and it is frequently created, destroyed, and migrated, which brings great challenges to security monitoring. For example, traditional security monitoring tools may find it difficult to track the dynamic changes of containers in real time, and cannot detect and respond to security incidents in a timely manner. In addition, the shared kernel also brings the following potential risks. Containers usually share the kernel with the host, which means that if there is a vulnerability in the application in the container, it may be exploited by attackers to attack the host kernel, thus affecting the security of the entire system. For example, if a buffer overflow vulnerability occurs in an application in a container, an attacker may exploit this vulnerability to gain control of the host. Therefore, it is crucial to improve the ability to monitor host and container behavior and dynamically identify risks. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a container behavior risk identification method, device, equipment and medium, which can monitor the behavior of containers in real time and dynamically to complete dynamic risk identification. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a method for identifying container behavior risks, comprising:

[0005] Acquire in real time a first behavior phase characteristic of a container to be identified and a second behavior phase characteristic of a host where the container to be identified is located; wherein the first behavior phase characteristic or the second behavior phase characteristic is container data or host data generated at each stage of a life cycle corresponding to the execution of any instruction when executing the instruction;

[0006] According to a preset feature matching rule, feature rule matching is performed on the first behavior stage feature and the second behavior stage feature respectively to obtain a first risk identification result;

[0007] If there is a suspected risk result that matches the intelligence library label in the first risk identification result, the intelligence library collision process is executed to obtain a second risk identification result; wherein the intelligence library label represents that the first behavior stage feature or the second behavior stage feature is associated with the data information in the intelligence library;

[0008] If the second risk identification result is a safe result and there is a suspected risk result matching an unknown risk tag in the first risk identification result, a heuristic scanning process is performed to obtain a third risk identification result;

[0009] The behavior risk of the to-be-identified container is determined according to the first risk identification result, the second risk identification result, and the third risk identification result.

[0010] Optionally, the real-time acquisition of a first behavior phase characteristic of the container to be identified and a second behavior phase characteristic of the host where the container to be identified is located includes:

[0011] Using a preset behavior monitoring tool to monitor the container to be identified and the host where the container to be identified is located in real time, so as to obtain a first real-time process behavior feature field of the container to be identified and a second real-time process behavior feature field of the host where the container to be identified is located, which are reported in real time;

[0012] A first behavior phase characteristic of the container to be identified and a second behavior phase characteristic of the host where the container to be identified is located are determined based on the first real-time process behavior characteristic field and the second real-time process behavior characteristic field respectively.

[0013] Optionally, performing feature rule matching on the first behavior stage feature and the second behavior stage feature respectively according to a preset feature matching rule to obtain a first risk identification result includes:

[0014] Using a preset rule engine to perform data cleaning processing on the first behavior stage feature and the second behavior stage feature respectively, so as to obtain a first target behavior stage feature and a second target behavior stage feature that meet the data cleaning condition in the preset rule engine;

[0015] Using the preset feature matching rule in the preset rule engine, the first target behavior phase feature and the second target behavior phase feature are respectively subjected to feature marking processing to obtain a corresponding first marking result and a second marking result;

[0016] Acquire a first risk identification result of the container to be identified according to the first marking result and the second marking result;

[0017] If the first risk identification result is a safety result or an alarm result, the safety result or the alarm result is directly output and the risk identification process ends.

[0018] Optionally, if there is a suspected risk result matching the intelligence library label in the first risk identification result, executing the intelligence library collision process to obtain a second risk identification result includes:

[0019] If the first risk identification result contains an intelligence library label of a suspected risk result, the first risk identification result is determined to be a suspected risk result, and the first labeling result and the second labeling result corresponding to the suspected risk result are obtained;

[0020] Classifying the first marking result and the second marking result to determine the behavior type to which the current behavior phase characteristic belongs;

[0021] According to the behavior type and the stage characteristics of the current behavior, query from the intelligence database whether there is corresponding malicious data information, and if so, obtain a second risk identification result characterized as an alarm result;

[0022] If not, a second risk identification result characterized as a safety result is obtained.

[0023] Optionally, querying from an intelligence library whether corresponding malicious data information exists according to the behavior type and the stage characteristics of the current behavior includes:

[0024] If the behavior type is a file behavior type, obtaining file information in the first marking result and the second marking result as a current behavior phase feature;

[0025] According to the file behavior type and the current file type, current file, and current file name in the current behavior phase characteristics, query from the intelligence library whether there is corresponding malicious file information;

[0026] If the behavior type is a domain name access type, obtaining domain name information in the first marking result and the second marking result as a current behavior phase feature;

[0027] According to the domain name access type and the current domain name information in the current behavior phase characteristics, querying from the intelligence database whether there is corresponding malicious domain name information;

[0028] If the behavior type is an IP access type, obtaining IP information in the first marking result and the second marking result as a phase feature of the current behavior;

[0029] According to the IP access type and the current IP information in the current behavior phase characteristics, query from the intelligence library whether there is corresponding malicious IP information.

[0030] Optionally, the performing of the heuristic scanning process to obtain the third risk identification result includes:

[0031] If the behavior type is a file behavior type, obtaining file information and ID information of the container to be identified and IP information of the host where the container to be identified is located in the first marking result and the second marking result;

[0032] Combining the current file path and the current file name in the file information into a request parameter, and sending the request parameter to the container to be identified corresponding to the ID information of the container to be identified and the host corresponding to the IP information of the host where the container to be identified is located, so as to perform a malicious file scanning operation and obtain a third risk identification result;

[0033] If the behavior type is a domain name access type, the current domain name information is subjected to DNS resolution to obtain resolved IP information, and fingerprint and IP attribution detection are performed on the resolved IP information to obtain a third risk identification result of the resolved IP;

[0034] If the behavior type is an IP access type, the current IP information is obtained, and fingerprint and IP attribution detection are performed on the current IP information to obtain a third risk identification result of the current IP.

