Threat surface evaluation system oriented to Docker container and computer readable storage medium

Abstract

The invention provides a threat surface evaluation system for a Docker container. The threat surface evaluation system for the Docker container comprises a virus detection unit, a WebShell detection unit, an anti-Shell detection unit, a brute force cracking detection unit, an abnormal command detection unit, an authority escape detection unit, a port forwarding detection unit, a remote command execution detection unit, an access malicious address detection unit, a voucher stealing unit and a transverse movement detection unit. The threat surface evaluation system for the Docker container is used for improving reliability indexes such as system average power failure time, system average power failure frequency and insufficient power supply quantity, the proposed method is a method based on integer linear programming, and the threat surface evaluation system has the advantages of being short in solving time, capable of finding a globally optimal solution and the like.

Description

Technical Field

[0001] The present invention relates to the field of comprehensive assessment of power grids, and in particular to a threat surface assessment system for Docker containers. Background Art

[0002] In the traditional power industry, various software and applications are usually deployed and run in the form of physical servers and virtual machines. However, in the scenario of smart grid, the traditional deployment method seems too heavy and complicated. Docker technology provides a lighter containerization solution that can meet the requirements of rapid deployment, reusability and elastic expansion in smart grid. Docker technology can package applications into an independent container to achieve isolation from the system environment and avoid conflicts between applications. At the same time, Docker containers are lightweight and quickly start and stop, which can achieve rapid deployment and application upgrades, and improve the flexibility and maintainability of smart grid systems. Docker technology provides security mechanisms such as strict access control, resource isolation and container image signature verification, which enhances the security of smart grid systems. Containers are the next generation of virtualization technology, but containers themselves are very lacking in security. Container security is used for overall security protection of the entire process of container creation, deployment and operation, so that containers and applications running on containers can run normally. The threat surface assessment of containers is mainly used to discover security risks in the container environment, avoid the online operation of risky containers, and continuously discover and prevent attacks during the operation of containers. Summary of the invention

[0003] The purpose of the present invention is to address the deficiencies of the above-mentioned prior art and provide a threat surface assessment system for Docker containers.

[0004] The technical solution provided by the present invention is: a threat surface assessment system for Docker containers, comprising:

[0005] The virus detection unit is used to learn sample data, extract high-dimensional features, and respond to more threats;

[0006] WebShell detection unit, combining syntax analysis and AI detection technology to determine whether the sample has malicious behavior from the perspective of script static analysis;

[0007] The anti-shell detection unit is used to improve the threshold of actual attack and defense technology. It completely covers most of the attack interfaces in actual attack and defense in container scenarios through behavioral event detection, and broadens the execution flow and data flow associations between behavioral events.

[0008] Brute force detection unit, used to monitor login behavior in real time and promptly detect hackers who use different services to try to brute force the user's login password;

[0009] An abnormal command detection unit, used to detect unusual commands executed on the container;

[0010] The permission escape detection unit is used to detect hackers' behavior of using vulnerabilities or improper configuration on the host to elevate their own process permissions;

[0011] Port forwarding detection unit, used to detect hackers using ssh and iptable to transfer ports;

[0012] Remote command execution detection unit, which is used to detect WebRCE attack threats by collecting file, network, and process system behavior information on the container host platform and detecting deep correlations such as data flows and execution flows among multiple behavior events;

[0013] Access malicious address detection unit, which is used to detect and monitor network requests on containers;

[0014] Credential theft unit, used to monitor stolen accounts, access to / etc / passwd, access to sensitive configurations, and hashing behavior;

[0015] The lateral movement detection unit is used to detect whether there is lateral movement behavior by monitoring the network connection, process execution, and multiple weak behavior associations of the container.

[0016] Preferably, the specific process of the virus detection unit is: virus detection based on AI technology, using deep learning technology, learning through massive sample data, and extracting high-dimensional features, so that the virus detection unit has generalization capabilities, thereby responding to more unknown threats, and the number of these high-dimensional features is extremely small, and will not grow synchronously with the number of viruses.

