Container intrusion detection method and system

Abstract

The present invention discloses a container intrusion detection method and system, which traverses the container and collects call sequence samples; forms training set data based on data preprocessing of the call sequence samples; converts the call sequence samples into graph relationships, and calculates the characteristic value of each system call node, thereby further controlling the call sequence samples and fully considering the characteristic value of each system call node. Based on the characteristic value of each system call node, the cluster analysis of the call sequence samples is triggered to output the clustering results; based on the screening of the clustering results, the system call sequence with intrusion behavior is defined, the characteristic value of each system call node is further controlled, and the sequence with intrusion behavior is defined in the cluster analysis, and finally the real-time monitoring and intrusion detection of the production environment are realized, which can effectively improve the security and reliability of the container and be compatible with real-time intrusion detection of various production environments.

Description

Technical Field

[0001] The present invention relates to the technical field of containers, and in particular to a container intrusion detection method and system. Background Art

[0002] With the development of science and technology, container technology has been widely used in the industry due to its lightweight, flexible and fast deployment characteristics, and has become an important part of the basic technology in the cloud computing era. Containers not only play the role of underlying technology in emerging fields such as cloud computing, microservices, and the Internet of Things, but their high efficiency and flexibility also make container technology the first choice for enterprises pursuing rapid development and deployment. However, the security issues of containers have gradually been exposed, mainly reflected in container intrusions. Existing technologies mainly perform phased detection on containers and are not compatible with real-time intrusion detection in various production environments. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art. The present invention provides a container intrusion detection method and system, which traverses the container and collects call sequence samples; forms training set data based on data preprocessing of the call sequence samples; converts the call sequence samples into graph relationships, and calculates the characteristic value of each system call node, thereby achieving further control of the call sequence samples and fully considering the characteristic value of each system call node.

[0004] Based on the characteristic value of each system call node, the cluster analysis of the call sequence samples is triggered to output the clustering results; based on the screening of the clustering results, the system call sequence with intrusion behavior is defined, the characteristic value of each system call node is further controlled, and the sequence with intrusion behavior is defined in the cluster analysis. Finally, real-time monitoring and intrusion detection of the production environment are realized, which can effectively improve the security and reliability of the container and be compatible with real-time intrusion detection in various production environments.

[0005] An embodiment of the present invention provides a container intrusion detection method, which is applied to a container intrusion detection scenario;

[0006] The container intrusion detection method comprises:

[0007] Traverse the container and collect call sequence samples;

[0008] Forming training set data based on data preprocessing of the calling sequence samples;

[0009] Convert the call sequence samples into graph relationships and calculate the feature value of each system call node;

[0010] Triggering cluster analysis of call sequence samples based on the characteristic value of each system call node to output clustering results;

[0011] Defining the system call sequence with intrusion behavior based on the screening of clustering results;

[0012] Monitor the production environment in real time and perform real-time intrusion detection on container processes in the production environment.

[0013] Optionally, traversing the container and collecting call sequence samples includes:

[0014] Positioning container;

[0015] Model and load of collection container;

[0016] Define the corresponding traversal mode according to the container model and load;

[0017] Traverse the container along the traversal mode;

[0018] A data space is defined based on the traversal of the container, and call sequence samples are collected in the data space. At this time, the system call trace generated by the container process is intercepted on the host machine, and the corresponding numbering sequence is matched based on the call sequence samples.

[0019] Optionally, the data preprocessing based on the calling sequence samples to form the training set data includes:

[0020] Freeze call sequence sample;

[0021] Divide multiple data combinations based on call sequence samples;

[0022] Outputting a corresponding optimized data set based on data preprocessing of multiple data combinations;

[0023] The data set after freeze-frame optimization;

[0024] Form corresponding training data according to the optimized data set;

[0025] The corresponding detection learning model is trained based on the training data until the corresponding detection learning model is output.

[0026] Optionally, converting the call sequence samples into a graph relationship and calculating the characteristic value of each system call node includes:

[0027] Perform data detection on containers;

[0028] A corresponding system call node is defined based on data detection of the container. In this case, there are multiple system call nodes.

