Detection methods and related equipment for container escape risks in cloud-edge collaborative environments

Abstract

The present invention provides a method and related equipment for detecting container escape risks in a cloud-edge collaborative environment, belonging to the field of network security. The method includes: tracking the process of the container, performing anomaly detection on the container process based on process information, and evaluating the container escape risk according to the detection result to determine whether to issue a risk alert for the container; determining the operation log set of the container, performing data analysis on the operation log set, and obtaining a data analysis result; applying a data mining algorithm to identify the escape risk of the operation log set and obtain a first risk identification result; applying a preset each escape behavior identification model to identify the operation log set and obtain a second risk identification result; generating a potential escape risk detection result based on the container data analysis result, the first risk identification result, and the second risk identification result. Applying the method of the present invention, whether the container behavior has an escape risk is evaluated from multiple dimensions, which is conducive to timely detection of container escape behavior.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and related equipment for detecting container escape risks in a cloud-edge collaborative environment. Background Art

[0002] With the development of cloud computing technology, business platforms based on cloud-edge collaboration are gradually being applied in various fields. Cloud-edge collaboration refers to the collaborative completion of computing tasks through cloud computing and edge computing. In a cloud-edge collaboration environment, application deployment is typically achieved using container technology. Tenants' containers run on host nodes and can access resources on the host to complete business processing.

[0003] In cloud-edge collaborative environments, it's often necessary to restrict access permissions for each tenant's container to prevent malicious users from escalating privileges and potentially escaping the container. Currently, this approach primarily involves configuring access permissions at container startup, limiting access to only specific resources on the host. While the container is running, malicious traffic is identified based on its corresponding access permissions, preventing container escape.

[0004] In actual application scenarios, there may be a need to manually configure access permissions, meaning tenants can manually change container access permissions. Based on existing escape risk prevention methods, if a malicious user pre-emptively changes container access permissions, traffic control cannot accurately identify malicious traffic, resulting in a container escape risk in the cloud-edge collaborative environment and poor network security. Summary of the Invention

[0005] In view of this, an embodiment of the present invention provides a method for detecting container escape risks in a cloud-edge collaborative environment to solve the problem that the existing technology only identifies container escape behavior through access permissions, making it difficult to accurately identify malicious traffic in various scenarios, resulting in poor network security.

[0006] An embodiment of the present invention also provides a device for detecting container escape risks in a cloud-edge collaborative environment to ensure the practical implementation and application of the above method.

[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0008] A method for detecting container escape risks in a cloud-edge collaborative environment, comprising:

[0009] Track the process of each container in the cloud-edge collaborative environment to obtain the process information corresponding to each container;

[0010] For each of the containers, based on the process information corresponding to the container, perform anomaly detection on the process of the container to obtain a process detection result corresponding to the container;

[0011] For each of the containers, determining a real-time escape risk detection result of the container based on the process detection result corresponding to the container, and determining whether to issue a risk alert for the container based on the real-time escape risk detection result;

[0012] Determine an operation log set corresponding to each container;

[0013] Performing data analysis on the operation log set corresponding to each container to obtain data analysis results corresponding to each container;

[0014] For each of the containers, applying a preset data mining algorithm to perform escape risk identification on the operation log set corresponding to the container, and obtaining a first risk identification result corresponding to the container;

[0015] Determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior;

[0016] For each of the containers, applying each of the escape behavior recognition models to perform recognition processing on the operation log set corresponding to the container, obtaining an escape behavior recognition result output by the escape behavior recognition model, and using the escape behavior recognition result output by each of the escape behavior recognition models as the second risk recognition result corresponding to the container;

[0017] For each of the containers, a potential escape risk detection result corresponding to the container is generated based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

[0018] Optionally, the method of tracking the process of each container in the cloud-edge collaborative environment to obtain the process information corresponding to each container includes:

[0019] For each of the containers, perform system call tracing on the process of the container to obtain process call data corresponding to the container;

[0020] For each container, monitor the resource usage of the container process to obtain resource usage data corresponding to the container;

[0021] For each container, perform a process audit on the process of the container to obtain a process audit log corresponding to the container;

[0022] For each of the containers, the process call data, resource usage data, and process audit log corresponding to the container are used as the process information corresponding to the container.

