Method for detecting escape risk of container in cloud-edge collaborative environment and related equipment

Abstract

The invention provides a method for detecting the escape risk of a container in a cloud edge collaborative environment and related equipment, and belongs to the field of network security, and the method comprises the steps: carrying out the process tracking of the container, carrying out the anomaly detection of the process of the container based on the process information, and evaluating the escape risk of the container according to a detection result, so as to determine whether to carry out the risk alarm of the container or not; determining an operation log set of the container, and performing data analysis on the operation log set to obtain a data analysis result; performing escape risk identification on the operation log set by applying a data mining algorithm to obtain a first risk identification result; identifying the operation log set by applying each preset escape behavior identification model to obtain a second risk identification result; and generating a potential escape risk detection result based on the data analysis result of the container, the first risk identification result and the second risk identification result. By applying the method, whether the escape risk exists in the container behavior or not is evaluated from multiple dimensions, and the container escape behavior can be found in time.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and related equipment for detecting container escape risks in a cloud-edge collaborative environment. Background Art

[0002] With the development of cloud computing technology, business platforms based on cloud-edge collaboration are gradually being applied to various fields. Cloud-edge collaboration refers to the collaborative completion of computing tasks through cloud computing and edge computing. In a cloud-edge collaborative environment, container technology is usually used to deploy applications. The tenant's container runs on the host node and can access the resources on the host to complete business processing.

[0003] In the operation scenario of the cloud-edge collaborative environment, it is usually necessary to restrict the access rights of each tenant's container to prevent malicious users from maliciously elevating the privileges of the container and causing the risk of container escape. At present, the main method is to configure the corresponding access rights when the container is started so that it can only access the specified resources on the host machine. When the container is running, malicious traffic is identified through its corresponding access rights to prevent container escape.

[0004] In actual application scenarios, there may be a need to manually configure access permissions, that is, tenants can manually change the access permissions of containers. Based on the existing escape risk prevention methods, if malicious users change the access permissions of containers in advance, malicious traffic cannot be accurately identified during the traffic control process, resulting in the risk of container escape in the cloud-edge collaborative environment, making the network environment less secure. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a method for detecting container escape risks in a cloud-edge collaborative environment, so as to solve the problem that the prior art only identifies container escape behavior through access permissions, which makes it difficult to accurately identify malicious traffic in various scenarios, resulting in poor network security.

[0006] An embodiment of the present invention also provides a device for detecting container escape risks in a cloud-edge collaborative environment to ensure the practical implementation and application of the above method.

[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0008] A method for detecting container escape risks in a cloud-edge collaborative environment, comprising:

[0009] Track the process of each container in the cloud-edge collaborative environment to obtain the process information corresponding to each container;

[0010] For each of the containers, based on the process information corresponding to the container, perform anomaly detection on the process of the container to obtain a process detection result corresponding to the container;

[0011] For each of the containers, determine a real-time escape risk detection result of the container according to a process detection result corresponding to the container, and determine whether to issue a risk warning for the container according to the real-time escape risk detection result;

[0012] Determine a set of operation logs corresponding to each of the containers;

[0013] Performing data analysis on the operation log set corresponding to each of the containers respectively to obtain data analysis results corresponding to each of the containers;

[0014] For each of the containers, applying a preset data mining algorithm, performing escape risk identification on an operation log set corresponding to the container, and obtaining a first risk identification result corresponding to the container;

[0015] Determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior;

[0016] For each of the containers, apply each of the escape behavior recognition models to perform recognition processing on the operation log set corresponding to the container, obtain the escape behavior recognition result output by the escape behavior recognition model, and use the escape behavior recognition result output by each of the escape behavior recognition models as the second risk recognition result corresponding to the container;

[0017] For each of the containers, a potential escape risk detection result corresponding to the container is generated based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

[0018] In the above method, optionally, the process tracking of each container in the cloud-edge collaborative environment to obtain the process information corresponding to each container includes:

[0019] For each of the containers, perform system call tracing on the process of the container to obtain process call data corresponding to the container;

[0020] For each of the containers, monitor resource usage of the process of the container to obtain resource usage data corresponding to the container;

[0021] For each of the containers, a process audit is performed on the process of the container to obtain a process audit log corresponding to the container;

[0022] For each of the containers, the process call data, resource occupancy data and process audit log corresponding to the container are used as the process information corresponding to the container.

[0023] In the above method, optionally, performing abnormality detection on the process of the container based on the process information corresponding to the container to obtain the process detection result corresponding to the container includes:

[0024] Based on the process call data corresponding to the container, abnormal call behavior detection is performed on the process of the container to obtain an abnormal call behavior detection result corresponding to the container;

[0025] Based on the resource usage data corresponding to the container, abnormal resource usage behavior detection is performed on the process of the container to obtain the abnormal resource usage behavior detection result corresponding to the container;

[0026] Based on the process audit log corresponding to the container, abnormal activities of the process of the container are identified to obtain abnormal activity monitoring results corresponding to the container;

[0027] The abnormal call behavior detection result, the abnormal resource usage behavior detection result and the abnormal activity monitoring result are used as the process detection result corresponding to the container.

[0028] In the above method, optionally, performing data analysis on the operation log set corresponding to each container to obtain the data analysis result corresponding to each container includes:

[0029] For each operation log set corresponding to the container, extract the specified field data of each operation log in the operation log set to obtain the target log data corresponding to each operation log, and use each target log data as the log data set corresponding to the container;

[0030] For each of the containers, based on the log data set corresponding to the container, a plurality of characteristic indicators corresponding to the container are determined; the plurality of characteristic indicators correspond one-to-one to a plurality of preset characteristic dimensions;

[0031] For each of the containers, based on the log data set corresponding to the container, a plurality of statistical indicators corresponding to the container are determined; the plurality of statistical indicators correspond one-to-one to a plurality of preset statistical dimensions;

[0032] For each of the containers, based on the log data set corresponding to the container, an operation trend analysis is performed on the container to obtain an operation trend analysis result corresponding to the container;

[0033] For each of the containers, each characteristic index corresponding to the container, each statistical index corresponding to the container, and an operation trend analysis result are used as the data analysis result corresponding to the container.

[0034] In the above method, optionally, applying a preset data mining algorithm to perform escape risk identification on the operation log set corresponding to the container to obtain a first risk identification result corresponding to the container includes:

[0035] Performing association rule mining on the operation log set corresponding to the container to obtain an association rule mining result; the association rule mining result includes an event association relationship between each operation log in the operation log set corresponding to the container;

[0036] Perform cluster analysis on the operation log set corresponding to the container to obtain a cluster analysis result;

[0037] According to the association rule mining result and the cluster analysis result, anomaly detection is performed on the operation log set corresponding to the container to obtain an anomaly detection result, and the anomaly detection result is used as the first risk identification result corresponding to the container.