[0035] Optionally, determining the behavior risk of the to-be-identified container according to the third risk identification result includes:

[0036] If the resolved IP or the current IP has any one or more of fingerprint anomalies and IP location anomalies, it is determined that the container to be identified has a behavioral risk, and an alarm result is output.

[0037] In a second aspect, the present application discloses a container behavior risk identification device, comprising:

[0038] A feature acquisition module, used to acquire in real time a first behavior phase feature of a container to be identified and a second behavior phase feature of a host where the container to be identified is located; wherein the first behavior phase feature or the second behavior phase feature is container data or host data generated at each stage of a life cycle corresponding to the execution of any instruction when executing the instruction;

[0039] A rule matching module, used for performing feature rule matching on the first behavior stage feature and the second behavior stage feature respectively according to a preset feature matching rule to obtain a first risk identification result;

[0040] An intelligence library collision module, configured to execute an intelligence library collision process to obtain a second risk identification result if there is a suspected risk result that matches an intelligence library label in the first risk identification result; wherein the intelligence library label represents that the first behavior phase feature or the second behavior phase feature is associated with the data information in the intelligence library;

[0041] a scanning module, configured to execute a heuristic scanning process to obtain a third risk identification result if the second risk identification result is a safe result and there is a suspected risk result matching an unknown risk tag in the first risk identification result;

[0042] A risk determination module is used to determine the behavior risk of the container to be identified according to the first risk identification result, the second risk identification result, and the third risk identification result.

[0043] In a third aspect, the present application discloses an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] The processor is used to execute the computer program to implement the steps of the container behavior risk identification method disclosed above.

[0046] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the container behavior risk identification method disclosed above are implemented.

[0047] It can be seen that the present application discloses a container behavior risk identification method, including: obtaining in real time a first behavior phase characteristic of a container to be identified and a second behavior phase characteristic of a host where the container to be identified is located; wherein the first behavior phase characteristic or the second behavior phase characteristic is the container data or host data generated in each stage of the life cycle corresponding to the execution of any instruction when executing the instruction; according to the preset feature matching rule, the first behavior phase characteristic and the second behavior phase characteristic are respectively matched with the feature rule to obtain a first risk identification result; if there is a suspected risk result that matches the intelligence library label in the first risk identification result, the intelligence library collision process is executed to obtain a second risk identification result; wherein the intelligence library label represents that the first behavior phase characteristic or the second behavior phase characteristic is mutually associated with the data information in the intelligence library; if the second risk identification result is a safety result and there is a suspected risk result that matches the unknown risk label in the first risk identification result, the heuristic scanning process is executed to obtain a third risk identification result; the behavior risk of the container to be identified is determined according to the first risk identification result, the second risk identification result, and the third risk identification result. It can be seen that real-time acquisition of the first behavioral phase characteristics of the container to be identified and the second behavioral phase characteristics of the host can cover the behavioral data at different stages of both the container and host levels, and fully grasp the dynamics of the entire operating environment. This helps to discover not only the container itself, but also the potential risks that may be affected by the host or the container. The data of each stage of the life cycle corresponding to the execution of any instruction is collected, and no link that may cause risks is missed. The entire process from the start of instruction execution to the end is within the monitoring range, which increases the probability of risk discovery. Furthermore, the multi-stage risk identification method is progressive, which can minimize the omission of risks. The comprehensive use of multiple risk identification methods can timely discover potential risks in container behavior and improve the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0049] Figure 1 A flow chart of a container behavior risk identification method disclosed in this application;

[0050] Figure 2 A flow chart of a container behavior analysis and matching method based on a rule engine disclosed in this application;

[0051] Figure 3 A data flow chart for container behavior risk identification disclosed in this application;

[0052] Figure 4 A flowchart of a specific container behavior risk identification method disclosed in this application;

[0053] Figure 5 This is another specific flow chart of a method for identifying container behavior risks disclosed in this application;

[0054] Figure 6 A flow chart of a method for identifying container behavior risks based on multiple risk identification methods disclosed in this application;

[0055] Figure 7 This is a schematic diagram of the structure of a container behavior risk identification device disclosed in this application;

[0056] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0058] In the current complex cloud-native network security environment, hosts and containers face multiple threats from malware (such as viruses, Trojans, and ransomware). The complexity of the operating system and services in the host environment increases the difficulty of security protection, which means that as the functions of the host system continue to enrich and expand, its internal structure and operation mechanism become more complex, making the task of security protection more arduous. For example, complex systems may have more vulnerabilities and security risks, and traditional security protection methods may be difficult to fully cover and effectively deal with these problems. Traditional antivirus software is difficult to deal with new threats. Although the container environment provides a lightweight and portable deployment method, it also brings new security challenges, such as container image contamination. The container image is the basis for container operation. If the image is contaminated by malware, the malware may be introduced into the system when the container is deployed. For example, an attacker may implant malicious code in the image or tamper with the software package in the official image, thereby launching an attack after the container is started. In addition, dynamicity also brings monitoring difficulties. The dynamic characteristics of the container make its life cycle short, and it is frequently created, destroyed, and migrated, which brings great challenges to security monitoring. For example, traditional security monitoring tools may find it difficult to track the dynamic changes of containers in real time, and cannot detect and respond to security incidents in a timely manner. In addition, the shared kernel also brings the following potential risks. Containers usually share the kernel with the host, which means that if there is a vulnerability in the application in the container, it may be exploited by attackers to attack the host kernel, thus affecting the security of the entire system. For example, if a buffer overflow vulnerability occurs in an application in a container, an attacker may exploit this vulnerability to gain control of the host. Therefore, it is crucial to improve the ability to monitor host and container behavior and dynamically identify risks.

