Mirror image scanning method and device, equipment and storage medium

Abstract

The invention discloses a mirror image scanning method and device, equipment and a storage medium, and relates to the technical field of cloud native. The method comprises the following steps: creating a mirror image scanning task, and determining a file layer contained in a mirror image layer in a container mirror image file system based on the mirror image scanning task; constructing a two-stage cache system, and managing the file layer by using the two-stage cache system; the two-stage cache system comprises a first-stage cache constructed based on a preset key value storage system and a second-stage cache constructed based on a database system; and obtaining storage information corresponding to the file layer in the two-stage cache system, and performing risk matching operation on the mirror image layer according to the storage information to output a mirror image scanning result. According to the technical scheme, it can be guaranteed that each basic mirror image layer is only scanned once under parallel operation, and the mirror image scanning efficiency is optimized.

Description

Technical Field

[0001] The present invention relates to the field of cloud native technology, and in particular to an image scanning method, device, equipment and storage medium. Background Art

[0002] Containerization technology is one of the foundations of cloud-native architecture. In a cloud-native environment, the image repository in the cluster usually contains hundreds, thousands, or even tens of thousands of container images. To prevent potential security vulnerabilities in the image file system, container images need to be scanned regularly. Since the vulnerability database is updated frequently, usually once every less than 24 hours, the images in the image repository need to be scanned frequently. There are often a large number of identical base layers in the image. In order to improve the efficiency of image scanning, the usual practice is to store the results of image layer scanning in the cache (database). When scanning the image, first check the cache (database) to see if the layer currently being scanned has been scanned. If it has been scanned, take out the scan result from the cache (database); if it is not in the cache (database), perform the scan operation normally and add the result to the cache (database) to avoid scanning the same file layer multiple times. This solution can effectively improve the scanning efficiency when facing serial scanning, but it is not applicable in cloud-native scenarios. The cloud-native environment uses containerization and distributed architecture to enable applications to dynamically expand and elastically scale to cope with instantaneous high-concurrency requests. In cloud-native scenarios, the number of images in the image repository is large. If serial scanning is used, the scanning time will be too long. If parallel scanning is used, the base image layer may be scanned multiple times.

[0003] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an image scanning method, device, equipment and storage medium, which can make full use of the distributed task characteristics in the cloud native scenario, ensure that each image layer will only be scanned once in parallel operation, and achieve high concurrency and high efficiency image scanning. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a mirror scanning method, comprising:

[0006] Creating an image scanning task, and determining a file layer included in an image layer in a container image file system based on the image scanning task;

[0007] Constructing a two-level cache system and using the two-level cache system to manage the file layer; the two-level cache system includes a first-level cache constructed based on a preset key-value storage system and a second-level cache constructed based on a database system;

[0008] The storage information corresponding to the file layer in the two-level cache system is acquired, and a risk matching operation is performed on the image layer according to the storage information to output an image scanning result.

[0009] Optionally, when the two-level cache system is the first-level cache, managing the file layer by using the two-level cache system includes:

[0010] Acquire a first identifier for identifying the file layer, and determine a scanning state corresponding to the file layer according to the first identifier;

[0011] A first key-value pair is generated based on the first identifier and the scan status, and the first key-value pair is stored in the first-level cache; wherein the first identifier is used as the key in the first key-value pair, and the scan status is used as the value in the first key-value pair.

[0012] Optionally, when the two-level cache system is the secondary cache, managing the file layer by using the two-level cache system includes:

[0013] Acquire the first identifier, and determine a first scanning result corresponding to the file layer according to the first identifier;

[0014] A second key-value pair is generated based on the first identifier and the first scan result, and the second key-value pair is stored in the secondary cache; wherein the first identifier is used as the key in the second key-value pair, and the first scan result is used as the value in the second key-value pair.

[0015] Optionally, the acquiring storage information corresponding to the file layer in the two-level cache system includes:

[0016] Check whether there is data information corresponding to the current file layer in the first-level cache;

[0017] When data information corresponding to the current file layer exists in the first-level cache, determining that the scanning status corresponding to the current file layer is scanning completed;

[0018] When there is no data information corresponding to the current file layer in the first-level cache, the current file layer is scanned using a scanning load, and a second identifier of the current file layer is obtained, and then the second identifier is added to the first-level cache, and the scanning status corresponding to the current file layer is determined to be scanning.