[0038] The above method may optionally further include:

[0039] Monitoring whether a predetermined operation occurs in the cloud-edge collaborative environment; the predetermined operation is a container creation operation or a container update operation;

[0040] When the predetermined operation is generated in the cloud-edge collaborative environment, determining a target container corresponding to the predetermined operation;

[0041] Determine whether the target container is a container in a preset whitelist;

[0042] If the target container is not a container in the whitelist, determining whether the current permission of the target container is within a preset permission range;

[0043] If the current permission of the target container is not within the permission range, a warning operation is performed on the target container.

[0044] The above method may optionally further include:

[0045] Performing a security scan on each of the containers to obtain a security scan result corresponding to each of the containers;

[0046] For each of the containers, it is determined whether to perform an early warning operation on the container according to the security scanning result corresponding to the container.

[0047] A device for detecting container escape risks in a cloud-edge collaborative environment, comprising:

[0048] A process tracking unit, used to track the process of each container in the cloud-edge collaborative environment and obtain process information corresponding to each container;

[0049] A process detection unit, configured to perform abnormality detection on the process of each container based on the process information corresponding to the container, and obtain a process detection result corresponding to the container;

[0050] A real-time alarm unit, configured to determine, for each of the containers, a real-time escape risk detection result of the container according to a process detection result corresponding to the container, and determine whether to issue a risk alarm for the container according to the real-time escape risk detection result;

[0051] A first determining unit, configured to determine a set of operation logs corresponding to each of the containers;

[0052] A data analysis unit, used to perform data analysis on the operation log set corresponding to each of the containers, and obtain a data analysis result corresponding to each of the containers;

[0053] A data mining unit is used to apply a preset data mining algorithm to each of the containers to identify the escape risk of the operation log set corresponding to the container, and obtain a first risk identification result corresponding to the container;

[0054] A second determination unit is used to determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior;

[0055] A risk identification unit is used to apply each of the escape behavior identification models to identify the operation log set corresponding to each of the containers, obtain the escape behavior identification result output by the escape behavior identification model, and use the escape behavior identification result output by each of the escape behavior identification models as the second risk identification result corresponding to the container;

[0056] The third determination unit is used to generate, for each of the containers, a potential escape risk detection result corresponding to the container based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

[0057] A storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the method for detecting container escape risks in a cloud-edge collaborative environment as described above.

[0058] An electronic device includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors as described above as a method for detecting container escape risks in a cloud-edge collaborative environment.

[0059] A method for detecting container escape risks in a cloud-edge collaborative environment based on the above-mentioned embodiment of the present invention includes: tracking the process of each container in the cloud-edge collaborative environment to obtain process information corresponding to each container; for each container, based on the process information corresponding to the container, performing an abnormality detection on the process of the container to obtain a process detection result corresponding to the container; for each container, according to the process detection result corresponding to the container, determining the real-time escape risk detection result of the container, and determining whether to issue a risk alert for the container according to the real-time escape risk detection result; determining the operation log set corresponding to each container; performing data analysis on the operation log set corresponding to each container respectively to obtain the data analysis result corresponding to each container; for each container, applying a preset data mining algorithm to the operation log set corresponding to the container; The operation log set corresponding to the container is used to identify the escape risk, and the first risk identification result corresponding to the container is obtained; a model set is determined; the model set includes at least one pre-built escape behavior identification model; each escape behavior identification model is a machine learning model for identifying escape behavior; for each container, each escape behavior identification model is applied to the operation log set corresponding to the container to perform identification processing, and the escape behavior identification result output by the escape behavior identification model is obtained, and the escape behavior identification result output by each escape behavior identification model is used as the second risk identification result corresponding to the container; for each container, based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container and the second risk identification result corresponding to the container, a potential escape risk detection result corresponding to the container is generated. By applying the method provided by the embodiment of the present invention, in a cloud-edge collaborative environment, the process information of each container can be obtained in real time through process tracking, and the process of each container can be detected for abnormality. From the perspective of whether the process is abnormal, it is identified whether the container has an escape risk. When it is detected that the container has an escape risk, a risk alarm can be issued to the container in real time. In addition, the operation logs of each container can be obtained through log collection, and data analysis, data mining, and machine learning model prediction can be performed based on the operation logs of each container to comprehensively identify whether the operation of the container has a risk of container escape. Based on the method provided by the embodiment of the present invention, regardless of whether the operation of the container exceeds the current access rights, the actual behavior of the container can be comprehensively evaluated from multiple dimensions to determine whether it is a container escape behavior based on data reflecting the actual behavior of the container, such as the container process and the container operation log, which is conducive to accurately identifying malicious traffic, timely discovering the risk of container escape, and improving the security of the network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0061] Figure 1 A method flow chart of a method for detecting container escape risk in a cloud-edge collaborative environment provided by an embodiment of the present invention;

[0062] Figure 2 Another method flow chart of a method for detecting container escape risk in a cloud-edge collaborative environment provided by an embodiment of the present invention;

[0063] Figure 3 Another method flow chart of a method for detecting container escape risk in a cloud-edge collaborative environment provided by an embodiment of the present invention;

[0064] Figure 4 A schematic diagram of the structure of a device for detecting container escape risk in a cloud-edge collaborative environment provided by an embodiment of the present invention;

[0065] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0068] An embodiment of the present invention provides a method for detecting container escape risks in a cloud-edge collaborative environment. The method can be applied to a cloud-edge collaborative platform, and its execution subject can be a server of the platform. The method flow chart of the method is as follows: Figure 1 As shown, including:

[0069] S101: Track the process of each container in the cloud-edge collaborative environment to obtain process information corresponding to each container;

[0070] The method provided by the embodiment of the present invention is applied to a cloud-edge collaborative environment to detect whether each container in the cloud-edge collaborative environment has a risk of container escape. In the cloud-edge collaborative environment of the embodiment of the present invention, each container runs in a mutually isolated network space, and each container has its own network namespace, IP address, port space, network policy, etc. Specifically, at the physical network layer, each container corresponds to an independent virtual LAN, at the operating system layer, each container corresponds to an independent network stack, and at the application layer, each container corresponds to a virtual network topology. At the same time, a security proxy service is set up in the cloud-edge collaborative environment, and the network communication data of each container can be forwarded through the security proxy service. The security proxy service can control and monitor the incoming and outgoing network traffic, and filter and intercept malicious traffic according to pre-set rules.

[0071] In the method provided by the embodiment of the present invention, relevant mechanisms for process tracking can be deployed in advance inside each container. During the operation of each container, the process in the container is tracked in real time, and relevant data on the process operation, such as process call data, resource usage data, process access data, etc., are obtained, and the relevant data on the process operation is used as the process information corresponding to the corresponding container.

[0072] S102: For each of the containers, based on the process information corresponding to the container, perform anomaly detection on the process of the container to obtain a process detection result corresponding to the container;

[0073] In the method provided by the embodiment of the present invention, the detection rules of process abnormal events can be set in advance according to the abnormal events usually presented by the container escape behavior, such as detecting whether there is malware activity, whether there is unauthorized access attempt, whether there is abnormal traffic pattern, whether there is abnormal file access, whether there is login failure, etc. Based on the process information corresponding to each container, the process of each container is detected for abnormality respectively using the pre-set detection rules to obtain the process detection result corresponding to each container. The process detection result corresponding to each container indicates whether the process of the container has abnormal behavior.