[0029] Associating a plurality of system call nodes and edges connecting two adjacent system call nodes, forming a corresponding graph relationship according to the transformation of the plurality of system call nodes, the corresponding edges and the call sequence samples, so as to output a system call node graph;

[0030] Locate each system call node;

[0031] Based on each system call node and system call node graph, Katz centrality, Betweenness centrality, Closeness centrality and Pagerank centrality are defined;

[0032] Katz centrality, Betweenness centrality, Closeness centrality and Pagerank centrality are defined as the eigenvalues ​​of each system call node.

[0033] Optionally, triggering cluster analysis of call sequence samples based on the characteristic value of each system call node to output clustering results includes:

[0034] Freeze the characteristic value of each system call node;

[0035] Embedded control for each system call node;

[0036] Aggregate information of multiple adjacent system call nodes and capture the complex dependencies and interaction features between system calls;

[0037] Collect the characteristic values ​​and call sequence samples of each system call node;

[0038] Associate the feature values ​​of each system call node with the call sequence samples;

[0039] A clustering analysis of the call sequence samples is triggered based on the feature value of each system call node and the call sequence samples to output a clustering result.

[0040] Optionally, the defining of the system call sequence with intrusion behavior based on the screening of the clustering results includes:

[0041] Freeze the clustering results and filter the clustering results;

[0042] Defining sequence combinations based on screening of clustering results;

[0043] Associating sequence combinations and corresponding detection learning models;

[0044] The detection learning model is trained back and forth based on the training set data and dynamically optimized based on the model prediction results and true labels.

[0045] Optionally, the defining of the system call sequence with intrusion behavior based on the screening of the clustering results further includes:

[0046] A loss function is introduced into the detection learning model, and the model parameters of the detection learning model are gradually optimized according to the loss function to improve the detection accuracy of the detection learning model;

[0047] The system call sequence with intrusion behavior is defined based on sequence combination and corresponding detection learning model.

[0048] Optionally, the real-time monitoring of the production environment and real-time intrusion detection of container processes in the production environment include:

[0049] Monitor the location of the production environment in real time;

[0050] Locate the production environment based on its location and monitor it in real time;

[0051] Define containers in the production environment based on the traversal of the production environment.

[0052] Optionally, the real-time monitoring of the production environment and real-time intrusion detection of container processes in the production environment further includes:

[0053] Collect the processes corresponding to the containers in the production environment;

[0054] Associating the process with the detection learning model and performing real-time intrusion detection on the process;

[0055] In real-time intrusion detection of a process, an anomaly set is defined based on the process and the detection learning model;

[0056] Based on the screening of the anomaly set, the system call sequence with intrusion behavior is defined.

[0057] In addition, an embodiment of the present invention further provides an intrusion detection system for a container, the intrusion detection system for a container comprising:

[0058] The collection module is used to traverse the container and collect call sequence samples;

[0059] A training module, used for forming training set data based on data preprocessing of the calling sequence samples;

[0060] The node module is used to convert the call sequence samples into graph relationships and calculate the feature value of each system call node;

[0061] A clustering module, used to trigger clustering analysis of call sequence samples based on the characteristic value of each system call node to output clustering results;

[0062] An intrusion module is used to define the system call sequence with intrusion behavior based on the screening of clustering results;

[0063] The detection module is used to monitor the production environment in real time and perform real-time intrusion detection on the processes of containers in the production environment.

[0064] In an embodiment of the present invention, through the method in the embodiment of the present invention, the container is traversed and call sequence samples are collected; training set data is formed based on data preprocessing of the call sequence samples; the call sequence samples are converted into graph relationships, and the characteristic values ​​of each system call node are calculated, thereby achieving further control of the call sequence samples and fully considering the characteristic values ​​of each system call node.