[0019] Optionally, after determining that the scanning status corresponding to the current file layer is scanning completed, the method further includes:

[0020] storing a second scanning result obtained by scanning the current file layer into the secondary cache;

[0021] Correspondingly, after determining that the scanning state corresponding to the current file layer is scanning, the method further includes:

[0022] When the scanning load completes scanning the current file layer, the scanning status is modified from scanning in progress to scanning completed, and the second scanning result is stored in the secondary cache.

[0023] Optionally, performing a risk matching operation on the image layer according to the storage information to output an image scanning result includes:

[0024] When all the file layers are scanned, a third identifier associated with the current image layer is determined, and a corresponding third scanning result is obtained from the secondary cache according to the third identifier;

[0025] The third scanning result is matched with a preset risk database, and the image scanning result corresponding to the current image layer is determined according to the matching result.

[0026] Optionally, build a first-level cache based on a preset key-value storage system, including:

[0027] Build a first-level cache based on Redis;

[0028] Or, constructing the first-level cache based on an in-memory database;

[0029] Or, constructing the first-level cache based on a dictionary provided by a preset programming language;

[0030] Or, the first-level cache is constructed based on a map data structure.

[0031] In a second aspect, the present application discloses a mirror scanning device, comprising:

[0032] Scan task creation module, used to create image scanning tasks;

[0033] A file layer determination module, used to determine the file layers included in the image layer in the container image file system based on the image scanning task;

[0034] A cache system construction module, used to construct a two-level cache system and use the two-level cache system to manage the file layer; the two-level cache system includes a first-level cache constructed based on a preset key-value storage system and a second-level cache constructed based on a database system;

[0035] The scanning result output module is used to obtain the storage information corresponding to the file layer in the two-level cache system, and perform a risk matching operation on the image layer according to the storage information to output the image scanning result.

[0036] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the mirror scanning method as described above.

[0037] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the mirror scanning method as described above.

[0038] The present application provides an image scanning method, comprising: creating an image scanning task, and determining a file layer contained in an image layer in a container image file system based on the image scanning task; building a two-level cache system, and managing the file layer using the two-level cache system; the two-level cache system comprises a first-level cache built based on a preset key-value storage system, and a second-level cache built based on a database system; acquiring storage information corresponding to the file layer in the two-level cache system, and performing a risk matching operation on the image layer according to the storage information to output an image scanning result.

[0039] The beneficial technical effect of the present application is that the scanning object in the image scanning task is no longer the image, but the file layer in the image. The image scanning task is split into two subtasks: executing a single-layer scan for the file layer and executing risk matching. The distributed task characteristics in the cloud native scenario are fully utilized, and multiple workloads are called at the same time to perform scanning and risk matching operations to achieve high concurrency and high efficiency image scanning. When performing image scanning on the file layer, a two-level cache system is constructed, which not only retains the database system in the conventional scanning method as the second-level cache, but also adds a first-level cache built based on a preset key-value storage system. The risk matching operation on the image layer is further performed according to the storage information corresponding to the file layer in the two-level cache system. In this way, it can be ensured in the cloud native scenario that each image layer will only be scanned once under parallel operation, thereby optimizing the scanning efficiency.

[0040] In addition, the present application provides an image scanning device, equipment and storage medium, which correspond to the above-mentioned image scanning method and have the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0042] Figure 1 This is a flow chart of a mirror scanning method disclosed in this application;

[0043] Figure 2 A schematic diagram of a mirror file system disclosed in this application;

[0044] Figure 3 A schematic diagram of a risk matching load workflow disclosed in this application;

[0045] Figure 4 A schematic diagram of a task scheduler workflow 1 disclosed in this application;

[0046] Figure 5 A schematic diagram of a task scheduler workflow 2 disclosed in this application;

[0047] Figure 6 A schematic diagram of the working process of a scanning load disclosed in this application;