[0074] S103: for each of the containers, determine a real-time escape risk detection result of the container according to a process detection result corresponding to the container, and determine whether to issue a risk warning for the container according to the real-time escape risk detection result;

[0075] In the method provided by the embodiment of the present invention, it can be determined whether the process of each container has abnormal behavior based on the process detection result of the container. For each container, if the process detection result of the container indicates that its process has abnormal behavior, the existence of the container escape risk of the container is used as the real-time escape risk detection result of the container; if the process detection result of the container indicates that its process does not have abnormal behavior, the absence of the container escape risk of the container is used as the real-time escape risk detection result of the container; if the real-time escape risk detection result of the container is that the process of the container has abnormal behavior, a risk warning is issued for the container; if the real-time escape risk detection result of the container is that the process of the container does not have abnormal behavior, there is no need to issue a risk warning for the container. The operation of issuing a risk warning to the container may include intercepting the operation of the container, issuing an alarm prompt to the staff, and other operations.

[0076] S104: Determine a set of operation logs corresponding to each container;

[0077] In the method provided by the embodiment of the present invention, for each container, various log data of the container can be collected from various log sources of the container, such as system logs, application logs, security logs, etc., and the original log data can be pre-processed by data cleaning, data standardization, etc., and the various types of pre-processed log data are used as various operation logs corresponding to the container, and the various operation logs of the container are combined into an operation log set corresponding to the container. That is, the operation log set of each container includes multiple groups of operation logs of the container.

[0078] S105: performing data analysis on the operation log set corresponding to each container respectively to obtain a data analysis result corresponding to each container;

[0079] In the method provided in the embodiment of the present invention, a data statistical analysis strategy can be set in advance according to actual analysis needs, such as setting various statistical analysis indicators, data change trend analysis, etc. For each container operation log set, data analysis is performed on each operation log in the operation log set using a pre-set data analysis strategy to obtain corresponding data analysis results. The data analysis result of each container can be the content obtained by data analysis processing such as various statistical analysis indicators.

[0080] S106: For each of the containers, applying a preset data mining algorithm, performing escape risk identification on an operation log set corresponding to the container, and obtaining a first risk identification result corresponding to the container;

[0081] In the method provided by the embodiment of the present invention, a data mining algorithm can be pre-set, and the data mining algorithm is used to mine abnormal phenomena in the operation log that characterize the container escape behavior. Specifically, the data mining algorithm can be set by using data mining techniques such as association rule mining and cluster analysis. For the operation log set corresponding to each container, a preset data mining algorithm is applied to perform data mining to identify whether there is a container escape behavior in the behavior reflected by the operation log set, so as to achieve escape risk identification, and the identification result is used as the first risk identification result corresponding to the container. It can be understood that if it is believed through data mining that there is an abnormal behavior in the behavior reflected by the operation log set of the container, the existence of abnormal behavior of the container is used as the identification result, and the result characterizes that the container has a container escape risk. If it is believed that there is no abnormal behavior in the behavior reflected by the operation log set of the container, the absence of abnormal behavior of the container is used as the identification result, and the result characterizes that the container does not have a container escape risk. That is, the first risk identification result corresponding to the container can be whether there is abnormal behavior in the container, which corresponds to whether the container has a container escape risk.

[0082] S107: Determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior;

[0083] In the method provided in an embodiment of the present invention, at least one machine learning model for identifying container escape behavior can be constructed in advance according to actual needs, and the pre-constructed machine learning model can be used as an escape behavior recognition model. When multiple escape behavior recognition models are constructed, each escape behavior recognition model can be constructed by different machine learning algorithms. It can be understood that each escape behavior recognition model is obtained by model training based on its corresponding machine learning algorithm and training sample set. The training sample set used to train the escape behavior recognition model includes multiple training samples and sample labels for each training sample. The training sample can specifically be an operation log sample or an indicator extracted based on the operation log. The sample label is a mark that characterizes whether there is container escape behavior.

[0084] In the method provided by the embodiment of the present invention, during the process of detecting the risk of container escape, various pre-built escape behavior recognition models can be obtained to obtain a model set.

[0085] S108: For each of the containers, apply each of the escape behavior recognition models to perform recognition processing on the operation log set corresponding to the container, obtain the escape behavior recognition result output by the escape behavior recognition model, and use the escape behavior recognition result output by each of the escape behavior recognition models as the second risk recognition result corresponding to the container;

[0086] In the method provided by the embodiment of the present invention, each escape behavior identification model is applied to perform data processing on the operation log set of each container, that is, to identify the container escape behavior. Specifically, for each container, the operation log data required by each escape behavior identification model is obtained from the operation log set corresponding to the container, and the operation log data required by each escape behavior identification model is loaded into the input layer of the corresponding escape behavior identification model, so that each escape behavior identification model performs escape behavior identification based on the operation log data required by it, and the escape behavior identification result output by each escape behavior identification model is obtained from the output layer of the escape behavior identification model, and each escape behavior identification result is combined into the second risk identification result corresponding to the container.

[0087] S109: For each of the containers, based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container, a potential escape risk detection result corresponding to the container is generated.

[0088] In the method provided by the embodiment of the present invention, the potential escape risk detection result of each container is determined based on the data analysis result, the first risk identification result and the second risk identification result corresponding to each container. For example, for each container, the data analysis result, the first risk identification result and the second risk identification result of the container are integrated, and the integrated result is used as the detection details. At the same time, according to the pre-set scoring strategy, the risk score can be performed based on the data analysis result, the first risk identification result and the second risk identification result of the container to obtain a comprehensive score that characterizes the overall container escape risk, and the detection details and the comprehensive score are used as the potential escape risk detection result of the container. The potential escape risk detection result of each container can be presented in the form of a test report.

[0089] Based on the method provided by an embodiment of the present invention, the process of each container in the cloud-edge collaborative environment is tracked to obtain the process information corresponding to each container; based on the process information corresponding to the container, the process of the container is detected for anomalies to obtain the process detection result corresponding to the container; according to the process detection result corresponding to the container, the real-time escape risk detection result of the container is determined, and according to the real-time escape risk detection result, it is determined whether to issue a risk alarm for the container; the operation log set corresponding to each container is determined; data analysis is performed on the operation log set corresponding to each container to obtain the data analysis result corresponding to each container; a preset data mining algorithm is applied to identify the escape risk of the operation log set corresponding to the container to obtain a first risk identification result corresponding to the container; each pre-built escape behavior identification model is applied to identify the operation log set of the container to obtain the escape behavior identification result output by each escape behavior identification model, and the escape behavior identification result output by each escape behavior identification model is used as the second risk identification result corresponding to the container; based on the data analysis result, the first risk identification result and the second risk identification result corresponding to the container, a potential escape risk detection result corresponding to the container is generated. By applying the method provided by the embodiment of the present invention, in a cloud-edge collaborative environment, the process information of each container can be obtained in real time through process tracking, and the process of each container can be detected for abnormalities. From the perspective of whether the process is abnormal, it can be identified whether the container has an escape risk. When it is detected that the container has an escape risk, a risk alert can be issued to the container in real time. In addition, the operation logs of each container can be obtained through log collection, and data analysis, data mining, and machine learning model prediction can be performed based on the operation logs of each container to comprehensively identify whether the operation of the container has a container escape risk. Based on the method provided by the embodiment of the present invention, regardless of whether the operation of the container exceeds the current access rights, based on the data reflecting the actual behavior of the container, such as the container process and the container operation log, a comprehensive evaluation can be performed from multiple dimensions on whether the actual behavior of the container is a container escape behavior, which is conducive to accurately identifying malicious traffic, timely discovering container escape risks, and improving the security of the network environment.