[0065] Based on the characteristic value of each system call node, the cluster analysis of the call sequence samples is triggered to output the clustering results; based on the screening of the clustering results, the system call sequence with intrusion behavior is defined, the characteristic value of each system call node is further controlled, and the sequence with intrusion behavior is defined in the cluster analysis. Finally, real-time monitoring and intrusion detection of the production environment are realized, which can effectively improve the security and reliability of the container and be compatible with real-time intrusion detection in various production environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0067] Figure 1 is a schematic flow chart of a method for detecting intrusion of a container in an embodiment of the present invention;

[0068] Figure 2 is a schematic diagram of the flow of S11 in the container intrusion detection method in an embodiment of the present invention;

[0069] Figure 3 is a schematic diagram of the flow of S12 in the container intrusion detection method in the embodiment of the present invention;

[0070] Figure 4 is a schematic diagram of the flow of S13 in the container intrusion detection method in an embodiment of the present invention;

[0071] Figure 5 is a schematic diagram of the flow of S14 in the container intrusion detection method in an embodiment of the present invention;

[0072] Figure 6 is a schematic diagram of the flow of S15 in the container intrusion detection method in an embodiment of the present invention;

[0073] Figure 7is a schematic diagram of the flow of S16 in the container intrusion detection method in an embodiment of the present invention;

[0074] Figure 8 is a schematic diagram of the structure of an intrusion detection system for a container in an embodiment of the present invention;

[0075] Fig. 9 The figure is a hardware diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0076] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0077] See also Figures 1 to 9 A container intrusion detection method is applied to a container intrusion detection scenario; the container intrusion detection method includes:

[0078] Step S11: traverse the container and collect call sequence samples;

[0079] Step S12: forming training set data based on data preprocessing of the calling sequence samples;

[0080] Step S13: converting the call sequence samples into a graph relationship and calculating the feature value of each system call node;

[0081] Step S14: triggering cluster analysis of call sequence samples based on the characteristic value of each system call node to output clustering results;

[0082] Step S15: defining a system call sequence with intrusion behavior based on the screening of clustering results;

[0083] Step S16: monitor the production environment in real time, and perform real-time intrusion detection on the processes of containers in the production environment.

[0084] In an embodiment of the present invention, through the method in the embodiment of the present invention, the container is traversed and call sequence samples are collected; training set data is formed based on data preprocessing of the call sequence samples; the call sequence samples are converted into graph relationships, and the characteristic values ​​of each system call node are calculated, thereby achieving further control of the call sequence samples and fully considering the characteristic values ​​of each system call node.

[0085] Based on the characteristic value of each system call node, the cluster analysis of the call sequence samples is triggered to output the clustering results; based on the screening of the clustering results, the system call sequence with intrusion behavior is defined, the characteristic value of each system call node is further controlled, and the sequence with intrusion behavior is defined in the cluster analysis. Finally, real-time monitoring and intrusion detection of the production environment are realized, which can effectively improve the security and reliability of the container and be compatible with real-time intrusion detection in various production environments.

[0086] refer to Figure 2 , in step S11, traverse the container and collect call sequence samples;

[0087] In the specific implementation process of the present invention, the specific steps may be:

[0088] S111: Positioning container;

[0089] S112: collecting the model and load of the container;

[0090] S113: defining a corresponding traversal mode according to the container model and load;

[0091] S114: traverse the container along the traversal pattern;

[0092] S115: A data space is defined based on the traversal of the container, and call sequence samples are collected in the data space. At this time, the system call trace generated by the container process is intercepted on the host machine, and the corresponding numbering sequence is matched based on the call sequence samples.

[0093] In the embodiment of the present application, the container is located, and the container is further controlled. At the same time, the model and load of the container are collected to facilitate overall control of the model and load of the container, thereby performing multi-dimensional control of the model and load of the container, so as to define the corresponding traversal mode according to the model and load of the container, thereby ensuring the accuracy of the traversal mode. Optionally, the traversal mode includes traversal modes such as overall traversal and local traversal.

[0094] Furthermore, the container is traversed along the traversal pattern, so as to define a data space based on the traversal of the container, and call sequence samples are collected in the data space, and call sequence samples are introduced to further control the call sequence samples.

[0095] At this time, the system call trace generated by the container process is intercepted on the host machine, and the corresponding numbering sequence is matched based on the call sequence sample. Furthermore, a unique number is assigned to each system call sample through direct number mapping, which simplifies the difficulty of subsequent data processing and improves analysis efficiency.

[0096] refer to Figure 3, in step S12, training set data is formed based on data preprocessing of the calling sequence samples;

[0097] In the specific implementation process of the present invention, the specific steps may be:

[0098] S121: freeze frame call sequence sample;

[0099] S122: Divide a plurality of data combinations based on the calling sequence samples;

[0100] S123: outputting a corresponding optimized data set based on data preprocessing of multiple data combinations;

[0101] S124: freeze-frame optimized data set;

[0102] S125: forming corresponding training data according to the optimized data set; training the corresponding detection learning model based on the training data until the corresponding detection learning model is output.