[0048] Figure 7 A schematic diagram of a specific mirror scanning workflow disclosed in this application;

[0049] Figure 8 This is a schematic diagram of the structure of a mirror scanning device disclosed in this application;

[0050] Fig. 9 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The current image scanning method can effectively improve the scanning efficiency when facing serial scanning, but it is not applicable in cloud-native scenarios. The cloud-native environment uses containerization and distributed architecture to enable applications to dynamically expand and elastically scale to cope with instantaneous high-concurrency requests. In addition, in cloud-native scenarios, the number of images in the image repository is large. If serial scanning is used, the scanning time will be too long. When using parallel scanning, the base image layer may be scanned multiple times. Therefore, traditional cache design is difficult to cope with the high concurrency requirements in cloud-native scenarios, which may cause some image layers to be scanned repeatedly, seriously affecting the overall scanning efficiency.

[0053] To this end, the present application provides an image scanning solution that can fully utilize the distributed task characteristics in cloud native scenarios, ensuring that each image layer will only be scanned once under parallel operation, thereby achieving high concurrency and high-efficiency image scanning.

[0054] The embodiment of the present invention discloses a mirror scanning method, see Figure 1 As shown, the method includes:

[0055] Step S11: creating an image scanning task, and determining the file layers included in the image layer in the container image file system based on the image scanning task.

[0056] It is understandable that the container image file system is stored in layers, such as Figure 2 As shown in the figure, image 1 has three layers, A, B, and C; while image 2 has four layers, A, B, C, and D; image 2 is based on image 1 with one layer D added. To improve scanning efficiency, a cache mechanism is introduced to store the scanned image layers. For example, for Figure 2 Mirror 1 and Mirror 2: When scanning Mirror 1, there is no data in file layers A, B, and C in cache DB (Data base, database system), so file layers A, B, and C will be scanned by the scanner; when scanning Mirror 2, the data of file layers A, B, and C already exist in cache DB, so the results are directly taken out of cache DB, and the scanner is used to scan file layer D to get the scanning result of Mirror 2. It can be seen that conventional image scanning can effectively achieve the goal of using cache to optimize scanning efficiency when scanning multiple images serially through a layer of cache. However, it is not suitable for the need to scan multiple images in parallel in cloud native scenarios, and there is a situation where a file layer is scanned multiple times. Similarly, Figure 2 For example, in a parallel scanning scenario, mirror 1 and mirror 2 are scanned at the same time. At this time, there is no data in the file layers A, B, and C in the cache (database). These three layers will be scanned twice respectively, resulting in low efficiency.

[0057] In view of the fact that there is a real need to perform security scans on a large number of images in the image warehouse in the cloud native scenario, in order to be applicable to the cloud native scenario, in the embodiment of the present application, the scanning object during image scanning is no longer the image, but the file layer. First, the image scanning task is created using the task scheduler, and the image layer is analyzed based on the image scanning task to determine which file layers the image layer has.

[0058] Step S12: construct a two-level cache system, and use the two-level cache system to manage the file layer; the two-level cache system includes a first-level cache constructed based on a preset key-value storage system, and a second-level cache constructed based on a database system.

[0059] In the embodiment of the present application, a two-level cache system is designed, which is a first-level cache built based on a preset key-value storage system and a second-level cache built based on a database system. Among them, the second-level cache is a cache DB in the conventional scanning method that is retained to optimize the scanning efficiency; the first-level cache is built based on a preset key-value storage system, wherein the preset key-value storage system is a storage solution with fast and lightweight characteristics. Including but not limited to Redis, a memory-based database system (Main Memory Database, MMDB), a dictionary that comes with a programming language, a map data structure (Map DataStructure), etc.

[0060] Specifically, building a first-level cache based on a preset key-value storage system includes: building a first-level cache based on Redis; or, building the first-level cache based on an in-memory database; or, building the first-level cache based on a dictionary that comes with a preset programming language; or, building the first-level cache based on a map data structure.

[0061] In a specific implementation, a key-value pair is used for storage of the first-level cache, wherein the stored content is: the key stores the layer ID of the file layer, which is used to identify the unique identifier of the file layer; the value stores the scanning status of the corresponding file layer, including two states: scanning in progress and scanning completed.