[0090] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of tracking the process of each container in the cloud-edge collaborative environment mentioned in step S101 to obtain the process information corresponding to each container includes:

[0091] For each of the containers, perform system call tracing on the process of the container to obtain process call data corresponding to the container;

[0092] In the method provided by the embodiment of the present invention, the ptrace system call or other similar mechanisms are applied in each container to track the process of the container, monitor the system calls and other related call operations executed by the process, and use the call data of the process as the process call data corresponding to the container.

[0093] For each of the containers, monitor resource usage of the process of the container to obtain resource usage data corresponding to the container;

[0094] In the method provided by the embodiment of the present invention, in each container, the resource usage and other data of the container process are monitored through the proc file system or other similar mechanisms, and the resource usage of the process in the container is used as the resource occupancy data corresponding to the container. proc is a virtual file system that can provide real-time information about the system and processes. It contains various files and directories, including data about process status, system resource usage, file descriptors opened by the process, kernel parameters, etc.

[0095] For each of the containers, a process audit is performed on the process of the container to obtain a process audit log corresponding to the container;

[0096] In the method provided by the embodiment of the present invention, in each container, the auditd service or other similar mechanisms are used to perform a security audit on the container process to obtain an audit log for the container process. The auditd service is an existing process that can record system calls and kernel events, and monitor specific file access, specific process activities, etc. according to pre-set audit rules.

[0097] For each of the containers, the process call data, resource occupancy data and process audit log corresponding to the container are used as the process information corresponding to the container.

[0098] In the method provided by the embodiment of the present invention, the process call data, resource occupancy data and process audit log corresponding to each container are used as the process information corresponding to each container.

[0099] On the basis of the method provided in the above embodiment, in the method provided in the embodiment of the present invention, the step S102 mentioned in the embodiment of the present invention includes: performing abnormality detection on the process of the container based on the process information corresponding to the container to obtain the process detection result corresponding to the container, including:

[0100] Based on the process call data corresponding to the container, abnormal call behavior detection is performed on the process of the container to obtain an abnormal call behavior detection result corresponding to the container;

[0101] In the method provided by the embodiment of the present invention, whether there are abnormal calls in the calling behavior of the process is detected through the process calling data of the container, such as detecting whether there is a malicious process attempting to attach to a normal process, and the detection result is used as the abnormal calling behavior detection result of the container, that is, the abnormal calling behavior detection result of the container represents whether there is abnormal calling behavior in the process of the container.

[0102] Based on the resource usage data corresponding to the container, abnormal resource usage behavior detection is performed on the process of the container to obtain the abnormal resource usage behavior detection result corresponding to the container;

[0103] In the method provided by the embodiment of the present invention, the resource usage data of the container is used to detect whether its process has abnormal resource usage, such as detecting whether sensitive file resources are accessed for a long time, and the detection result is used as the abnormal resource usage behavior detection result of the container, that is, the abnormal resource usage behavior detection result of the container represents whether the process of the container has abnormal resource usage behavior.

[0104] Based on the process audit log corresponding to the container, abnormal activities of the process of the container are identified to obtain abnormal activity monitoring results corresponding to the container;

[0105] In the method provided by the embodiment of the present invention, whether there is abnormal activity in the container process is detected through the process audit log of the container, and the detection result is used as the abnormal activity monitoring result of the container, that is, the abnormal activity monitoring result of the container represents whether there is abnormal activity in the process of the container.

[0106] The abnormal call behavior detection result, the abnormal resource usage behavior detection result and the abnormal activity monitoring result are used as the process detection result corresponding to the container.

[0107] In the method provided by an embodiment of the present invention, for each container, the abnormal calling behavior detection results, abnormal resource usage behavior detection results and abnormal activity monitoring results corresponding to the container are used as the process detection results of the container. Subsequently, it can be determined whether to issue a risk alarm based on dimensions such as abnormal calling behavior, abnormal resource usage behavior and abnormal activity.

[0108] exist Figure 1 Based on the method shown, Figure 2 As shown, in the method provided by the embodiment of the present invention, the process of performing data analysis on the operation log set corresponding to each container mentioned in step S105 to obtain the data analysis result corresponding to each container includes:

[0109] S201: For each operation log set corresponding to the container, extract the specified field data of each operation log in the operation log set to obtain the target log data corresponding to each operation log, and use each target log data as the log data set corresponding to the container;

[0110] In the method provided by the embodiment of the present invention, various log fields may be pre-specified, for example, fields such as user ID, operation type, IP address, timestamp, etc. may be specified. During the data analysis process, for each container operation log set, log data corresponding to the specified log field is extracted from each operation log therein, and the extracted log data is used to form a log data set corresponding to the container.

[0111] S202: For each of the containers, based on the log data set corresponding to the container, determine a plurality of characteristic indicators corresponding to the container; the plurality of characteristic indicators correspond one-to-one to a plurality of preset characteristic dimensions;

[0112] In the method provided by the embodiment of the present invention, multiple feature dimensions can be set in advance according to actual needs, such as operation frequency, user activity mode, abnormal behavior and other dimensions, and the feature analysis strategy corresponding to each feature dimension can be configured. During the data analysis process, the log data corresponding to each feature dimension can be obtained from the log data set of the container, and the log data corresponding to each feature dimension can be processed based on the feature analysis strategy corresponding to each feature dimension, such as calculating the index according to a predetermined calculation method, so as to obtain the feature index corresponding to each feature dimension, and use the feature index corresponding to each feature dimension as the feature index corresponding to the corresponding container. It can be understood that the feature index corresponding to each feature dimension is the result obtained by processing the corresponding log data based on the feature analysis strategy corresponding to the feature dimension.

[0113] S203: For each of the containers, based on the log data set corresponding to the container, determine multiple statistical indicators corresponding to the container; the multiple statistical indicators correspond one-to-one to multiple preset statistical dimensions;

[0114] In the method provided by the embodiment of the present invention, multiple statistical dimensions, such as the number of operations, error rate, etc., can be set in advance according to actual needs, and the statistical method corresponding to each statistical dimension can be configured. In the data analysis process, the log data corresponding to each statistical dimension can be obtained from the log data set of the container, and the log data corresponding to the statistical dimension can be statistically analyzed based on the statistical method corresponding to each statistical dimension, and the statistical results can be used as the statistical indicators corresponding to the statistical dimension, and the statistical indicators corresponding to each statistical dimension can be used as the statistical indicators corresponding to the container.