[0023] Optionally, the method further includes performing anomaly detection on the process of the container based on the process information corresponding to the container to obtain a detection result of the process corresponding to the container, including:

[0024] Based on the process call data corresponding to the container, abnormal call behavior detection is performed on the process of the container to obtain the abnormal call behavior detection result corresponding to the container;

[0025] Based on the resource usage data corresponding to the container, abnormal resource usage behavior detection is performed on the process of the container to obtain the abnormal resource usage behavior detection result corresponding to the container;

[0026] Based on the process audit log corresponding to the container, abnormal activity of the container process is identified to obtain abnormal activity monitoring results corresponding to the container;

[0027] The abnormal call behavior detection result, the abnormal resource usage behavior detection result and the abnormal activity monitoring result are used as the process detection result corresponding to the container.

[0028] Optionally, the method further includes performing data analysis on the operation log set corresponding to each container to obtain the data analysis result corresponding to each container, including:

[0029] For each operation log set corresponding to the container, extract data from each operation log in the operation log set using a specified field, obtain target log data corresponding to each operation log, and use each target log data as the log data set corresponding to the container;

[0030] For each of the containers, based on the log data set corresponding to the container, determining a plurality of characteristic indicators corresponding to the container; the plurality of characteristic indicators corresponding to the plurality of preset characteristic dimensions one by one;

[0031] For each of the containers, based on the log data set corresponding to the container, determining a plurality of statistical indicators corresponding to the container; the plurality of statistical indicators corresponding to the plurality of preset statistical dimensions;

[0032] For each of the containers, performing an operation trend analysis on the container based on a log data set corresponding to the container to obtain an operation trend analysis result corresponding to the container;

[0033] For each container, each characteristic index corresponding to the container, each statistical index corresponding to the container, and an operation trend analysis result are used as the data analysis result corresponding to the container.

[0034] In the above method, optionally, applying a preset data mining algorithm to perform escape risk identification on the operation log set corresponding to the container to obtain a first risk identification result corresponding to the container includes:

[0035] Performing association rule mining on the operation log set corresponding to the container to obtain an association rule mining result; the association rule mining result includes an event association relationship between each operation log in the operation log set corresponding to the container;

[0036] Perform cluster analysis on the operation log set corresponding to the container to obtain cluster analysis results;

[0037] Based on the association rule mining result and the cluster analysis result, anomaly detection is performed on the operation log set corresponding to the container to obtain an anomaly detection result, and the anomaly detection result is used as the first risk identification result corresponding to the container.

[0038] The above method may optionally further include:

[0039] Monitoring whether a predetermined operation occurs in the cloud-edge collaborative environment; the predetermined operation is a container creation operation or a container update operation;

[0040] When the predetermined operation occurs in the cloud-edge collaborative environment, determining a target container corresponding to the predetermined operation;

[0041] Determine whether the target container is a container in a preset whitelist;

[0042] If the target container is not a container in the whitelist, determining whether the current permission of the target container is within a preset permission range;

[0043] If the current permission of the target container is not within the permission range, a warning operation is performed on the target container.

[0044] The above method may optionally further include:

[0045] Performing a security scan on each of the containers to obtain a security scan result corresponding to each of the containers;

[0046] For each of the containers, it is determined whether to perform an early warning operation on the container according to the security scan result corresponding to the container.