[0059] To this end, the present invention provides a container behavior risk identification solution that can dynamically monitor the behavior of containers in real time and complete dynamic risk identification.

[0060] Reference Figure 1 As shown, an embodiment of the present invention discloses a container behavior risk identification method, including:

[0061] Step S11: acquiring in real time a first behavior phase characteristic of the container to be identified and a second behavior phase characteristic of the host where the container to be identified is located; wherein the first behavior phase characteristic or the second behavior phase characteristic is container data or host data generated at each stage in the life cycle corresponding to the execution of any instruction when executing the instruction.

[0062] In this embodiment, a preset behavior monitoring tool is used to monitor the container to be identified and the host where the container to be identified is located in real time, so as to obtain the first real-time process behavior characteristic field of the container to be identified and the second real-time process behavior characteristic field of the host where the container to be identified is located, which are reported in real time; the first behavior phase characteristic of the container to be identified and the second behavior phase characteristic of the host where the container to be identified are determined based on the first real-time process behavior characteristic field and the second real-time process behavior characteristic field, respectively. It can be understood that the preset behavior monitoring tool is used to collect behavior data of the container to be identified and the host where the container to be identified is located in real time, wherein the preset behavior monitoring tool may include but is not limited to: Falco, Sysdig and other behavior monitoring tools; wherein the behavior data includes the first real-time process behavior characteristic field of the container to be identified and the second real-time process behavior characteristic field of the host where the container to be identified is located, and examples of the first real-time process behavior characteristic field or the second real-time process behavior characteristic field are as follows:

[0063] Opflags indicates the process execution stage, pid indicates the process ID, ppid indicates the parent process, IDprocName indicates the process name, uid indicates the user ID, Gid indicates the group ID, cmdline indicates the operation instruction, fileName indicates the name of the file to be operated, fileHash indicates the file hash, args indicates the parameter list of the instruction execution, time indicates the timestamp of the behavior, and the values ​​of Opflags include: file creation (create), file opening (open), file closing (close), program execution (exec), data reading (read), data sending (send), program end (exit), etc. The host IP / container ID is used to distinguish whether the behavior occurs on the host or inside the container, in preparation for subsequent heuristic scanning. Therefore, the real-time process behavior feature field also includes: host IP: host_ip, container ID: container_id.

[0064] In this way, by obtaining the behavioral phase characteristics of containers and hosts in real time, data from all stages of the instruction execution life cycle can be covered, and potential risks can be fully captured. Whether it is the operations within the container or the impact of the host on the container, detailed monitoring can be carried out to ensure that no link that may pose a risk is missed.

[0065] Step S12: performing feature rule matching on the first behavior stage feature and the second behavior stage feature respectively according to a preset feature matching rule to obtain a first risk identification result.

[0066] In this embodiment, a preset rule engine is used to perform data cleaning processing on the first behavior stage feature and the second behavior stage feature respectively, so as to obtain the first target behavior stage feature and the second target behavior stage feature that meet the data cleaning conditions in the preset rule engine; the preset feature matching rules in the preset rule engine are used to perform feature marking processing on the first target behavior stage feature and the second target behavior stage feature respectively, so as to obtain the corresponding first marking result and the second marking result; the first risk identification result of the container to be identified is obtained according to the first marking result and the second marking result; if the first risk identification result is a safety result or an alarm result, the safety result or the alarm result is directly output and the risk identification process ends. It can be understood that if Figure 2 As shown, a rule engine is used to clean and label data (the rule engine can be the Antlr4 open source framework, which is not specifically limited). The rule engine needs to maintain a set of rule lists by itself. The rule examples are:

[0067] rule: test

[0068] desc: test

[0069] condition: >

[0070] opflags = EXEC

[0071] and procName = "chmod"

[0072] and (cmdline contains "+" and cmdline contains "x")

[0073] priority: high

[0074] tags: [malicious_file].

[0075] Among them, "rule: test" means that the rule name is "test", and "desc: test" is the description of the rule. "condition:> opflags = EXEC and procName = "chmod" and (cmdline contains "+"and cmdline contains "x")" clarifies the condition of the rule, that is, when the process execution phase (opflags) is "EXEC", the process name is "chmod", and the operation instruction (cmdline) contains both "+" and "x", the rule condition is met. "priority: high" indicates that the priority of this rule is high. "tags: [malicious_file]" means that if the data meets the rule conditions, it will be tagged according to this tag list. In this example, it will be tagged with the "malicious_file" tag.

[0076] When the phase characteristics of the first behavior and the phase characteristics of the second behavior meet the data cleaning condition, they will be marked according to the tags of the rules.