[0115] S204: For each of the containers, based on the log data set corresponding to the container, perform an operation trend analysis on the container to obtain an operation trend analysis result corresponding to the container;

[0116] In the method provided by the embodiment of the present invention, an operation trend analysis strategy can be set in advance according to actual needs to analyze the change trend of container operations, such as analyzing the change trend of the increase or decrease of the operation volume. In the data analysis process, based on the pre-set operation trend analysis strategy, the log data required for analysis is obtained from the log data set of the container, and the log data is trend analyzed based on the operation trend analysis strategy, and the analysis result is used as the operation trend analysis result corresponding to the container.

[0117] S205: For each of the containers, each characteristic index corresponding to the container, each statistical index corresponding to the container, and an operation trend analysis result are used as a data analysis result corresponding to the container.

[0118] In the method provided by the embodiment of the present invention, the data analysis result of the container is composed of each characteristic index corresponding to the container, each statistical index and the operation trend analysis result corresponding to the container.

[0119] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of applying a preset data mining algorithm mentioned in step S106 to identify the escape risk of the operation log set corresponding to the container and obtaining the first risk identification result corresponding to the container includes:

[0120] Performing association rule mining on the operation log set corresponding to the container to obtain an association rule mining result; the association rule mining result includes an event association relationship between each operation log in the operation log set corresponding to the container;

[0121] In the method provided by the embodiment of the present invention, the data mining algorithm is configured in combination with association rule mining and cluster analysis. In the data mining process, the operation log set of the container is mined for association rules through the pre-set association rules, the association relationship between the various events reflected in the operation log set is identified, and the association rule mining result is obtained.

[0122] Perform cluster analysis on the operation log set corresponding to the container to obtain a cluster analysis result;

[0123] In the method provided by the embodiment of the present invention, cluster analysis is performed on each operation log in the operation log set according to the similarity of each operation log in the operation log set, that is, each operation log is grouped according to similarity to identify whether there are isolated objects therein, and obtain a cluster analysis result.

[0124] According to the association rule mining result and the cluster analysis result, anomaly detection is performed on the operation log set corresponding to the container to obtain an anomaly detection result, and the anomaly detection result is used as the first risk identification result corresponding to the container.

[0125] In the method provided by the embodiment of the present invention, the association rule mining results and the cluster analysis results are combined to perform anomaly identification on each operation log in the operation log set, that is, the event association relationship and similarity between each operation log are combined to detect whether there are behaviors that are significantly different from the normal pattern, and the detection result is used as the first risk identification result corresponding to the container.

[0126] exist Figure 1 Based on the method shown, Figure 3 As shown, the method provided in the embodiment of the present invention further includes:

[0127] S301: monitoring whether a predetermined operation is generated in the cloud-edge collaborative environment; the predetermined operation is a container creation operation or a container update operation;

[0128] In the method provided by an embodiment of the present invention, a security monitoring service is deployed to monitor whether container creation operations or container update operations are generated in the cloud-edge collaborative environment, that is, to monitor whether new containers are created in the cloud-edge collaborative environment, or whether existing containers are updated.

[0129] S302: When the predetermined operation is generated in the cloud-edge collaborative environment, determining a target container corresponding to the predetermined operation;

[0130] In the method provided by the embodiment of the present invention, when a predetermined operation, i.e., a container creation operation or a container update operation, is monitored, the container associated with the current operation is used as the target container. For example, if a container creation operation is currently monitored, the newly created container is used as the target container, and if a container update operation is monitored, the currently updated container is used as the target container.

[0131] S303: Determine whether the target container is a container in a preset whitelist;

[0132] In the method provided by the embodiment of the present invention, a whitelist can be pre-configured, and for containers whose operations need to be ignored, corresponding container names can be configured in the whitelist. When a predetermined operation is monitored, the container name of the current target container can be compared with the container names in the preset whitelist. If the container name of the target container matches any container name in the whitelist, the target container is considered to be a container in the whitelist. If the container name of the target container is different from each container name in the whitelist, the target container is considered not to be a container in the whitelist.

[0133] S304: If the target container is not a container in the whitelist, determining whether the current permission of the target container is within a preset permission range;

[0134] In the method provided by the embodiment of the present invention, if the target container is not a container in the whitelist, the current permission information of the target container is obtained from the container configuration data of the target container, and it is determined whether the current permission of the target container is within the preset permission range according to the current permission information of the target container.

[0135] In the method provided by the embodiment of the present invention, if the target container is a container in the whitelist, the current processing process can be terminated without making any judgment on it.

[0136] S305: If the current permission of the target container is not within the permission range, a warning operation is performed on the target container.

[0137] In the method provided by the embodiment of the present invention, if the current permission of the target container is not within the preset permission range, the target container is warned, such as terminating the container or triggering an alarm, etc. If the current permission of the target container is within the preset permission range, no operation is required.

[0138] Based on the method provided by the embodiment of the present invention, it is possible to detect in real time whether the permissions of newly created containers and updated containers are reasonable, and to promptly perform warning operations on containers whose permissions exceed the scope, which is conducive to preventing the risk of container escape.

[0139] exist Figure 1 On the basis of the method shown, the method provided in the embodiment of the present invention further includes:

[0140] Performing a security scan on each of the containers to obtain a security scan result corresponding to each of the containers;

[0141] In the method provided by the embodiment of the present invention, each container in the cloud-edge collaborative environment can be regularly scanned for security, and specifically, vulnerability scanning and security detection can be performed on the container image to obtain the security scan result of each container. The security scan result of each container indicates whether the container has a security risk.

[0142] For each of the containers, it is determined whether to perform an early warning operation on the container according to the security scanning result corresponding to the container.

[0143] In the method provided in the embodiment of the present invention, if the security scan result corresponding to the container indicates that the container has a security risk, an early warning operation is performed on the container, and if the security scan result indicates that the container does not have a security risk, there is no need to perform an early warning operation on the container. The early warning operation can be set as needed, and the specific operation can be the same as the early warning operation mentioned in step S305 in the above embodiment, or it can be different.

[0144] Based on the method provided in the embodiment of the present invention, security scans can be performed on all containers in the cloud-edge collaborative environment at regular intervals, which is conducive to timely discovery of security risks such as container vulnerabilities for risk prevention.