[0103] In an embodiment of the present application, the calling sequence samples are frozen, and the calling sequence samples are further controlled, so as to divide multiple data combinations based on the calling sequence samples, so as to introduce multiple data combinations and realize further processing of the multiple data combinations.

[0104] At this time, the corresponding optimized data set is output based on the data preprocessing of multiple data combinations. For the data preprocessing of multiple data combinations, the calling sequence samples are enriched by insertion, deletion, replacement, etc., so as to form training set data, improve the generalization ability of the model, and avoid the risk of overfitting.

[0105] Therefore, the optimized data set is fixed; corresponding training data is formed according to the optimized data set; the corresponding detection learning model is trained based on the training data until the corresponding detection learning model is output, thereby achieving preliminary optimization of the data set and training of the corresponding training data, and ensuring the accuracy of the detection learning model.

[0106] refer to Figure 4 ,In step S13, the call sequence samples are converted into graph relations, and the characteristic value of each system call node is calculated;

[0107] In the specific implementation process of the present invention, the specific steps may be:

[0108] S131: Perform data detection on the container;

[0109] S132: defining a corresponding system call node based on data detection of the container, where there are multiple system call nodes;

[0110] S133: Associating a plurality of system call nodes and edges connecting two adjacent system call nodes, forming a corresponding graph relationship according to the transformation of the plurality of system call nodes, the corresponding edges and the call sequence samples, so as to output a system call node graph;

[0111] S134: Locate each system call node;

[0112] S135: Define Katz centrality, Betweenness centrality, Closeness centrality and Pagerank centrality based on each system call node and the system call node graph;

[0113] S136: Define Katz centrality, Betweenness centrality, Closeness centrality, and Pagerank centrality as eigenvalues ​​of each system call node.

[0114] In an embodiment of the present application, the container is traversed and call sequence samples are collected; training set data is formed based on data preprocessing of the call sequence samples; the call sequence samples are converted into graph relationships, and the characteristic values ​​of each system call node are calculated, thereby achieving further control of the call sequence samples and fully considering the characteristic values ​​of each system call node.

[0115] At this time, data detection is performed on the container, so that a corresponding system call node is defined based on the data detection of the container. At this time, there are multiple system call nodes, and control is performed on the multiple system call nodes.

[0116] At the same time, multiple system call nodes and the edges connecting two adjacent system call nodes are associated, and corresponding graph relationships are formed according to the transformation of multiple system call nodes, corresponding edges, and call sequence samples to output the system call node graph; at this time, based on the GNN image classification model, a system call graph is constructed based on the system log, where the nodes represent system calls and the edges represent the order or dependency between calls. In this way, the system call graph can accurately reflect the interaction patterns and dependencies between various system calls, and calculate the Katz centrality, Betweenness centrality, Closeness centrality, and Pagerank centrality of each system call node as the feature value of the node. The GNN model is used to learn the embedded representation of each node, and by aggregating the information of its neighboring nodes, the complex dependencies and interaction features between system calls are captured to identify container intrusion behaviors.

[0117] At this time, the GNN model is used to learn the embedded representation of each node. By aggregating the information of its neighboring nodes, the complex dependencies and interaction features between system calls are captured, and clustering analysis of system call sequences is realized. The clustering results of system call sequences are used to discover system call sequences with intrusion behaviors.

[0118] Optionally, the present invention is based on the system call sequence of the container process. The system call is the bridge for the user program to communicate with the operating system. The isolation of the container process is based on the namespace feature of the Linux kernel and the Cgroup technology. The system kernel is shared with the host machine, which means that the system call data collection for the container can be completed directly on the host machine without installing any agent inside the container or using complex technology. Each container can be regarded as an independently running process. Through the system call interception technology, we can obtain the system call function trace generated by the container process, thereby providing data support for subsequent security analysis and intrusion detection.