[0062] Specifically, when the two-level cache system is the first-level cache, the process of managing the file layer using the two-level cache system includes: obtaining a first identifier for identifying the file layer, and determining a scanning status corresponding to the file layer based on the first identifier; generating a first key-value pair based on the first identifier and the scanning status, and storing the first key-value pair to the first-level cache; wherein the first identifier is used as the key in the first key-value pair, and the scanning status is used as the value in the first key-value pair.

[0063] In another specific implementation, the secondary cache is also stored using key-value pairs, wherein the stored content is: the key stores the layer ID of the file layer, which is used to identify the unique identifier of the file layer; and the value stores the scanning result of the corresponding file layer.

[0064] Specifically, when the two-level cache system is the secondary cache, the process of managing the file layer using the two-level cache system includes: obtaining the first identifier, and determining the first scanning result corresponding to the file layer based on the first identifier; generating a second key-value pair based on the first identifier and the first scanning result, and storing the second key-value pair to the secondary cache; wherein the first identifier is used as the key in the second key-value pair, and the first scanning result is used as the value in the second key-value pair.

[0065] Step S13: acquiring storage information corresponding to the file layer in the two-level cache system, and performing a risk matching operation on the image layer according to the storage information to output an image scanning result.

[0066] It can be understood that since the first-level cache stores the identifier information of the file layer and the corresponding file layer status, when scanning the image according to the image scanning task, obtaining the storage information corresponding to the file layer in the first-level cache system is to check the file layer status corresponding to the file layer in the first-level cache according to the layer ID of the file layer to see which file layers are being scanned or the scanning has been completed.

[0067] Similarly, since the secondary cache stores the identifier information of the file layer and the scanning results of the corresponding file layer, when scanning the image according to the image scanning task, obtaining the storage information corresponding to the file layer in the secondary cache system is to obtain the corresponding scanning results from the secondary cache DB according to the layer ID of the file layer.

[0068] Furthermore, if the status of all file layers in the first-level cache is that the scan is completed, it means that all file layers of the image have been scanned. At this time, the risk matching workload can be pulled up through the task scheduler to perform the risk matching operation.

[0069] Specifically, after all the file layers are scanned, the third identifier associated with the current image layer is determined, and the corresponding third scanning result is obtained from the secondary cache according to the third identifier; the third scanning result is matched with the preset risk database, and the image scanning result corresponding to the current image layer is determined according to the matching result.

[0070] In an embodiment of the present application, after all file layers are scanned, when you want to obtain the image scanning result of the current image layer, obtain the scanning results of all file layers contained in the image layer from the secondary cache DB according to the layer ID of the file layer, merge and match the preset risk database, and finally output the corresponding image scanning result.

[0071] like Figure 3 The following is a schematic diagram of a risk matching load workflow provided as an example in an embodiment of the present application. The main work contents of the risk matching load are:

[0072] 1. The risk matching load is pulled up by the task scheduler to perform risk matching and output the image scanning results;

[0073] 2. The input of the risk matching load is the layer information of the image, that is, the layer ID of the file layer;

[0074] 3. The output of the risk matching workload is the image scan result;

[0075] 4. The risk matching load will obtain the scan results of all file layers corresponding to the current image layer from the secondary cache DB according to the file layer layer ID input by the task scheduler, merge them, match the risk database, and finally output the scan results of the image.

[0076] The present application provides an image scanning method, comprising: creating an image scanning task, and determining a file layer contained in an image layer in a container image file system based on the image scanning task; building a two-level cache system, and managing the file layer using the two-level cache system; the two-level cache system comprises a first-level cache built based on a preset key-value storage system, and a second-level cache built based on a database system; acquiring storage information corresponding to the file layer in the two-level cache system, and performing a risk matching operation on the image layer according to the storage information to output an image scanning result.