[0145] In order to better illustrate the method provided by the embodiment of the present invention, based on the methods provided by the previous embodiments and combined with actual application scenarios, the embodiment of the present invention provides another method for detecting the risk of container escape in a cloud-edge collaborative environment. Next, the method provided by the embodiment of the present invention is briefly described in combination with actual service implementation. The specific implementation process of the method provided by the embodiment of the present invention mainly includes:

[0146] Create an isolated container network space;

[0147] In an embodiment of the present invention, an isolated container network space is created in a cloud-edge collaborative environment, and a unique identifier is assigned to each container. A separately isolated container network space can enhance security, and an isolated container network can prevent malicious code or attacks from spreading from one container to another. Each container has its own network namespace and IP address, port space, and network policy, etc. Therefore, communication between containers can be better controlled and monitored, which also helps to avoid resource competition between containers and improve overall system resource utilization and performance. Specifically, using virtual LAN technology, an independent virtual LAN is created for each container at the physical network layer. Using network namespace technology, an independent network stack is created for each container at the operating system layer. Using software-defined network technology, a virtual network topology is created for each container at the application layer.

[0148] Deployment of security proxy services;

[0149] In an embodiment of the present invention, a security proxy service is deployed in a cloud-edge collaborative environment, which is responsible for intercepting and inspecting network communications between containers, and filtering and forwarding network traffic according to preset security policies. The security proxy service can serve as the front end of the firewall to control and monitor traffic in and out of the network. It can filter and block malicious traffic based on set policies and rules, thereby enhancing the security of the network, and can also be used to detect and mitigate distributed denial of service (DDoS) attacks. It can identify abnormal traffic patterns and take measures to filter or block malicious traffic to ensure normal service availability. The specific implementation of the security proxy service mainly includes:

[0150] Using transparent proxy technology, a global proxy server is set up in the cloud-edge collaborative environment. By modifying the routing table or firewall rules, all network communications between containers are forced to be forwarded to the proxy server. The proxy server can receive client requests, forward them directly to the target server, and return the response to the client, usually without modifying the request or response content.

[0151] Using non-transparent proxy technology, a local proxy server is set up in the cloud-edge collaborative environment. By modifying the configuration file or environment variables inside the container, the network communication between the specified containers is actively forwarded to the proxy server. After receiving the request, the proxy server may modify the request or response content, and then forward the request to the target server, and finally return the response to the client. The proxy server can be used to implement content filtering, caching or load balancing.

[0152] Using dynamic proxy technology, a distributed proxy service is set up in the cloud-edge collaborative environment. By dynamically injecting or removing the corresponding proxy module inside the container, the network communication between containers that need to be monitored or controlled is forwarded to the proxy service in real time. The proxy service can dynamically adjust its behavior according to different conditions (such as request content, load, time, etc.). For example, different backend servers may be selected according to the type of request.

[0153] Deploy a security monitoring service;

[0154] In the embodiment of the present invention, a security monitoring service is deployed in the cloud-edge collaborative environment. The service is responsible for monitoring the process activities inside the container and performing detection and alarm according to preset security rules. The security monitoring service can monitor and detect security events and abnormal activities in the system and network in real time, including but not limited to malware activities, unauthorized access attempts, abnormal traffic patterns, login failures, abnormal file access, etc., and can promptly alarm abnormal events. The specific implementation of the security monitoring service mainly includes:

[0155] Use process tracking technology, use ptrace system calls or other similar mechanisms inside the container to track and intercept processes running inside the container, and detect and alarm system calls or other sensitive operations performed by them. Ptrace is a system call that allows one process to control the execution of another process. Ptrace can be used to monitor whether there are malicious processes trying to attach to other processes to determine whether an alarm is needed.

[0156] Use process monitoring technology, use the proc file system or other similar mechanisms inside the container, monitor and sample the processes running inside the container, and detect and alarm the resources occupied by the process or other abnormal behaviors. proc is a virtual file system that provides real-time information about the system and processes. It contains various files and directories, including information about process status, system resource usage, file descriptors opened by the process, kernel parameters, etc. By collecting this information, you can monitor proc access and detect potential security issues, such as detecting whether the process accesses sensitive file resources. Regularly checking the process information in the proc file system can identify abnormal processes or resource usage patterns.

[0157] Using process auditing technology, use the auditd service or other similar mechanisms inside the container to audit and record the processes running inside the container, and detect and alarm the logs or other suspicious events generated by them. auditd is a user space daemon of the audit subsystem of the Linux kernel. It is responsible for recording system calls and kernel events for security auditing. Audit rules can be configured by editing the configuration file. For example, you can set rules to monitor the access to specific files, the activities of specific processes, and so on. When the service performs a security audit on the process based on the audit rules, the corresponding audit log can be generated. You can use tools such as ausearch and aureport to query and analyze audit logs to monitor the security status of the system and identify abnormal activities.

[0158] Deploy a security audit service;

[0159] In the embodiment of the present invention, a security audit service is deployed in the cloud-edge collaborative environment. The service is responsible for recording the operation logs inside and outside the container, and analyzing and evaluating them according to the preset security standards. The security audit service can be used to analyze and audit the logs of the system and network, detect abnormal behaviors and security incidents, and track and analyze possible security threats and attack patterns. Through log auditing, potential security issues can be quickly identified and countermeasures can be taken in a timely manner. The specific implementation of the security audit service mainly includes:

[0160] Using log collection technology, a log server is set up in the cloud-edge collaborative environment. By configuring log sources or log agents inside and outside the container, all container-related operation logs are collected to the log server.

[0161] Using log analysis technology, a log analyzer is set up in a cloud-edge collaborative environment. By applying data mining, machine learning, artificial intelligence and other technologies, the collected operation logs are analyzed and evaluated, and corresponding scores or reports are generated based on preset security standards.

[0162] Using log display technology, a log displayer is set up in the cloud-edge collaborative environment. By using visualization, interactive, real-time and other technologies, the log analysis results are displayed and presented, and corresponding query, filtering, sorting and other functions are provided.

[0163] The log analysis process mainly includes:

[0164] Data collection and preprocessing: Collect data from various log sources (such as system logs, application logs, security logs, etc.). Clean the original log data, such as processing missing values, duplicate records, and data with inconsistent formats to ensure data quality. Standardize the cleaned data and convert the data into a consistent format, such as a unified format for timestamps.

[0165] Feature data extraction: Extract key fields from logs, such as user ID, operation type, IP address, timestamp, etc.

[0166] Feature analysis: Based on the key fields extracted from the logs, calculate features such as operation frequency, user activity patterns, and abnormal behaviors.

[0167] Basic statistical analysis: Based on the key fields extracted from the log, calculate the basic statistical indicators of the log, such as the number of operations, error rate, etc.

[0168] Trend analysis: Identify long-term trends and patterns, such as growth or decline in operation volume, based on key fields in the logs.

[0169] Apply data mining technology: Use association rule mining to discover the relationship between different events in the log; use cluster analysis to group log entries by similarity and identify abnormal groups. Combine association rule mining results with cluster analysis results to perform anomaly detection and identify behaviors that are significantly different from normal patterns and may indicate security threats.