[0119] Therefore, each system call node is located; based on each system call node and the system call node graph, Katz centrality, Betweenness centrality, Closeness centrality and Pagerank centrality are defined; Katz centrality, Betweenness centrality, Closeness centrality and Pagerank centrality are defined as the characteristic values ​​of each system call node.

[0120] refer to Figure 5 , S14: triggering cluster analysis of call sequence samples based on the characteristic value of each system call node to output clustering results;

[0121] In the specific implementation process of the present invention, the specific steps may be:

[0122] S141: freeze the characteristic value of each system call node;

[0123] S142: Embedding control on each system call node;

[0124] S143: Aggregate information of multiple adjacent system call nodes and capture complex dependencies and interaction features between system calls;

[0125] S144: Collecting feature values ​​and call sequence samples of each system call node; associating feature values ​​and call sequence samples of each system call node;

[0126] S145: triggering cluster analysis of the call sequence samples based on the feature value of each system call node and the call sequence samples to output a clustering result.

[0127] In the embodiment of the present application, the characteristic value of each system call node is fixed, and the characteristic value of each system call node is further controlled. At the same time, each system call node is embedded and controlled to aggregate the information of multiple adjacent system call nodes and capture the complex dependencies and interaction features between system calls. For graph neural network training, the GNN model is used to learn the embedded representation of each node, and by aggregating the information of its neighboring nodes, the complex dependencies and interaction features between system calls are captured, and cluster analysis of system call sequences is achieved.

[0128] Therefore, the characteristic value and call sequence sample of each system call node are collected; the characteristic value and call sequence sample of each system call node are associated; based on the characteristic value and call sequence sample of each system call node, cluster analysis of the call sequence sample is triggered to output the clustering result.

[0129] Optionally, a graph convolutional neural network is selected to learn graph node features. The goal is to convert the n×d feature matrix extracted by the struc2vec method into a lower-dimensional l×m feature matrix, where l≤n and m≤d, for graph classification.

[0130] In each layer l of a graph convolutional network (GCN), a node v∈V has a hidden vector Initial value of hidden vector Calculated by the struc2vec method. At each layer l, node v collects information from its neighbor nodes and calculates the hidden vector of node v as follows

[0131]

[0132] Where N(v) represents the neighbor nodes with which there is an edge with node v, and W represents the size d l-1 ×d l The weight matrix of l is the dimension of the hidden vector of the lth layer, and σ represents the Sigmoid activation function used to activate neurons. In this way, the hidden vectors of all nodes in all layers are calculated. The hidden vector of the last layer k is the node embedding vector of node v, expressed as:

[0133]

[0134] The node embedding vectors of all nodes are added together to form the graph representation z G As shown in the following formula, where z v The node embedding vector representing node v is:

[0135] z G =∑ v∈V zv .

[0136] In order to further capture the structural information in the graph and the interactions between nodes, we add weights to the GCN model. Define T = {(A i ,N i ,Y i ):i=1,…,m} is a training set containing m graphs. For the graph G numbered i i =(V i ,E i ), Ai represents the adjacency matrix of the graph, Ni represents the feature matrix of the graph, and Yi represents the label of the graph. First, initialize the random weight value for the training sample (A i ,N i ) to predict the label. Then compare the predicted result with the true label Y of the sample i The error and loss function are calculated by comparing the predicted result with the actual label. The weight can be obtained by a d l-1 ×d l The size of the matrix W is represented by d l-1 and d l are the dimensions of the hidden vectors of the l-1th layer and the lth layer respectively. The weights are updated by the Adam optimization algorithm and back propagation. The Adam algorithm is an algorithm used for deep learning optimizers. It combines the advantages of momentum and adaptive learning rate, calculates the adaptive learning rate of each parameter, and can automatically adjust the learning rate at different stages to accelerate model convergence.

[0137] refer to Figure 6 ,S15: Defining the system call sequence with intrusion behavior based on the ,screening of clustering results;

[0138] In the specific implementation process of the present invention, the specific steps may be:

[0139] S151: freeze the clustering results and screen the clustering results;

[0140] S152: defining sequence combinations based on screening of clustering results;

[0141] S153: Associating sequence combinations and corresponding detection learning models;

[0142] S154: The detection learning model is trained back and forth based on the training set data, and is dynamically optimized based on the model prediction results and the true labels;

[0143] S155: introducing a loss function into the detection learning model, and gradually optimizing the model parameters of the detection learning model according to the loss function, so as to improve the detection accuracy of the detection learning model;

[0144] S156: Define a system call sequence with intrusion behavior based on the sequence combination and the corresponding detection learning model.