[0077] The beneficial technical effect of the present application is that the scanning object in the image scanning task is no longer the image, but the file layer in the image. The image scanning task is split into two subtasks: executing a single-layer scan for the file layer and executing risk matching. The distributed task characteristics in the cloud native scenario are fully utilized, and multiple workloads are called at the same time to perform scanning and risk matching operations to achieve high concurrency and high efficiency image scanning. When performing image scanning on the file layer, a two-level cache system is constructed, which not only retains the database system in the conventional scanning method as the second-level cache, but also adds a first-level cache built based on a preset key-value storage system. The risk matching operation on the image layer is further performed according to the storage information corresponding to the file layer in the two-level cache system. In this way, it can be ensured in the cloud native scenario that each image layer will only be scanned once under parallel operation, thereby optimizing the scanning efficiency.

[0078] Based on the above embodiment, this embodiment will specifically explain S13 in the above embodiment. The process of obtaining the storage information corresponding to the file layer in the two-level cache system may include the following steps:

[0079] Check whether there is data information corresponding to the current file layer in the first-level cache;

[0080] When data information corresponding to the current file layer exists in the first-level cache, determining that the scanning status corresponding to the current file layer is scanning completed;

[0081] When there is no data information corresponding to the current file layer in the first-level cache, the current file layer is scanned using a scanning load, and a second identifier of the current file layer is obtained, and then the second identifier is added to the first-level cache, and the scanning status corresponding to the current file layer is determined to be scanning.

[0082] In the embodiment of the present application, the storage information in the first-level cache can be checked by the task scheduler. When checking the current file layer, if there is data information corresponding to the current file layer in the first-level cache, it means that the current file layer has been scanned, and its corresponding scanning status is scanning completed; for the file layer without data in the first-level cache, it will be assigned to the scanning load for scanning, and the layer ID of the file layer will be added to the first-level cache, and the status is scanning.

[0083] It should be noted that the scanning load is pulled up by the task scheduler to perform scanning operations on a single file layer. The scanning results of the file layer whose scanning status is Scanning Completed will be stored in the L2 cache. If the scanning status is Scanning, after the scanning load is executed, the status of the scanned file layer will be changed from Scanning to Scanned Completed in the L1 cache, and then the scanning results will be stored in the L2 cache.

[0084] Specifically, after determining that the scanning status corresponding to the current file layer is that the scanning is completed, it also includes: storing the second scanning result obtained by scanning the current file layer in the secondary cache; correspondingly, after determining that the scanning status corresponding to the current file layer is scanning in progress, it also includes: when the scanning load completes scanning the current file layer, modifying the scanning status from scanning in progress to scanning completed, and storing the second scanning result in the secondary cache.

[0085] like Figure 4 , Figure 5 The following are schematic diagrams of the working process of the task scheduler provided in this embodiment, wherein the first-level cache is cache Redis as an example for explanation.

[0086] The main tasks of the task scheduler are:

[0087] 1. Create an image scanning task to analyze the file layers of the image;

[0088] 2. According to the layer ID of the file layer, check which file layers in the first-level cache Redis are being scanned or have been scanned;

[0089] 3. Assign the file layer without data in the first-level cache Redis to the scanning load for scanning, and add the layer ID of the file layer to the first-level cache Redis, with the status of "Scanning";

[0090] 4. Monitor the image scanning task and check in the primary cache Redis whether all the file layers of the image have been scanned, that is, whether the status corresponding to the layer ID of all file layers has been scanned. After all scans are completed, pull up the risk matching workload and perform the risk matching operation.

[0091] like Figure 6 The figure shows a schematic diagram of the working process of the scanning load provided in this embodiment. The main working contents of the scanning load are:

[0092] 1. The scanning load is pulled up by the task scheduler to perform scanning operations on a single file layer;

[0093] 2. The input of the scanning workload is the file layer, which is provided by the task scheduler;

[0094] 3. The output of the scan load is the scan result of the input;

[0095] 4. After the scan load is executed, the status of the scanned file layer will be changed from scanning to scanning completed in the first-level cache Redis;

[0096] 5. After the scan load is executed, the scan results will be stored in the secondary cache DB.