[0047] A device for detecting container escape risks in a cloud-edge collaborative environment, comprising:

[0048] A process tracking unit is used to track the process of each container in the cloud-edge collaborative environment and obtain process information corresponding to each container;

[0049] a process detection unit, configured to perform an anomaly detection on the process of each container based on the process information corresponding to the container, and obtain a process detection result corresponding to the container;

[0050] A real-time alarm unit is configured to determine, for each container, a real-time escape risk detection result of the container based on a process detection result corresponding to the container, and determine whether to issue a risk alarm for the container based on the real-time escape risk detection result;

[0051] A first determining unit, configured to determine a set of operation logs corresponding to each of the containers;

[0052] A data analysis unit, configured to perform data analysis on the operation log set corresponding to each container, and obtain a data analysis result corresponding to each container;

[0053] a data mining unit configured to apply a preset data mining algorithm to each of the containers to identify the escape risk of the operation log set corresponding to the container, and obtain a first risk identification result corresponding to the container;

[0054] A second determining unit is configured to determine a model set, wherein the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for recognizing escape behavior;

[0055] a risk identification unit configured to apply each of the escape behavior identification models to each of the containers, perform identification processing on the operation log set corresponding to the container, obtain an escape behavior identification result output by the escape behavior identification model, and use the escape behavior identification result output by each of the escape behavior identification models as a second risk identification result corresponding to the container;

[0056] The third determining unit is configured to generate, for each of the containers, a potential escape risk detection result corresponding to the container based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

[0057] A storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned method for detecting container escape risks in a cloud-edge collaborative environment.

[0058] An electronic device includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors to perform the above-mentioned method for detecting container escape risks in a cloud-edge collaborative environment.

[0059] A method for detecting container escape risks in a cloud-edge collaborative environment based on the above-mentioned embodiment of the present invention includes: tracking the process of each container in the cloud-edge collaborative environment to obtain process information corresponding to each container; for each container, based on the process information corresponding to the container, performing anomaly detection on the process of the container to obtain the process detection result corresponding to the container; for each container, determining the real-time escape risk detection result of the container according to the process detection result corresponding to the container, and determining whether to issue a risk alert for the container according to the real-time escape risk detection result; determining the operation log set corresponding to each container; performing data analysis on the operation log set corresponding to each container respectively to obtain the data analysis result corresponding to each container; for each container, applying a preset data mining algorithm to the process of the container The operation log set corresponding to the container is used to identify the escape risk and obtain the first risk identification result corresponding to the container; a model set is determined; the model set includes at least one pre-built escape behavior identification model; each escape behavior identification model is a machine learning model for identifying escape behavior; for each container, each escape behavior identification model is applied to the operation log set corresponding to the container to perform identification processing, obtain the escape behavior identification result output by the escape behavior identification model, and use the escape behavior identification result output by each escape behavior identification model as the second risk identification result corresponding to the container; for each container, based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container, a potential escape risk detection result corresponding to the container is generated. By applying the method provided by the embodiment of the present invention, in a cloud-edge collaborative environment, the process information of each container can be obtained in real time through process tracking, and anomaly detection can be performed on the process of each container. From the perspective of whether the process is abnormal, it is identified whether the container has an escape risk. When it is detected that the container has an escape risk, a risk alert can be issued to the container in real time. Furthermore, the operation logs of each container can be obtained through log collection, and data analysis, data mining, and machine learning model prediction can be performed based on the operation logs of each container to comprehensively identify whether the container operation has a container escape risk. Based on the method provided by the embodiment of the present invention, regardless of whether the operation of the container exceeds the current access rights, a comprehensive assessment can be made from multiple dimensions to determine whether the actual behavior of the container is a container escape behavior based on data reflecting the actual behavior of the container, such as the container process and the container operation log. This is conducive to accurately identifying malicious traffic, timely discovering container escape risks, and improving the security of the network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0061] Figure 1 A flowchart of a method for detecting container escape risks in a cloud-edge collaborative environment provided by an embodiment of the present invention;

[0062] Figure 2 Another method flow chart of a method for detecting container escape risk in a cloud-edge collaborative environment provided by an embodiment of the present invention;

[0063] Figure 3 Another method flow chart of a method for detecting container escape risks in a cloud-edge collaborative environment provided by an embodiment of the present invention;