[0077] Sample data:

[0078] {

[0079] "opflags": "EXEC",

[0080] "pid": 2,

[0081] "ppid": 1,

[0082] "procName": "chmod",

[0083] "uid": 1,

[0084] "gid": 2,

[0085] "cmdline": "chmod +x webshell.php",

[0086] "fileName": " / root / webshell.php",

[0087] "fileHash": "1234567",

[0088] "args": "+x webshell.php",

[0089] "syscall": "cap",

[0090] "time": 1725506794700

[0091] }

[0092] Labeling result:

[0093] {

[0094] "opflags": "EXEC",

[0095] "pid": 2,

[0096] "ppid": 1,

[0097] "procName": "chmod",

[0098] "uid": 1,

[0099] "gid": 2,

[0100] "cmdline": "chmod +x webshell.php",

[0101] "fileName": " / root / webshell.php",

[0102] "fileHash": "1234567",

[0103] "args": "+x webshell.php",

[0104] "syscall": "cap",

[0105] "time": 1725506794700,

[0106] "tags":

[0107] "malicious_file"

[0108] ,

[0109] "rule": "test"

[0110] }

[0111] In this way, the rule engine can identify and filter out data that is irrelevant to behavior monitoring or is obviously wrong based on specific rules. For example, for some data with irregular formats and serious field missing, rules can be used to filter and exclude them to ensure the quality of data for subsequent processing. In addition, the rule engine will standardize the data collected from different sources and in different formats. For example, in the case of inconsistent timestamp formats, the rule engine can convert them into a unified time format to facilitate subsequent analysis and comparison.

[0112] It can be seen from the data labeling results that meet the rule sample conditions above that in addition to the fields in the original data, a "tags" field is added, which contains the label "malicious_file" according to the rule, and the "rule" field indicates that the name of the applied rule is "test". At the same time, it is emphasized that data labeling tags are not limited to the samples in the above case, and can be designed according to different rules.

[0113] Step S13: If there is a suspected risk result that matches the intelligence library label in the first risk identification result, the intelligence library collision process is executed to obtain a second risk identification result; wherein, the intelligence library label represents that the first behavior stage characteristics or the second behavior stage characteristics are correlated with the data information in the intelligence library.

[0114] In this embodiment, feature rule matching is performed by preset feature matching rules to quickly screen out obvious risks and suspected risk situations (matched to intelligence library labels). This preliminary risk identification can timely discover known risk patterns and improve response speed. However, if the first risk identification result obtained after the rule engine matching process is that there is a suspected risk result label matched to the rule in the current first behavior phase feature or the second behavior phase feature, it is characterized that in the container to be identified or the host where the container to be identified is located, in the life cycle of executing a certain instruction or script, there is a behavior feature that matches the suspected risk result label. Therefore, it is necessary to execute the next step of the intelligence library collision process to accurately determine whether the behavior feature data is risk data, that is, to obtain the execution intelligence library collision process and obtain the second risk identification result. It should be noted that the intelligence library mentioned in the present invention specifically includes information dictionary libraries such as malware, network attacks, social engineering attacks, malicious IPs, and open source intelligence. For the suspected risk results, the intelligence library collision process is further executed to use the rich information of the intelligence library to determine whether there is a risk associated with known malicious behavior. This can enhance the accuracy and reliability of risk identification with the help of external security intelligence.

[0115] Step S14: If the second risk identification result is a safe result and there is a suspected risk result matching an unknown risk tag in the first risk identification result, a heuristic scanning process is performed to obtain a third risk identification result.

[0116] In this embodiment, if there are only suspected risk results in the first risk identification result, and no other safety results or warning results are included, and the second risk result is identified as a safety result, then in order to further ensure the accuracy of risk identification, a heuristic scanning process is executed to obtain a third risk identification result. In this way, when there are only suspected risks and the intelligence library collision result is safe, a heuristic scanning process is executed to further determine whether there are potential risks through active exploration and in-depth analysis. This multi-stage risk identification method is progressive and can minimize the omission of risks.

[0117] like Figure 3 As shown, the behavioral data of the container to be identified and the host where the container to be identified is located is collected by the collector and reported in real time. After the report, the rule engine further performs data cleaning, rule matching, and data labeling, and analyzes the labeled data to obtain a first risk identification result. When there is a suspected risk result in the first risk identification result, the intelligence library collision is further performed to obtain a second risk identification result. If the second risk identification result is a safe result, the scanner is further controlled to perform heuristic scanning to obtain a third risk identification result.

[0118] Step S15: determining the behavior risk of the container to be identified according to the first risk identification result, the second risk identification result, and the third risk identification result.

[0119] In this embodiment, when the first risk identification result is a safety result or an alarm result, it is directly output to prompt that the container to be identified is a behavior safety or behavior risk. When the second risk identification result is an alarm result (intelligence library collision is successful), a risk alarm is generated, otherwise it is ignored. When the third risk identification result is an alarm result (risk is scanned), an alarm is generated, otherwise it is ignored.

[0120] It can be seen that the present application discloses a container behavior risk identification method, including: obtaining in real time a first behavior phase characteristic of a container to be identified and a second behavior phase characteristic of a host where the container to be identified is located; wherein the first behavior phase characteristic or the second behavior phase characteristic is the container data or host data generated in each stage of the life cycle corresponding to the execution of any instruction when executing the instruction; according to the preset feature matching rule, the first behavior phase characteristic and the second behavior phase characteristic are respectively matched with the feature rule to obtain a first risk identification result; if there is a suspected risk result that matches the intelligence library label in the first risk identification result, the intelligence library collision process is executed to obtain a second risk identification result; wherein the intelligence library label represents that the first behavior phase characteristic or the second behavior phase characteristic is mutually associated with the data information in the intelligence library; if the second risk identification result is a safety result and there is a suspected risk result that matches the unknown risk label in the first risk identification result, the heuristic scanning process is executed to obtain a third risk identification result; the behavior risk of the container to be identified is determined according to the first risk identification result, the second risk identification result, and the third risk identification result. It can be seen that real-time acquisition of the first behavioral phase characteristics of the container to be identified and the second behavioral phase characteristics of the host can cover the behavioral data at different stages of both the container and host levels, and fully grasp the dynamics of the entire operating environment. This helps to discover not only the container itself, but also the potential risks that may be affected by the host or the container. The data of each stage of the life cycle corresponding to the execution of any instruction is collected, and no link that may cause risks is missed. The entire process from the start of instruction execution to the end is within the monitoring range, which increases the probability of risk discovery. Furthermore, the multi-stage risk identification method is progressive, which can minimize the omission of risks. The comprehensive use of multiple risk identification methods can timely discover potential risks in container behavior and improve the overall security of the system.