[0017] Further preferably, the virus detection unit utilizes a file reputation detection engine, a gene feature detection engine, a behavior engine, and a cloud search engine to filter through layers to make the detection more accurate, more efficient, and with lower member occupancy consumption.

[0018] Further preferably, the WebShell detection unit specifically includes the following steps:

[0019] 1) Syntax analysis: Analyze the text through the concat() function of the String class to obtain grammatical features and other features, and then fuse the grammatical features and other features;

[0020] 2) AI detection: AI detection is performed on the above fused features to classify data samples into different categories according to script type, score, black and white, and evidence information to determine whether the samples have malicious behavior;

[0021] Further preferably, the rebound shell detection unit introduces inter-process fd pipe chain association detection, and identifies the rebound shell attack technique from a deeper essential level by identifying the inter-process fdpipe chain data constituting a specific src / sink flow anomaly.

[0022] Further preferably, the rebound shell detection unit introduces real-time memory feature detection technology, which can accurately identify the rebound shell shellcode and Payload features of the memory injection class, thereby completing the rebound shell threat map detection technology.

[0023] Further preferably, the permission escape detection unit supports four types of privilege escalation detection capabilities: privilege escalation by exploiting sudo and su vulnerabilities, privilege escalation by exploiting improperly configured suid programs, privilege escalation by exploiting improper configuration, and privilege escalation by exploiting system kernel vulnerabilities; it also supports multiple methods of detection, including misconfiguration (privileged container, Linux Capabilities escape, misconfiguration), incorrect mounting (Docker.sock, Procfs, host directory), mounting sensitive directories, modifying namespaces, and adding user permissions through K8s Rolebinding.

[0024] Further preferably, the remote command execution detection unit provides, for each WebRCE alarm, a process tree, process command line parameters, victim container WebRCE threat, and context key information when the threat occurs, supports causal evidence, and highlights the basis for behavior rule determination.

[0025] A computer storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the system according to any one of claims 1 to 8 is implemented.

[0026] The cloud model evaluation method adopted in the present invention takes into account both the good expression of normal cloud uncertainty information and the stability and rationality after multivariate information fusion, reduces the randomness and uncertainty of the cloud model, reflects the real situation of the new distribution network and reveals its weak links.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] The detection engine based on AI technology uses deep learning technology to learn from massive sample data and extract high-dimensional features. It has strong generalization capabilities and can thus cope with more unknown threats.

[0029] WebShell is to determine whether the sample has malicious behavior from the perspective of static analysis of script files. Technically, it combines syntax analysis, AI detection and other technologies to effectively solve various WebShell deformation and bypass. It has the characteristics of strong detection ability and low false positives.

[0030] Anti-Shell can accurately identify the rebound shell shellcode and Payload features of memory injection, thereby completing the rebound shell threat map detection technology stack.

[0031] WebRCE detection covers dozens of common application services such as databases, Web applications, office automation, etc. in attack interfaces during actual offensive and defensive operations. It targets more than a dozen ATT&CK attack methods such as common coding obfuscation, malicious downloads, file behaviors, information collection, network outbound connections, script execution, and system persistence. It supports common behavior countermeasures and bypasses, and has broad-spectrum and generalized detection capabilities.

[0032] After data integration, preprocessing and regularized storage, it is identified by the filtering engine, analysis engine and verification engine to produce tactical intelligence and event intelligence such as C2 domain names, malicious link URLs, attacker IPs, etc., and given rich contextual information. It provides security detection and defense capabilities for various security scenarios such as vulnerability exploits, virus downloads, and C2 external connections. It also provides information query services for domain names, IPs, URLs, and files through the security wiki, helping users to conduct closed-loop operations of threat evidence, disposal, and detection, and completely eliminate known and unknown threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flow chart of a virus detection unit in a threat surface assessment system for Docker containers provided by the present invention;

[0034] Figure 2 A flowchart of a WeShell detection unit in a threat surface assessment system for Docker containers provided by the present invention;

[0035] Figure 3 This is a flow chart of a rebound shell detection unit in a threat surface assessment system for Docker containers provided by the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0037] Example

[0038] The threat surface assessment system for Docker containers specifically includes:

[0039] The virus detection unit is used to learn sample data, extract high-dimensional features, and respond to more threats. Traditional virus detection technology uses feature matching, but feature matching has no generalization ability or the generalization ability is relatively weak. When the virus undergoes a simple mutation, new feature rules must be added. Therefore, as the number of viruses increases, the virus feature library also increases, and the resources occupied by the operation also increase. The detection engine based on AI technology uses deep learning technology to learn from massive sample data and extract high-dimensional features. It has strong generalization ability, so it can respond to more unknown threats. The number of these high-dimensional features is extremely small and will not grow synchronously with the number of viruses. The docker container threat surface detection method constructs a multi-dimensional, lightweight funnel-type detection framework, including file reputation detection engine, gene feature detection engine, behavior engine, cloud check engine, etc. Through layer-by-layer filtering, detection is more accurate and efficient, and resource consumption is lower.

[0040] The WebShell detection unit combines syntax analysis and AI detection technology to determine whether a sample has malicious behavior from the perspective of script static analysis, which can effectively solve various WebShell deformations and bypasses. It has the characteristics of strong detection ability and low false positives.

[0041] Anti-Shell Detection Unit: When hackers obtain arbitrary code execution permissions on the victim server, the next step is to use the control end to listen on a TCP / UDP port. The controlled end initiates a request to the port and transfers the input and output of its command line to the control end to obtain an interactive shell. By using the role reversal of the client and server in the network concept, the hackers can solve the problems of firewall restrictions, insufficient permissions, and port occupation that affect attacks in actual attack and defense, thereby better controlling the victim server.

[0042] The anti-shell detection unit is used to improve the technical threshold for actual attack and defense. It completely covers the vast majority of attack interfaces in actual attack and defense in container scenarios through behavioral event detection, and broadens and generalizes the execution flow and data flow associations between behavioral events. It has accumulated a lot of experience in attack and defense confrontation techniques for each type of basic rebound technique, effectively improving the technical threshold for actual attack and defense.

[0043] Brute force detection unit, used to monitor login behavior in real time and promptly detect hackers who use different services to try to brute force the user's login password;

[0044] An abnormal command detection unit, used to detect unusual commands executed on the container;

[0045] The privilege escape detection unit is used to detect hackers who use vulnerabilities or improper configuration on the host to elevate their own process privileges. It supports four types of privilege escalation detection capabilities: privilege escalation using sudo and su vulnerabilities; privilege escalation using improperly configured suid programs; privilege escalation using improper configuration; privilege escalation using system kernel vulnerabilities. It can cover most privilege escalation detection methods on Linux.

[0046] For escape, it not only supports vulnerability privilege escalation escape detection, but also supports misconfiguration (privileged container, LinuxCapabilities escape, misconfiguration, etc.), incorrect mounting (Docker.sock, Procfs, host directory, etc.), mounting sensitive directories, modifying namespaces, K8s Rolebinding to add user permissions and other methods for coordinated detection.

[0047] Port forwarding detection unit, used to detect hackers using ssh and iptable to transfer ports;

[0048] The remote command execution detection unit is used to discover WebRCE attack threats by collecting file, network, and process system behavior information on the container host platform and detecting deep associations such as data flows and execution flows among multiple behavioral events. It targets more than a dozen types of ATT&CK attack techniques, such as common coding obfuscation, malicious downloads, file behaviors, information collection, network outbound connections, script execution, and system residency. It supports common behavior countermeasures and bypasses, and has broad-spectrum and generalized detection capabilities.

[0049] The access malicious address detection unit is used to detect and monitor network requests on the container. Remote control Trojans will transmit network information with servers controlled by hackers. Through big data and its own threat intelligence system, malicious IPs and domain names can be accurately identified.

[0050] Credential theft unit, used to monitor stolen accounts, access to / etc / passwd, access to sensitive configurations, and hashing behavior;

[0051] The lateral movement detection unit is used to detect whether there is lateral movement behavior by monitoring the network connection, process execution, and multiple weak behavior associations of the container.

[0052] The present invention also provides a computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

[0053] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the claims.