[0145] In an embodiment of the present application, a cluster analysis of call sequence samples is triggered based on the characteristic value of each system call node to output a clustering result; based on the screening of the clustering results, a system call sequence with intrusion behavior is defined, the characteristic value of each system call node is further controlled, and a sequence with intrusion behavior is defined in the cluster analysis.

[0146] At this point, the clustering results are frozen and screened, so that sequence combinations can be defined based on the screening of the clustering results, and the sequence combinations can be further controlled.

[0147] Furthermore, the associated sequence combinations and the corresponding detection learning models are controlled as a whole, so that the detection learning models can be repeatedly trained based on the training set data and dynamically optimized based on the model prediction results and the true labels.

[0148] At the same time, a loss function is introduced to the detection learning model, and the model parameters of the detection learning model are gradually optimized according to the loss function to improve the detection accuracy of the detection learning model; based on the sequence combination and the corresponding detection learning model, the system call sequence with intrusion behavior is defined, the characteristic value of each system call node is further controlled, and the sequence with intrusion behavior is defined in the cluster analysis. Optionally, the detection model is run on the test set, and the loss function is calculated and the model parameters are optimized by comparing the model prediction results and the true labels to improve the accuracy of intrusion detection.

[0149] refer to Figure 7 ,S16: Real-time monitoring of the production environment, and real-time intrusion detection of container processes in the production environment;

[0150] In the specific implementation process of the present invention, the specific steps may be:

[0151] S161: Real-time monitoring of the location of the production environment;

[0152] S162: locate the production environment based on the location of the production environment, and monitor the production environment in real time;

[0153] S163: defining containers in the production environment based on the traversal of the production environment;

[0154] S164: Collect the processes corresponding to the containers in the production environment; associate the processes with the detection learning model, and perform real-time intrusion detection on the processes;

[0155] S165: In real-time intrusion detection of a process, an anomaly set is defined according to the process and the detection learning model;

[0156] S166: Define a system call sequence with intrusion behavior based on the screening of the exception set.

[0157] In the specific implementation process of the present invention, cluster analysis of call sequence samples is triggered based on the characteristic value of each system call node to output clustering results; system call sequences with intrusion behaviors are defined based on the screening of clustering results, the characteristic value of each system call node is further controlled, and sequences with intrusion behaviors are defined in the cluster analysis, and finally real-time monitoring and intrusion detection of the production environment are realized, which can effectively improve the security and reliability of the container and be compatible with real-time intrusion detection of various production environments.

[0158] At this time, the location of the production environment is monitored in real time, so that the production environment can be located based on its location, and the production environment can be monitored in real time to facilitate in-depth control of the production environment, thereby defining containers in the production environment based on the traversal of the production environment.

[0159] Furthermore, the processes corresponding to the containers in the production environment are collected; the processes and the detection learning model are associated, and real-time intrusion detection is performed on the processes; in the real-time intrusion detection of the processes, an anomaly set is defined based on the processes and the detection learning model; based on the screening of the anomaly set, a system call sequence with intrusion behavior is defined, thereby realizing real-time intrusion detection of the production environment container processes.

[0160] In an embodiment of the present invention, through the method in the embodiment of the present invention, the container is traversed and call sequence samples are collected; training set data is formed based on data preprocessing of the call sequence samples; the call sequence samples are converted into graph relationships, and the characteristic values ​​of each system call node are calculated, thereby achieving further control of the call sequence samples and fully considering the characteristic values ​​of each system call node.

[0161] Based on the characteristic value of each system call node, the cluster analysis of the call sequence samples is triggered to output the clustering results; based on the screening of the clustering results, the system call sequence with intrusion behavior is defined, the characteristic value of each system call node is further controlled, and the sequence with intrusion behavior is defined in the cluster analysis. Finally, real-time monitoring and intrusion detection of the production environment are realized, which can effectively improve the security and reliability of the container and be compatible with real-time intrusion detection in various production environments.