[0121] Reference Figure 4 As shown, the embodiment of the present invention discloses a specific container behavior risk identification method. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically:

[0122] Step S21: acquiring in real time a first behavior phase characteristic of the container to be identified and a second behavior phase characteristic of the host where the container to be identified is located; wherein the first behavior phase characteristic or the second behavior phase characteristic is container data or host data generated at each stage in the life cycle corresponding to the execution of any instruction when executing the instruction.

[0123] Step S22: performing feature rule matching on the first behavior stage feature and the second behavior stage feature respectively according to a preset feature matching rule to obtain a first risk identification result.

[0124] For more detailed processing procedures in steps S21 and S22, please refer to the aforementioned disclosed embodiments, which will not be described in detail here.

[0125] Step S23: If there is an intelligence library label of a suspected risk result in the first risk identification result, the first risk identification result is determined to be a suspected risk result, and the first labeling result and the second labeling result corresponding to the suspected risk result are obtained.

[0126] In this embodiment, further risk analysis is performed based on the matching results of each behavior data obtained after matching by the rule engine (classified and labeled behavior stage data). The collected behavior stage data is all the stage behaviors containing a risk instruction, and the real-time behavior stage data of each stage is labeled. It should be noted that the rules in the rule base can be used for risk labeling according to different stages, so the subsequent process can be performed according to the labeling results: when the data labeling result, that is, the first risk identification result, contains the intelligence library label intelligence, an intelligence library collision is performed. It should be noted that before the intelligence library collides, the objects on which the intelligence library collision process is executed are pre-determined, that is, the first labeling result and the second labeling result.

[0127] Step S24: classifying the first marking result and the second marking result to determine the behavior type to which the current behavior phase characteristic belongs.

[0128] In this embodiment, Figure 5 As shown, the data marking classification of the first marking result and the second marking result is obtained to distinguish the file behavior, domain name access, IP address request, etc. of the first marking result and the second marking result. The behavior type to which the current behavior phase feature belongs is determined.

[0129] Step S25: query whether there is corresponding malicious data information from the intelligence library according to the behavior type and the stage characteristics of the current behavior. If so, obtain a second risk identification result characterized as an alarm result; if not, obtain a second risk identification result characterized as a security result.

[0130] In this embodiment, if the behavior type is a file behavior type, the file information in the first marking result and the second marking result is obtained as the current behavior stage characteristic; according to the file behavior type and the current file type, current file, and current file name in the current behavior stage characteristic, it is inquired from the intelligence library whether there is corresponding malicious file information; if the behavior type is a domain name access type, the domain name information in the first marking result and the second marking result is obtained as the current behavior stage characteristic; according to the domain name access type and the current domain name information in the current behavior stage characteristic, it is inquired from the intelligence library whether there is corresponding malicious domain name information; if the behavior type is an IP access type, the IP information in the first marking result and the second marking result is obtained as the current behavior stage characteristic; according to the IP access type and the current IP information in the current behavior stage characteristic, it is inquired from the intelligence library whether there is corresponding malicious IP information. It is understandable that if it is a file behavior, the file path filePath, file name fileName, file fileHash, and file type fileType in the data are obtained, and the intelligence library is queried based on the obtained file type, file Hash, and file name. If the intelligence exists, a malicious file alarm is generated. If it is a domain name access type, the domain name information in the data is obtained, recorded as domain, and the intelligence library is queried based on domain. If the intelligence library has the same malicious domain name information, a malicious domain name alarm is generated. If it is an IP access type, the IP information in the data is obtained, recorded as IP, and the intelligence library is queried based on IP. If the intelligence library has the same malicious IP information, a malicious IP alarm is generated.

[0131] Step S26: If the second risk identification result is a safe result and there is a suspected risk result matching an unknown risk tag in the first risk identification result, the heuristic scanning process is started.

[0132] In this embodiment, Figure 5As shown in the figure, when there is an unknown risk label in the data labeling result in the first risk identification result and no risk is found in the second risk identification result (the risk may be about to occur or the behavior is suspected of risk behavior), heuristic scanning is required. That is, when the data contains a suspected risk label, it means that in the rule matching process, the data shows some characteristics that may have risks, but it is not enough to determine it as a clear risk. At this time, it is impossible to determine whether there is a real risk by relying solely on rule matching, so further heuristic scanning is required. The addition of the condition that the second risk identification result is a safe result is to make a more comprehensive consideration in the entire risk identification process. Because if the risk has been found in the intelligence library collision process, it will be processed according to the corresponding risk processing process without the need for heuristic scanning. Only when there is no clear risk indicated by the intelligence library label and there is a suspected risk, the heuristic scan is started to further explore whether there is a potential risk. This can avoid repeated processing and improve the efficiency and accuracy of risk identification.

[0133] Step S27: If the behavior type is a file behavior type, obtain the file information and the ID information of the container to be identified, and the IP information of the host where the container to be identified is located in the first marking result and the second marking result; combine the current file path and the current file name in the file information as request parameters, and send the request parameters to the container to be identified corresponding to the ID information of the container to be identified and the host corresponding to the IP information of the host where the container to be identified is located, so as to perform a malicious file scanning operation and obtain a third risk identification result.