[0097] It can be seen that in this embodiment, firstly, it is determined whether to pull up the risk matching workload according to the storage information in the first-level cache, and the risk matching operation is performed; then, the scanning results of all file layers contained in the current image layer are output according to the storage information in the second-level cache, and the risk database is matched after merging, and finally the image scanning results are output. In this way, the distributed task characteristics in the cloud native scenario are utilized, and the image scanning task is split into two subtasks, the scanning load and the risk matching load, through the task scheduler, to achieve high concurrency and high efficiency image scanning; and cache Redis is introduced on the basis of the original cache DB to form a two-level cache system, which ensures that each image layer will only be scanned once under parallel operation, optimizing the parallel scanning efficiency.

[0098] Further, such as Figure 7 The figure shows a flow chart of an overall implementation of the image scanning task provided in combination with the content disclosed in the above embodiments. The components include: task scheduler, scanning load, risk matching load, secondary cache (database DB), primary cache (Redis); in terms of cache, a Redis-based cache is added to the original database cache.

[0099] First, the task scheduler analyzes the file layers of the image according to the image scanning task, checks the storage information in the first-level cache, and obtains the scanning status of the file layer. For the file layer without data in the first-level cache, it is assigned to the scanning load for scanning, and the layer ID of the file layer is added to the first-level cache Redis, and the status is scanning. The scanning results of the corresponding file layers with the scanning status of completed will be stored in the second-level cache. When all file layers are scanned, the risk matching workload is pulled up, the risk matching operation is performed, and the scanning results of the image are finally output.

[0100] Correspondingly, the embodiment of the present application also discloses a mirror scanning device, see Figure 8 As shown, the device comprises:

[0101] A scanning task creation module 11 is used to create an image scanning task;

[0102] A file layer determination module 12, used to determine the file layers included in the image layer in the container image file system based on the image scanning task;

[0103] A cache system construction module 13 is used to construct a two-level cache system and use the two-level cache system to manage the file layer; the two-level cache system includes a first-level cache constructed based on a preset key-value storage system and a second-level cache constructed based on a database system;

[0104] The scanning result output module 14 is used to obtain storage information corresponding to the file layer in the two-level cache system, and perform a risk matching operation on the image layer according to the storage information to output an image scanning result.

[0105] Among them, for more specific working processes of the above-mentioned modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0106] It can be seen that the above scheme of this embodiment includes: creating an image scanning task, and determining the file layer contained in the image layer in the container image file system based on the image scanning task; building a two-level cache system, and using the two-level cache system to manage the file layer; the two-level cache system includes a first-level cache built based on a preset key-value storage system, and a second-level cache built based on a database system; obtaining storage information corresponding to the file layer in the two-level cache system, and performing a risk matching operation on the image layer according to the storage information to output the image scanning result.

[0107] The beneficial technical effect of the present application is that the scanning object in the image scanning task is no longer the image, but the file layer in the image. The image scanning task is split into two subtasks: executing a single-layer scan for the file layer and executing risk matching. The distributed task characteristics in the cloud native scenario are fully utilized, and multiple workloads are called at the same time to perform scanning and risk matching operations to achieve high concurrency and high efficiency image scanning. When performing image scanning on the file layer, a two-level cache system is constructed, which not only retains the database system in the conventional scanning method as the second-level cache, but also adds a first-level cache built based on a preset key-value storage system. The risk matching operation on the image layer is further performed according to the storage information corresponding to the file layer in the two-level cache system. In this way, it can be ensured in the cloud native scenario that each image layer will only be scanned once under parallel operation, thereby optimizing the scanning efficiency.

[0108] Furthermore, the present application also discloses an electronic device. Fig. 9 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the diagram cannot be considered as any limitation on the scope of use of the present application.

[0109] Fig. 9A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the image scanning method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be a server.

[0110] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0111] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222 and data 223, etc. The data 223 may include various data. The storage method may be temporary storage or permanent storage.