[0170] Apply machine learning technology: Use a variety of machine learning algorithms to build identification models for escape behaviors. For example, use labeled security log samples to train classification models (such as decision trees and support vector machines) to identify potential security threats. Use labeled log samples to train unsupervised learning models (such as isolation forests and principal component analysis) to detect abnormal behaviors. Use labeled log text samples and natural language processing technology (NLP) to train models that identify security-related events or warnings. Based on log data samples, train deep learning models (such as convolutional neural networks and recursive neural networks) to process complex log data and discover advanced patterns and anomalies. Use cross-validation and test sets to evaluate the accuracy and effectiveness of each model. During the log analysis process, apply each model to analyze the current log data.

[0171] Security score: The security score is calculated based on the preset security standards (such as compliance, risk level) using the above analysis results. A weighted algorithm can be used to combine various indicators to generate a score.

[0172] Report generation: Automatically generate reports containing analysis results, abnormal events, trend charts and security recommendations. Reports can include: Summary (overall overview of log analysis), Detailed analysis (detailed description of key findings and abnormal behaviors), Security score (score based on preset criteria) and Recommendations (improvement measures and risk mitigation suggestions).

[0173] Deployment of secure monitoring services;

[0174] In an embodiment of the present invention, a security monitoring service is deployed in a cloud-edge collaborative environment. The service is responsible for real-time monitoring of newly created or updated containers in the environment, and determines whether to issue an alarm based on whether the container complies with security specifications. The security monitoring service can monitor newly created containers or updated containers, and automatically detect whether the permissions of the container are reasonable. If the permissions are too large, the container can be directly terminated or an alarm can be triggered according to the configured monitoring policy. The monitoring service can also regularly perform vulnerability scans and security checks on container images. It can identify known vulnerabilities and weaknesses in containers, and help to promptly repair and strengthen the security protection of containers. The specific implementation of the security monitoring service mainly includes:

[0175] Install and deploy a listener in the cloud-edge collaborative environment to monitor the creation and update of containers in the environment in real time. Once a container change is found, the container is checked for permissions. If it is detected that the permissions corresponding to the container are too large or there are some configurations that may affect the security of the host, the container is terminated. Regarding permissions, you can query the SecurityContext configuration content of the container Pod to query the maximum permission range in the container, or you can query the ServiceAccount information associated with the container Pod to query the permission range of the Kubernetes cluster resources that can be manipulated in the container.

[0176] The monitoring service can also be set to scan all containers regularly, and if any problems are found, the container can be terminated directly.

[0177] The listening service allows the configuration of a whitelist, allowing certain special containers to have greater permissions. You can add a specific label to a special container, and the listening service will ignore the corresponding container when scanning and listening. You can also configure a whitelist by specifying the container name.

[0178] The method provided by the embodiment of the present invention isolates the container network and uses a network security agent to allow the tenant's container to use only its own network namespace and cannot directly access the network where the host machine is located. Through security monitoring, security auditing, security monitoring and other services, behavioral analysis, interception, alarm and other operations are performed on the container cluster environment, which is conducive to timely detection of container escape risks and reduces the possibility of host machine damage. It can effectively prevent containers from escalating privileges and escaping through dangerous configurations, dangerous mounting, related program vulnerabilities or kernel vulnerabilities, thereby improving the security of containers in the cloud-edge collaborative environment.

[0179] and Figure 1 Corresponding to the method for detecting container escape risk in a cloud-edge collaborative environment shown in FIG, an embodiment of the present invention further provides a device for detecting container escape risk in a cloud-edge collaborative environment, for detecting Figure 1 The specific implementation of the method shown in is shown in the structural diagram Figure 4 As shown, including:

[0180] The process tracking unit 401 is used to track the process of each container in the cloud-edge collaborative environment and obtain the process information corresponding to each container;

[0181] A process detection unit 402 is used to perform an abnormality detection on the process of each container based on the process information corresponding to the container, and obtain a process detection result corresponding to the container;

[0182] The real-time alarm unit 403 is used to determine, for each of the containers, a real-time escape risk detection result of the container according to the process detection result corresponding to the container, and determine whether to issue a risk alarm for the container according to the real-time escape risk detection result;

[0183] A first determining unit 404 is used to determine a set of operation logs corresponding to each of the containers;

[0184] The data analysis unit 405 is used to perform data analysis on the operation log set corresponding to each container to obtain the data analysis result corresponding to each container;

[0185] The data mining unit 406 is used to apply a preset data mining algorithm to each of the containers to identify the escape risk of the operation log set corresponding to the container, and obtain a first risk identification result corresponding to the container;

[0186] A second determining unit 407 is used to determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior;

[0187] The risk identification unit 408 is used to apply each of the escape behavior identification models to identify the operation log set corresponding to each of the containers, obtain the escape behavior identification result output by the escape behavior identification model, and use the escape behavior identification result output by each of the escape behavior identification models as the second risk identification result corresponding to the container;

[0188] The third determination unit 409 is configured to generate, for each of the containers, a potential escape risk detection result corresponding to the container based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

[0189] By applying the device provided by the embodiment of the present invention, in a cloud-edge collaborative environment, the process information of each container can be obtained in real time through process tracking, and the process of each container can be detected for abnormalities. From the perspective of whether the process is abnormal, it can be identified whether the container has an escape risk. When it is detected that the container has an escape risk, a risk alert can be issued to the container in real time. In addition, the operation logs of each container can be obtained through log collection, and data analysis, data mining, and machine learning model prediction can be performed based on the operation logs of each container to comprehensively identify whether the operation of the container has a container escape risk. Based on the device provided by the embodiment of the present invention, regardless of whether the operation of the container exceeds the current access rights, the actual behavior of the container can be comprehensively evaluated from multiple dimensions to determine whether it is a container escape behavior based on data reflecting the actual behavior of the container, such as the container process and the container operation log, which is conducive to accurately identifying malicious traffic, timely discovering container escape risks, and improving the security of the network environment.

[0190] exist Figure 4 Based on the device shown, the device provided by the embodiment of the present invention can be further expanded into multiple units. The functions of each unit can be found in the descriptions of the various embodiments provided in the previous text for the method for detecting container escape risks in a cloud-edge collaborative environment, and no further examples will be given here.

[0191] An embodiment of the present invention also provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned method for detecting container escape risks in a cloud-edge collaborative environment.