[0134] In this embodiment, the heuristic scanning process is as follows: obtain data labeling classification, distinguish file behavior, domain name access, IP address request, etc. If it is a file behavior, obtain the file path filePath, file name fileName, host IP, and container ID in the data. Assign the file path + file name as a request parameter to the specified host / container for malicious file scanning, and generate a malicious file alarm if a risk is found.

[0135] Step S28: If the behavior type is a domain name access type, the current domain name information is subjected to DNS resolution to obtain the resolved IP information, and the resolved IP information is fingerprinted and the IP attribution is detected to obtain the third risk identification result of the resolved IP; if the behavior type is an IP access type, the current IP information is obtained, and the current IP information is fingerprinted and the IP attribution is detected to obtain the third risk identification result of the current IP.

[0136] In this embodiment, if it is a domain name access type, the domain name information in the data is obtained and recorded as domain. DNS resolution is performed according to domain to obtain the resolved IP of the domain name. If it is an IP access type, the IP information in the data is obtained and recorded as IP. Fingerprint and IP attribution detection are performed based on the resolved IP and IP information. If the IP fingerprint information is abnormal or the IP attribution is incorrect, a malicious domain name IP alarm is generated.

[0137] Step S29: determining the behavior risk of the container to be identified according to the first risk identification result, the second risk identification result, and the third risk identification result.

[0138] In this embodiment, if the resolved IP or the current IP has any one or more of fingerprint anomalies and IP location anomalies, it is determined that the container to be identified has a behavioral risk, and an alarm result is output.

[0139] like Figure 6 As shown in the figure, the process of identifying container behavior risks based on multiple risk identification methods starts from the "start" point and enters the monitoring and processing stage of host and container behavior data. First, the host container behavior data is collected in real time, and the host and container behavior data are collected through open source behavior monitoring tools such as Falco and Sysdig. These data include behavioral stage data, such as process execution stage (opflags), process ID (pid), parent process ID (ppid), process name (procName), user ID (uid), group ID (gid), operation instruction (cmdline), operation file name (fileName), file hash (fileHash), instruction execution parameter list (args) and behavior occurrence timestamp (time). At the same time, the host IP and container ID are also collected to distinguish the location where the behavior occurs. The collected data will be reported for subsequent processing.

[0140] The reported data enters the data labeling and classification phase, where the rule engine is used to clean and label the data. The rule engine maintains a list of rules. For example, when the data meets specific conditions, such as the process execution phase is a specific value, the process name meets specific requirements, and the operation instruction contains specific content, it will be labeled according to the tags of the rule. The results after labeling can distinguish different types of behavior and provide a basis for subsequent risk analysis. Next, determine whether the labeled data triggers a risk alarm. If the data meets specific risk conditions, such as containing enough tags to trigger a risk alarm, risk analysis will be performed and a risk alarm will be generated. At the same time, corresponding behavior prevention measures can be taken, such as process killing and container killing, to prevent further expansion of risks.

[0141] At the same time, determine whether the data contains intelligence tags. If there is an intelligence library tag in the data, it may be related to a known security threat, and an intelligence library collision is performed at this time. During the intelligence library collision process, different processing will be performed based on the labeling classification of the data. If it is a file behavior, obtain the file path, file name, file hash, file type and other information in the data, and then query the intelligence library based on this information. If the same malicious file information exists in the intelligence library, a malicious file alarm is generated.

[0142] If it is a domain name access type, obtain the domain name information in the data and query the intelligence database based on the domain name. If the intelligence database contains the same malicious domain name information, a malicious domain name alarm is generated.

[0143] If it is an IP access type, obtain the IP information in the data and query the intelligence database based on the IP. If the intelligence database contains the same malicious IP information, a malicious IP alarm is generated.

[0144] After the intelligence database is collided, it is determined whether the risk is successfully discovered. If a risk is discovered, risk assessment is performed and a risk warning is generated. At the same time, actions such as behavior blocking can be taken.

[0145] If the data does not contain an intelligence label or no risk is found in the intelligence database collision, then determine whether the data contains a suspected risk label. If the data contains a suspected risk label and no risk is found in the intelligence database collision, then perform a heuristic scan.

[0146] Heuristic scanning performs different operations based on the data's label classification:

[0147] If it is a file behavior, obtain the file path, file name, host IP, and container ID in the data. Combine the file path and file name as request parameters and assign them to the specified host or container for malicious file scanning. If risks are found, a malicious file alarm is generated, and malicious file deletion and other operations can be performed as needed.

[0148] If it is a domain name access type, obtain the domain name information in the data, perform DNS resolution to obtain the domain name resolution IP. Then perform fingerprint and IP location detection on the resolution IP. If the IP fingerprint information is abnormal or there is a problem with the IP location, a malicious domain name IP alarm is generated.

[0149] If it is an IP access type, obtain the IP information in the data, perform fingerprint and IP location detection on the IP. If a problem is found, a malicious IP alarm is generated.

[0150] If risks are found after heuristic scanning, risk assessment is performed and risk warnings are generated, and corresponding measures can be taken. If no risks are found, the behavior is ignored. If the data does not contain suspected risk tags, the behavior is also ignored.