[0162] See also Figure 8 , Figure 8 It is a schematic diagram of the structural composition of the container intrusion detection system in an embodiment of the present invention.

[0163] like Figure 8 As shown, a container intrusion detection system, the container intrusion detection system comprising:

[0164] A collection module 21, used to traverse the container and collect call sequence samples;

[0165] A training module 22, used for forming training set data based on data preprocessing of the calling sequence samples;

[0166] The node module 23 is used to convert the call sequence samples into a graph relationship and calculate the characteristic value of each system call node;

[0167] A clustering module 24, used to trigger clustering analysis of call sequence samples based on the characteristic value of each system call node to output a clustering result;

[0168] An intrusion module 25, used to define a system call sequence with intrusion behavior based on the screening of clustering results;

[0169] The detection module 26 is used to monitor the production environment in real time and perform real-time intrusion detection on the processes of containers in the production environment.

[0170] See also Fig. 9 , refer to the following Fig. 9 The electronic intelligent device 40 according to this embodiment of the present invention is described. Fig. 9 The electronic intelligent device 40 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0171] like Fig. 9 As shown, the electronic intelligent device 40 is in the form of a general computing intelligent device. The components of the electronic intelligent device 40 may include but are not limited to: at least one processing unit 41, at least one storage unit 42, and a bus 43 connecting different system components (including the storage unit 42 and the processing unit 41).

[0172] The storage unit stores program codes, which can be executed by the processing unit 41, so that the processing unit 41 executes the steps according to various exemplary embodiments of the present invention described in the above “Embodiment Method” section of this specification.

[0173] The storage unit 42 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 421 and / or a cache memory unit 422 , and may further include a read-only memory unit (ROM) 423 .

[0174] The storage unit 42 may also include a program / utility 424 having a set (at least one) of program modules 425, such program modules 425 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0175] Bus 43 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0176] The electronic smart device 40 may also communicate with one or more external smart devices (e.g., keyboards, pointing smart devices, Bluetooth smart devices, etc.), one or more smart devices that enable a user to interact with the electronic smart device 40, and / or any smart device that enables the electronic smart device 40 to communicate with one or more other computing smart devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 44. Furthermore, the electronic smart device 40 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 45. Fig. 9 As shown, the network adapter 45 communicates with other modules of the electronic intelligent device 40 via the bus 43. It should be understood that although Fig. 9 Not shown, other hardware and / or software modules may be used in conjunction with the electronic intelligent device 40, including but not limited to: microcode, intelligent device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup planning systems.

[0177] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing intelligent device (which can be a personal computer, a server, a terminal device, or a network intelligent device, etc.) to execute the method according to the implementation of the present disclosure.

[0178] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc. In addition, it stores computer program instructions, and when the computer program instructions are executed by a computer, the computer executes the above method.