[0112] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the image scanning method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0113] Furthermore, the embodiment of the present application also discloses a computer-readable storage medium, wherein the computer-readable storage medium mentioned here includes a random access memory (Random Access Memory, RAM), a memory, a read-only memory (Read-Only Memory, ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a magnetic disk or an optical disk, or any other form of storage medium known in the technical field. Wherein, when the computer program is executed by the processor, the aforementioned mirror scanning method is implemented. For the specific steps of the method, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0114] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0115] The steps of the image scanning method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0116] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0117] The above is a detailed introduction to the image scanning method, device, equipment and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A mirror scanning method, characterized in that: include: Creating an image scanning task, and determining a file layer included in an image layer in a container image file system based on the image scanning task; Constructing a two-level cache system and using the two-level cache system to manage the file layer; the two-level cache system includes a first-level cache constructed based on a preset key-value storage system and a second-level cache constructed based on a database system; The storage information corresponding to the file layer in the two-level cache system is acquired, and a risk matching operation is performed on the image layer according to the storage information to output an image scanning result.

2. The mirror scanning method according to claim 1, characterized in that: When the two-level cache system is the first-level cache, managing the file layer by using the two-level cache system includes: Acquire a first identifier for identifying the file layer, and determine a scanning state corresponding to the file layer according to the first identifier; A first key-value pair is generated based on the first identifier and the scan status, and the first key-value pair is stored in the first-level cache; wherein the first identifier is used as the key in the first key-value pair, and the scan status is used as the value in the first key-value pair.

3. The mirror scanning method according to claim 2, characterized in that: When the two-level cache system is the secondary cache, managing the file layer by using the two-level cache system includes: Acquire the first identifier, and determine a first scanning result corresponding to the file layer according to the first identifier; A second key-value pair is generated based on the first identifier and the first scan result, and the second key-value pair is stored in the secondary cache; wherein the first identifier is used as the key in the second key-value pair, and the first scan result is used as the value in the second key-value pair.

4. The mirror scanning method according to claim 2, characterized in that: The acquiring storage information corresponding to the file layer in the two-level cache system includes: Check whether there is data information corresponding to the current file layer in the first-level cache; When data information corresponding to the current file layer exists in the first-level cache, determining that the scanning status corresponding to the current file layer is scanning completed; When there is no data information corresponding to the current file layer in the first-level cache, the current file layer is scanned using a scanning load, and a second identifier of the current file layer is obtained, and then the second identifier is added to the first-level cache, and the scanning status corresponding to the current file layer is determined to be scanning.

5. The mirror scanning method according to claim 4, characterized in that: After determining that the scanning status corresponding to the current file layer is that scanning is completed, the method further includes: storing a second scanning result obtained by scanning the current file layer into the secondary cache; Correspondingly, after determining that the scanning state corresponding to the current file layer is scanning, the method further includes: When the scanning load completes scanning the current file layer, the scanning status is modified from scanning in progress to scanning completed, and the second scanning result is stored in the secondary cache.

6. The mirror scanning method according to claim 5, characterized in that: The performing a risk matching operation on the image layer according to the storage information to output an image scanning result includes: When all the file layers are scanned, a third identifier associated with the current image layer is determined, and a corresponding third scanning result is obtained from the secondary cache according to the third identifier; The third scanning result is matched with a preset risk database, and the image scanning result corresponding to the current image layer is determined according to the matching result.

7. The mirror scanning method according to any one of claims 1 to 6, characterized in that: Build a first-level cache based on a preset key-value storage system, including: Build a first-level cache based on Redis; Or, constructing the first-level cache based on an in-memory database; Or, constructing the first-level cache based on a dictionary provided by a preset programming language; Or, the first-level cache is constructed based on a map data structure.

8. A mirror scanning device, characterized in that: include: Scan task creation module, used to create image scanning tasks; A file layer determination module, used to determine the file layers included in the image layer in the container image file system based on the image scanning task; A cache system construction module, used to construct a two-level cache system and use the two-level cache system to manage the file layer; the two-level cache system includes a first-level cache constructed based on a preset key-value storage system and a second-level cache constructed based on a database system; The scanning result output module is used to obtain the storage information corresponding to the file layer in the two-level cache system, and perform a risk matching operation on the image layer according to the storage information to output the image scanning result.

9. An electronic device, characterized in that: The electronic device comprises a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the mirror scanning method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein when the computer program is executed by a processor, the mirror scanning method according to any one of claims 1 to 7 is implemented.

Images