[0151] It can be seen that different processing methods are adopted for different types of behaviors such as file behavior, domain name access and IP address request. For file behavior, malicious file scanning is performed by combining file path and file name; for domain name access, DNS resolution is performed and fingerprint and location detection is performed on the resolved IP; for IP access, fingerprint and location detection is performed directly on the IP. This targeted processing method can better adapt to different types of behaviors and improve the efficiency and accuracy of risk identification. The processing strategies at each stage can be flexibly adjusted according to actual conditions to meet security needs in different scenarios. For example, the rules for feature rule matching can be adjusted according to the update of the intelligence library and the actual risk situation, or the parameters of heuristic scanning can be adjusted according to changes in the network environment. When malicious data information is found, an alarm result can be quickly generated to remind relevant personnel to take timely measures. For different types of risks such as malicious files, malicious domain names and malicious IPs, there are clear alarm mechanisms, allowing security personnel to quickly locate problems and handle them. Heuristic scanning can actively conduct in-depth inspections in suspected risk situations and discover potential risks in a timely manner. If risks are found in heuristic scanning, alarms can also be quickly generated, and malicious file deletion and other operations can be automatically performed as needed to effectively prevent the expansion of risks.

[0152] Reference Figure 7 As shown, the present invention also discloses a container behavior risk identification device, comprising:

[0153] The feature acquisition module 11 is used to acquire in real time a first behavior phase feature of the container to be identified and a second behavior phase feature of the host where the container to be identified is located; wherein the first behavior phase feature or the second behavior phase feature is the container data or host data generated at each stage of the life cycle corresponding to the execution of any instruction when executing the instruction;

[0154] A rule matching module 12, configured to perform feature rule matching on the first behavior phase feature and the second behavior phase feature respectively according to a preset feature matching rule to obtain a first risk identification result;

[0155] The intelligence library collision module 13 is used to execute the intelligence library collision process to obtain a second risk identification result if there is a suspected risk result matching the intelligence library label in the first risk identification result; wherein the intelligence library label represents that the first behavior stage feature or the second behavior stage feature is associated with the data information in the intelligence library;

[0156] A scanning module 14 is configured to execute a heuristic scanning process to obtain a third risk identification result if the second risk identification result is a safe result and there is a suspected risk result matching an unknown risk tag in the first risk identification result;

[0157] The risk determination module 15 is used to determine the behavior risk of the container to be identified according to the first risk identification result, the second risk identification result, and the third risk identification result.

[0158] It can be seen that the present application discloses real-time acquisition of the first behavioral phase characteristics of the container to be identified and the second behavioral phase characteristics of the host where the container to be identified is located; wherein the first behavioral phase characteristics or the second behavioral phase characteristics are container data or host data generated at each stage in the life cycle corresponding to the execution of any instruction when executing the instruction; the first behavioral phase characteristics and the second behavioral phase characteristics are respectively matched according to the preset feature matching rules to obtain a first risk identification result; if there is a suspected risk result that matches the intelligence library label in the first risk identification result, the intelligence library collision process is executed to obtain a second risk identification result; wherein the intelligence library label represents that the first behavioral phase characteristics or the second behavioral phase characteristics are mutually associated with the data information in the intelligence library; if the second risk identification result is a safety result and there is a suspected risk result that matches the unknown risk label in the first risk identification result, the heuristic scanning process is executed to obtain a third risk identification result; the behavioral risk of the container to be identified is determined according to the first risk identification result, the second risk identification result, and the third risk identification result. It can be seen that real-time acquisition of the first behavioral phase characteristics of the container to be identified and the second behavioral phase characteristics of the host can cover the behavioral data at different stages of both the container and host levels, and fully grasp the dynamics of the entire operating environment. This helps to discover not only the container itself, but also the potential risks that may be affected by the host or the container. The data of each stage of the life cycle corresponding to the execution of any instruction is collected, and no link that may cause risks is missed. The entire process from the start of instruction execution to the end is within the monitoring range, which increases the probability of risk discovery. Furthermore, the multi-stage risk identification method is progressive, which can minimize the omission of risks. The comprehensive use of multiple risk identification methods can timely discover potential risks in container behavior and improve the overall security of the system.

[0159] Furthermore, the present application also discloses an electronic device. Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0160] Figure 8A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the container behavior risk identification method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0161] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0162] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0163] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0164] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the container behavior risk identification method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. In addition to data received by the electronic device and transmitted from an external device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0165] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the container behavior risk identification method disclosed above is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0166] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0167] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly with hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory RAM (Random Access Memory), memory, read-only memory ROM (Read Only Memory), electrically programmable EPROM (Electrically Programmable Read Only Memory), electrically erasable programmable EEPROM (ElectricErasable Programmable Read Only Memory), register, hard disk, removable disk, CD-ROM (CompactDisc-Read Only Memory), or any other form of storage medium known in the technical field.

[0168] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0169] The scheme provided by the present invention is introduced in detail above. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A container behavior risk identification method, characterized in that: include: Acquire in real time a first behavior phase characteristic of a container to be identified and a second behavior phase characteristic of a host where the container to be identified is located; wherein the first behavior phase characteristic or the second behavior phase characteristic is container data or host data generated at each stage of a life cycle corresponding to the execution of any instruction when executing the instruction; According to a preset feature matching rule, feature rule matching is performed on the first behavior stage feature and the second behavior stage feature respectively to obtain a first risk identification result; If there is a suspected risk result that matches the intelligence library label in the first risk identification result, the intelligence library collision process is executed to obtain a second risk identification result; wherein the intelligence library label represents that the first behavior stage feature or the second behavior stage feature is associated with the data information in the intelligence library; If the second risk identification result is a safe result and there is a suspected risk result matching an unknown risk tag in the first risk identification result, a heuristic scanning process is performed to obtain a third risk identification result; The behavior risk of the to-be-identified container is determined according to the first risk identification result, the second risk identification result, and the third risk identification result.