[0192] The embodiment of the present invention further provides an electronic device, the structural diagram of which is shown in FIG. Figure 5 As shown, it specifically includes a memory 501 and one or more instructions 502, wherein the one or more instructions 502 are stored in the memory 501 and are configured to be executed by one or more processors 503 to perform the following operations:

[0193] Track the process of each container in the cloud-edge collaborative environment to obtain the process information corresponding to each container;

[0194] For each of the containers, based on the process information corresponding to the container, perform anomaly detection on the process of the container to obtain a process detection result corresponding to the container;

[0195] For each of the containers, determine a real-time escape risk detection result of the container according to a process detection result corresponding to the container, and determine whether to issue a risk warning for the container according to the real-time escape risk detection result;

[0196] Determine a set of operation logs corresponding to each of the containers;

[0197] Performing data analysis on the operation log set corresponding to each of the containers respectively to obtain data analysis results corresponding to each of the containers;

[0198] For each of the containers, applying a preset data mining algorithm, performing escape risk identification on an operation log set corresponding to the container, and obtaining a first risk identification result corresponding to the container;

[0199] Determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior;

[0200] For each of the containers, apply each of the escape behavior recognition models to perform recognition processing on the operation log set corresponding to the container, obtain the escape behavior recognition result output by the escape behavior recognition model, and use the escape behavior recognition result output by each of the escape behavior recognition models as the second risk recognition result corresponding to the container;

[0201] For each of the containers, a potential escape risk detection result corresponding to the container is generated based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

[0202] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0203] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0204] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting container escape risk in a cloud-edge collaborative environment, characterized in that: include: Track the process of each container in the cloud-edge collaborative environment to obtain the process information corresponding to each container; For each of the containers, based on the process information corresponding to the container, perform anomaly detection on the process of the container to obtain a process detection result corresponding to the container; For each of the containers, determine a real-time escape risk detection result of the container according to a process detection result corresponding to the container, and determine whether to issue a risk warning for the container according to the real-time escape risk detection result; Determine a set of operation logs corresponding to each of the containers; Performing data analysis on the operation log set corresponding to each of the containers respectively to obtain data analysis results corresponding to each of the containers; For each of the containers, applying a preset data mining algorithm, performing escape risk identification on an operation log set corresponding to the container, and obtaining a first risk identification result corresponding to the container; Determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior; For each of the containers, apply each of the escape behavior recognition models to perform recognition processing on the operation log set corresponding to the container, obtain the escape behavior recognition result output by the escape behavior recognition model, and use the escape behavior recognition result output by each of the escape behavior recognition models as the second risk recognition result corresponding to the container; For each of the containers, a potential escape risk detection result corresponding to the container is generated based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

2. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: The process tracking of each container in the cloud-edge collaborative environment to obtain process information corresponding to each container includes: For each of the containers, perform system call tracing on the process of the container to obtain process call data corresponding to the container; For each of the containers, monitor resource usage of the process of the container to obtain resource usage data corresponding to the container; For each of the containers, a process audit is performed on the process of the container to obtain a process audit log corresponding to the container; For each of the containers, the process call data, resource occupancy data and process audit log corresponding to the container are used as the process information corresponding to the container.

3. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 2 is characterized in that: The performing abnormality detection on the process of the container based on the process information corresponding to the container to obtain the process detection result corresponding to the container includes: Based on the process call data corresponding to the container, abnormal call behavior detection is performed on the process of the container to obtain an abnormal call behavior detection result corresponding to the container; Based on the resource usage data corresponding to the container, abnormal resource usage behavior detection is performed on the process of the container to obtain the abnormal resource usage behavior detection result corresponding to the container; Based on the process audit log corresponding to the container, abnormal activities of the process of the container are identified to obtain abnormal activity monitoring results corresponding to the container; The abnormal call behavior detection result, the abnormal resource usage behavior detection result and the abnormal activity monitoring result are used as the process detection result corresponding to the container.

4. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: The performing data analysis on the operation log set corresponding to each of the containers to obtain the data analysis result corresponding to each of the containers includes: For each operation log set corresponding to the container, extract the specified field data of each operation log in the operation log set to obtain the target log data corresponding to each operation log, and use each target log data as the log data set corresponding to the container; For each of the containers, based on the log data set corresponding to the container, a plurality of characteristic indicators corresponding to the container are determined; the plurality of characteristic indicators correspond one-to-one to a plurality of preset characteristic dimensions; For each of the containers, based on the log data set corresponding to the container, a plurality of statistical indicators corresponding to the container are determined; the plurality of statistical indicators correspond one-to-one to a plurality of preset statistical dimensions; For each of the containers, based on the log data set corresponding to the container, an operation trend analysis is performed on the container to obtain an operation trend analysis result corresponding to the container; For each of the containers, each characteristic index corresponding to the container, each statistical index corresponding to the container, and an operation trend analysis result are used as the data analysis result corresponding to the container.

5. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: The applying a preset data mining algorithm to perform escape risk identification on the operation log set corresponding to the container to obtain a first risk identification result corresponding to the container includes: Performing association rule mining on the operation log set corresponding to the container to obtain an association rule mining result; the association rule mining result includes an event association relationship between each operation log in the operation log set corresponding to the container; Perform cluster analysis on the operation log set corresponding to the container to obtain a cluster analysis result; According to the association rule mining result and the cluster analysis result, anomaly detection is performed on the operation log set corresponding to the container to obtain an anomaly detection result, and the anomaly detection result is used as the first risk identification result corresponding to the container.

6. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: Also includes: Monitoring whether a predetermined operation occurs in the cloud-edge collaborative environment; the predetermined operation is a container creation operation or a container update operation; When the predetermined operation is generated in the cloud-edge collaborative environment, determining a target container corresponding to the predetermined operation; Determine whether the target container is a container in a preset whitelist; If the target container is not a container in the whitelist, determining whether the current permission of the target container is within a preset permission range; If the current permission of the target container is not within the permission range, a warning operation is performed on the target container.

7. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: Also includes: Performing a security scan on each of the containers to obtain a security scan result corresponding to each of the containers; For each of the containers, it is determined whether to perform an early warning operation on the container according to the security scanning result corresponding to the container.

8. A device for detecting container escape risk in a cloud-edge collaborative environment, characterized in that: include: A process tracking unit, used to track the process of each container in the cloud-edge collaborative environment and obtain process information corresponding to each container; A process detection unit, configured to perform abnormality detection on the process of each container based on the process information corresponding to the container, and obtain a process detection result corresponding to the container; A real-time alarm unit, configured to determine, for each of the containers, a real-time escape risk detection result of the container according to a process detection result corresponding to the container, and determine whether to issue a risk alarm for the container according to the real-time escape risk detection result; A first determining unit, configured to determine a set of operation logs corresponding to each of the containers; A data analysis unit, used to perform data analysis on the operation log set corresponding to each of the containers, and obtain a data analysis result corresponding to each of the containers; A data mining unit is used to apply a preset data mining algorithm to each of the containers to identify the escape risk of the operation log set corresponding to the container, and obtain a first risk identification result corresponding to the container; A second determination unit is used to determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior; A risk identification unit is used to apply each of the escape behavior identification models to identify the operation log set corresponding to each of the containers, obtain the escape behavior identification result output by the escape behavior identification model, and use the escape behavior identification result output by each of the escape behavior identification models as the second risk identification result corresponding to the container; The third determination unit is used to generate, for each of the containers, a potential escape risk detection result corresponding to the container based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

9. A storage medium, characterized in that: The storage medium includes stored instructions, wherein, when the instructions are executed, the device where the storage medium is located is controlled to execute the method for detecting container escape risks in a cloud-edge collaborative environment as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors to implement the method for detecting container escape risks in a cloud-edge collaborative environment as described in any one of claims 1 to 7.

Images