[0054] It should be understood that the present invention is not limited to the precise construction shown in the above description and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A threat surface assessment system for Docker containers, characterized in that: include: The virus detection unit is used to learn sample data, extract high-dimensional features, and respond to more threats; WebShell detection unit, combining syntax analysis and AI detection technology to determine whether the sample has malicious behavior from the perspective of script static analysis; The anti-shell detection unit is used to improve the threshold of actual attack and defense technology. It completely covers most of the attack interfaces in actual attack and defense in container scenarios through behavioral event detection, and broadens the execution flow and data flow associations between behavioral events. Brute force cracking detection unit, used to monitor login behavior in real time and promptly detect hackers who use different services to try to crack user login passwords by brute force; An abnormal command detection unit, used to detect unusual commands executed on the container; The permission escape detection unit is used to detect hackers' behavior of using vulnerabilities or improper configuration on the host to elevate their own process permissions; Port forwarding detection unit, used to detect hackers using ssh and iptable to transfer ports; Remote command execution detection unit, which is used to detect WebRCE attack threats by collecting file, network, and process system behavior information on the container host platform and detecting deep correlations such as data flows and execution flows among multiple behavior events; Access malicious address detection unit, which is used to detect and monitor network requests on containers; Credential theft unit, used to monitor stolen accounts, access to / etc / passwd, access to sensitive configurations, and hashing behavior; The lateral movement detection unit is used to detect whether there is lateral movement behavior by monitoring the network connection, process execution, and multiple weak behavior associations of the container.

2. A threat surface assessment system for Docker containers according to claim 1, characterized in that: The specific process of the virus detection unit is: virus detection based on AI technology, using deep learning technology, learning through massive sample data, and extracting high-dimensional features, so that the virus detection unit has generalization capabilities, thereby responding to more unknown threats, and the number of these high-dimensional features is extremely small, and will not grow synchronously with the number of viruses.

3. A threat surface assessment system for Docker containers according to claim 1, characterized in that: The virus detection unit utilizes a file reputation detection engine, a gene feature detection engine, a behavior engine, and a cloud search engine to filter through layers, making detection more accurate, more efficient, and requiring less team member consumption.

4. A threat surface assessment system for Docker containers according to claim 1, characterized in that: The WebShell detection unit specifically includes the following steps: 1) Syntax analysis: Analyze the text through the concat() function of the String class to obtain grammatical features and other features, and then fuse the grammatical features and other features; 2) AI detection: The above fused features are subjected to AI detection, and the data samples are divided into different categories according to script type, score, black and white, and evidence information to determine whether the samples have malicious behavior.

5. A threat surface assessment system for Docker containers according to claim 1, characterized in that: The rebound shell detection unit introduces inter-process fd pipe chain association detection, and identifies the rebound shell attack method from a deeper essential level by identifying the specific src / sink flow anomaly formed by the inter-process fdpipe chain data.

6. A threat surface assessment system for Docker containers according to claim 1, characterized in that: The rebound shell detection unit introduces real-time memory feature detection technology, which can accurately identify the rebound shell shellcode and Payload features of the memory injection class, thereby completing the rebound shell threat map detection technology.

7. A threat surface assessment system for Docker containers according to claim 1, characterized in that: The permission escape detection unit supports four types of privilege escalation detection capabilities: privilege escalation by exploiting sudo and su vulnerabilities, privilege escalation by exploiting improperly configured suid programs, privilege escalation by exploiting improper configuration, and privilege escalation by exploiting system kernel vulnerabilities; it also supports multiple methods of detection, including misconfiguration (privileged container, Linux Capabilities escape, misconfiguration), incorrect mounting (Docker.sock, Procfs, host directory), mounting sensitive directories, modifying namespaces, and adding user permissions through K8s Rolebinding.

8. A threat surface assessment system for Docker containers according to claim 1, characterized in that: The remote command execution detection unit provides, for each WebRCE alarm, the process tree, process command line parameters, victim container WebRCE threat, and context key information when the threat occurs, supports causal evidence, and highlights the basis for behavior rule determination.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the system according to any one of claims 1 to 8 is implemented.

Images