2. The container behavior risk identification method according to claim 1 is characterized in that: The step of acquiring in real time a first behavior phase characteristic of the container to be identified and a second behavior phase characteristic of the host where the container to be identified is located includes: Using a preset behavior monitoring tool to monitor the container to be identified and the host where the container to be identified is located in real time, so as to obtain a first real-time process behavior feature field of the container to be identified and a second real-time process behavior feature field of the host where the container to be identified is located, which are reported in real time; A first behavior phase characteristic of the container to be identified and a second behavior phase characteristic of the host where the container to be identified is located are determined based on the first real-time process behavior characteristic field and the second real-time process behavior characteristic field respectively.

3. The container behavior risk identification method according to claim 1 is characterized in that: The performing feature rule matching on the first behavior phase feature and the second behavior phase feature respectively according to a preset feature matching rule to obtain a first risk identification result includes: Using a preset rule engine to perform data cleaning processing on the first behavior stage feature and the second behavior stage feature respectively, so as to obtain a first target behavior stage feature and a second target behavior stage feature that meet the data cleaning condition in the preset rule engine; Using the preset feature matching rule in the preset rule engine, the first target behavior phase feature and the second target behavior phase feature are respectively subjected to feature marking processing to obtain corresponding first marking results and second marking results; Acquire a first risk identification result of the container to be identified according to the first marking result and the second marking result; If the first risk identification result is a safety result or an alarm result, the safety result or the alarm result is directly output and the risk identification process ends.

4. The container behavior risk identification method according to claim 3 is characterized in that: If there is a suspected risk result matching the intelligence library label in the first risk identification result, executing the intelligence library collision process to obtain a second risk identification result, including: If the first risk identification result contains an intelligence library label of a suspected risk result, the first risk identification result is determined to be a suspected risk result, and the first labeling result and the second labeling result corresponding to the suspected risk result are obtained; Classifying the first marking result and the second marking result to determine the behavior type to which the current behavior phase characteristic belongs; According to the behavior type and the stage characteristics of the current behavior, query from the intelligence database whether there is corresponding malicious data information, and if so, obtain a second risk identification result characterized as an alarm result; If not, a second risk identification result characterized as a safety result is obtained.

5. The container behavior risk identification method according to claim 4 is characterized in that: The querying from the intelligence library whether there is corresponding malicious data information according to the behavior type and the stage characteristics of the current behavior includes: If the behavior type is a file behavior type, obtaining file information in the first marking result and the second marking result as a current behavior phase feature; According to the file behavior type and the current file type, current file, and current file name in the current behavior phase characteristics, query from the intelligence library whether there is corresponding malicious file information; If the behavior type is a domain name access type, obtaining domain name information in the first marking result and the second marking result as a current behavior phase feature; According to the domain name access type and the current domain name information in the current behavior phase characteristics, querying from the intelligence database whether there is corresponding malicious domain name information; If the behavior type is an IP access type, obtaining IP information in the first marking result and the second marking result as a phase feature of the current behavior; According to the IP access type and the current IP information in the current behavior phase characteristics, query from the intelligence library whether there is corresponding malicious IP information.

6. The container behavior risk identification method according to claim 5 is characterized in that: The executing heuristic scanning process to obtain the third risk identification result includes: If the behavior type is a file behavior type, obtaining file information and ID information of the container to be identified and IP information of the host where the container to be identified is located in the first marking result and the second marking result; Combining the current file path and the current file name in the file information into a request parameter, and sending the request parameter to the container to be identified corresponding to the ID information of the container to be identified and the host corresponding to the IP information of the host where the container to be identified is located, so as to perform a malicious file scanning operation and obtain a third risk identification result; If the behavior type is a domain name access type, the current domain name information is subjected to DNS resolution to obtain resolved IP information, and fingerprint and IP attribution detection are performed on the resolved IP information to obtain a third risk identification result of the resolved IP; If the behavior type is an IP access type, the current IP information is obtained, and fingerprint and IP attribution detection are performed on the current IP information to obtain a third risk identification result of the current IP.

7. The container behavior risk identification method according to claim 6 is characterized in that: Determining the behavior risk of the container to be identified according to the third risk identification result includes: If the resolved IP or the current IP has any one or more of fingerprint anomalies and IP location anomalies, it is determined that the container to be identified has a behavioral risk, and an alarm result is output.

8. A container behavior risk identification device, characterized in that: include: A feature acquisition module, used to acquire in real time a first behavior phase feature of a container to be identified and a second behavior phase feature of a host where the container to be identified is located; wherein the first behavior phase feature or the second behavior phase feature is container data or host data generated at each stage of a life cycle corresponding to the execution of any instruction when executing the instruction; A rule matching module, used for performing feature rule matching on the first behavior stage feature and the second behavior stage feature respectively according to a preset feature matching rule to obtain a first risk identification result; An intelligence library collision module, configured to execute an intelligence library collision process to obtain a second risk identification result if there is a suspected risk result that matches an intelligence library label in the first risk identification result; wherein the intelligence library label represents that the first behavior phase feature or the second behavior phase feature is associated with the data information in the intelligence library; a scanning module, configured to execute a heuristic scanning process to obtain a third risk identification result if the second risk identification result is a safe result and there is a suspected risk result matching an unknown risk tag in the first risk identification result; A risk determination module is used to determine the behavior risk of the container to be identified according to the first risk identification result, the second risk identification result, and the third risk identification result.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the container behavior risk identification method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the container behavior risk identification method according to any one of claims 1 to 7 are implemented.

Images