[0064] Figure 4 A schematic diagram of the structure of a device for detecting container escape risks in a cloud-edge collaborative environment provided by an embodiment of the present invention;

[0065] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0067] In this application, the terms "comprises," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0068] The embodiment of the present invention provides a method for detecting container escape risks in a cloud-edge collaborative environment. The method can be applied to a cloud-edge collaborative platform, and its execution subject can be a server of the platform. The method flow chart of the method is as follows: Figure 1 Shown, including:

[0069] S101: Track the process of each container in the cloud-edge collaborative environment to obtain process information corresponding to each container;

[0070] The method provided by the embodiment of the present invention is applied to a cloud-edge collaborative environment to detect whether each container in the cloud-edge collaborative environment has a container escape risk. In the cloud-edge collaborative environment of the embodiment of the present invention, each container runs in a mutually isolated network space, and each container has its own network namespace, IP address, port space, network policy, etc. Specifically, at the physical network layer, each container corresponds to an independent virtual LAN, at the operating system layer, each container corresponds to an independent network stack, and at the application layer, each container corresponds to a virtual network topology. At the same time, a security proxy service is set up in the cloud-edge collaborative environment, and the network communication data of each container can be forwarded through the security proxy service. The security proxy service can control and monitor the inbound and outbound network traffic, and filter and intercept malicious traffic according to pre-set rules.

[0071] In the method provided by the embodiment of the present invention, a relevant mechanism for process tracking can be deployed in advance inside each container. During the operation of each container, the process in the container is tracked in real time, and relevant data on the process operation is obtained, such as process call data, resource usage data, process access data, etc. The relevant data on the process operation is used as the process information corresponding to the corresponding container.

[0072] S102: For each container, based on the process information corresponding to the container, perform an anomaly detection on the process of the container to obtain a process detection result corresponding to the container;

[0073] In the method provided by an embodiment of the present invention, detection rules for process anomaly events can be pre-set based on the anomalies typically exhibited by container escape behavior. For example, these rules can detect the presence of malware activity, unauthorized access attempts, abnormal traffic patterns, abnormal file access, login failures, and so on. Based on the process information corresponding to each container, pre-set detection rules are used to perform anomaly detection on each container's process, obtaining a process detection result corresponding to each container. The process detection result corresponding to each container indicates whether the container's process has exhibited abnormal behavior.

[0074] S103: For each container, determine a real-time escape risk detection result of the container based on the process detection result corresponding to the container, and determine whether to issue a risk alert for the container based on the real-time escape risk detection result;

[0075] In the method provided by the embodiment of the present invention, it is possible to determine whether the process of each container has abnormal behavior based on the process detection result of the container. For each container, if the process detection result of the container indicates that its process has abnormal behavior, then the existence of container escape risk for the container is used as the real-time escape risk detection result of the container; if the process detection result of the container indicates that its process does not have abnormal behavior, then the absence of container escape risk for the container is used as the real-time escape risk detection result of the container; if the real-time escape risk detection result of the container is that the process of the container has abnormal behavior, then a risk alert is issued for the container; if the real-time escape risk detection result of the container is that the process of the container does not have abnormal behavior, then there is no need to issue a risk alert for the container. The operation of issuing a risk alert for the container may include intercepting the container, issuing an alarm prompt to the staff, and other operations.

[0076] S104: Determine an operation log set corresponding to each container;

[0077] In the method provided by an embodiment of the present invention, for each container, various log data of the container can be collected from various log sources of the container, such as system logs, application logs, and security logs. The raw log data is preprocessed by methods such as data cleaning and data standardization. The preprocessed log data is used as the operation logs corresponding to the container, and the operation logs of the container are combined into an operation log set corresponding to the container. In other words, the operation log set of each container includes multiple groups of operation logs of the container.