[0179] In addition, the container intrusion detection method and system provided by the embodiments of the present invention are introduced in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A container intrusion detection method, characterized in that: Applied to container intrusion detection scenarios; The container intrusion detection method comprises: Traverse the container and collect call sequence samples; Forming training set data based on data preprocessing of the calling sequence samples; Convert the call sequence samples into graph relationships and calculate the feature value of each system call node; Triggering cluster analysis of call sequence samples based on the characteristic value of each system call node to output clustering results; Defining the system call sequence with intrusion behavior based on the screening of clustering results; Monitor the production environment in real time and perform real-time intrusion detection on container processes in the production environment; The method of defining a system call sequence with intrusion behavior based on the screening of clustering results includes: freezing clustering results and screening the clustering results; defining a sequence combination based on the screening of clustering results; associating the sequence combination with a corresponding detection learning model; the detection learning model is reciprocatedly trained based on training set data, and dynamically optimized based on model prediction results and true labels; a loss function is introduced into the detection learning model, and model parameters of the detection learning model are gradually optimized according to the loss function to improve the detection accuracy of the detection learning model; and a system call sequence with intrusion behavior is defined based on the sequence combination and the corresponding detection learning model; The converting of the call sequence samples into a graph relationship and calculating the characteristic value of each system call node includes: performing data detection on the container; defining a corresponding system call node based on the data detection of the container, where there are multiple system call nodes; associating multiple system call nodes and edges connecting two adjacent system call nodes, forming a corresponding graph relationship according to the conversion of the multiple system call nodes, the corresponding edges and the call sequence samples, so as to output a system call node graph; locating each system call node; Based on each system call node and system call node graph, Katz centrality, Betweenness centrality, Closeness centrality and Pagerank centrality are defined; Define Katz centrality, Betweenness centrality, Closeness centrality, and Pagerank centrality as the eigenvalues ​​of each system call node; The cluster analysis of the call sequence samples is triggered based on the characteristic value of each system call node to output the clustering results, including: Freeze the characteristic value of each system call node; Embedded control for each system call node; Aggregate information of multiple adjacent system call nodes and capture the complex dependencies and interaction features between system calls; Collecting feature values ​​and call sequence samples of each system call node; associating feature values ​​and call sequence samples of each system call node; triggering cluster analysis of the call sequence samples based on the feature value of each system call node and the call sequence samples to output clustering results; At this time, a graph convolutional neural network is selected to learn graph node features. The goal is to convert the n×d feature matrix extracted by the struc2vec method into a lower-dimensional l×m feature matrix, where l≤n and m≤d, for graph classification; In each layer l of a graph convolutional network (GCN), a node v∈V has a hidden vector Initial value of hidden vector Calculated by the struc2vec method; at each layer l, node v collects information from its neighboring nodes and calculates the hidden vector of node v as follows Where N(v) represents the neighbor nodes with which there is an edge with node v, and W represents the size d l-1 ×d l The weight matrix of l is the dimension of the hidden vector of the lth layer, σ represents the Sigmoid activation function used to activate neurons; in this way, the hidden vectors of all nodes in all layers are calculated; the hidden vector of the last layer k is the node embedding vector of node v, expressed as: The node embedding vectors of all nodes are added together to form the graph representation z G ; As shown in the following formula, where z v The node embedding vector representing the node v; 2. The container intrusion detection method according to claim 1, characterized in that: The traversing of the container and collecting call sequence samples include: Positioning container; Model and load of collection container; Define the corresponding traversal mode according to the container model and load; Traverse the container along the traversal mode; A data space is defined based on the traversal of the container, and call sequence samples are collected in the data space. At this time, the system call trace generated by the container process is intercepted on the host machine, and the corresponding numbering sequence is matched based on the call sequence samples.

3. The container intrusion detection method according to claim 2, characterized in that: The data preprocessing based on the calling sequence samples to form the training set data includes: Freeze call sequence sample; Divide multiple data combinations based on call sequence samples; Outputting a corresponding optimized data set based on data preprocessing of multiple data combinations; The data set after freeze-frame optimization; Corresponding training data is formed according to the optimized data set; and the corresponding detection learning model is trained based on the training data until the corresponding detection learning model is output.

4. The container intrusion detection method according to claim 1, characterized in that: The real-time monitoring of the production environment and the real-time intrusion detection of the container processes in the production environment include: Monitor the location of the production environment in real time; Locate the production environment based on its location and monitor it in real time; Define containers in the production environment based on the traversal of the production environment.

5. The container intrusion detection method according to claim 4, characterized in that: The real-time monitoring of the production environment and the real-time intrusion detection of the processes of the containers in the production environment also include: Collect the processes corresponding to the containers in the production environment; associate the processes with the detection learning model, and perform real-time intrusion detection on the processes; In real-time intrusion detection of a process, an anomaly set is defined based on the process and the detection learning model; Based on the screening of the anomaly set, the system call sequence with intrusion behavior is defined.

6. A container intrusion detection system, characterized in that: The container intrusion detection system is applied to the container intrusion detection method according to any one of claims 1 to 5, and the container intrusion detection system comprises: The collection module is used to traverse the container and collect call sequence samples; A training module, used for forming training set data based on data preprocessing of the calling sequence samples; The node module is used to convert the call sequence samples into graph relationships and calculate the feature value of each system call node; A clustering module, used to trigger clustering analysis of call sequence samples based on the characteristic value of each system call node to output clustering results; An intrusion module is used to define the system call sequence with intrusion behavior based on the screening of clustering results; The detection module is used to monitor the production environment in real time and perform real-time intrusion detection on the processes of containers in the production environment.

Images