[0078] S105: Perform data analysis on the operation log set corresponding to each container to obtain a data analysis result corresponding to each container;

[0079] In the method provided by the embodiments of the present invention, data statistical analysis strategies can be pre-configured based on actual analysis needs, such as various statistical analysis indicators and data trend analysis. For each container's operation log set, data analysis is performed on each operation log in the set using the pre-configured data analysis strategy to obtain corresponding data analysis results. The data analysis results for each container can be the content obtained through data analysis processing, such as various statistical analysis indicators.

[0080] S106: For each container, applying a preset data mining algorithm to perform escape risk identification on the operation log set corresponding to the container, and obtaining a first risk identification result corresponding to the container;

[0081] In the method provided in an embodiment of the present invention, a pre-set data mining algorithm can be used to mine operation logs for abnormal phenomena that indicate container escape behavior. Specifically, the data mining algorithm can be set using data mining techniques such as association rule mining and cluster analysis. For each set of operation logs corresponding to a container, a pre-set data mining algorithm is applied to perform data mining to identify whether the behavior reflected in the operation log set contains container escape behavior, thereby identifying the risk of escape. The identification result is used as the first risk identification result corresponding to the container. It is understood that if data mining determines that the behavior reflected in the operation log set of a container contains abnormal behavior, the presence of abnormal behavior for the container is used as the identification result, indicating that the container has a container escape risk. If data mining determines that the behavior reflected in the operation log set of a container does not contain abnormal behavior, the absence of abnormal behavior for the container is used as the identification result, indicating that the container does not have a container escape risk. In other words, the first risk identification result corresponding to the container can be whether the container has abnormal behavior, which correspondingly indicates whether the container has a container escape risk.

[0082] S107: Determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior;

[0083] In the method provided by the embodiment of the present invention, at least one machine learning model for identifying container escape behavior can be constructed in advance according to actual needs, and the pre-constructed machine learning model can be used as an escape behavior recognition model. When multiple escape behavior recognition models are constructed, each escape behavior recognition model can be constructed by a different machine learning algorithm. It can be understood that each escape behavior recognition model is obtained by model training based on its corresponding machine learning algorithm and training sample set. The training sample set used to train the escape behavior recognition model includes multiple training samples and sample labels for each training sample. The training samples can specifically be operation log samples or indicators extracted based on operation logs. The sample labels are marks that characterize whether there is container escape behavior.

[0084] In the method provided by the embodiment of the present invention, during the process of detecting the risk of container escape, pre-built escape behavior recognition models can be obtained to obtain a model set.

[0085] S108: For each of the containers, apply each of the escape behavior recognition models to perform recognition processing on the operation log set corresponding to the container, obtain an escape behavior recognition result output by the escape behavior recognition model, and use the escape behavior recognition result output by each of the escape behavior recognition models as the second risk recognition result corresponding to the container;

[0086] In the method provided by an embodiment of the present invention, each escape behavior identification model is applied separately to perform data processing on the operation log set of each container, that is, to identify the container's escape behavior. Specifically, for each container, the operation log data required by each escape behavior identification model is obtained from the operation log set corresponding to the container. The operation log data required by each escape behavior identification model is loaded into the input layer of the corresponding escape behavior identification model, so that each escape behavior identification model performs escape behavior identification based on the required operation log data. The escape behavior identification result output by each escape behavior identification model is obtained from its output layer, and each escape behavior identification result is combined to form the second risk identification result corresponding to the container.

[0087] S109: For each of the containers, based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container, a potential escape risk detection result corresponding to the container is generated.

[0088] In the method provided by an embodiment of the present invention, a potential escape risk detection result for each container is determined based on the data analysis results, first risk identification results, and second risk identification results corresponding to each container. For example, for each container, the data analysis results, first risk identification results, and second risk identification results for the container are integrated, and the integrated results are used as the detection details. Simultaneously, a risk score can be assigned based on the container's data analysis results, first risk identification results, and second risk identification results according to a pre-set scoring strategy to obtain a comprehensive score representing the overall escape risk of the container. The detection details and comprehensive score are used as the potential escape risk detection result for the container. The potential escape risk detection result for each container can be presented in the form of a detection report.

[0089] Based on the method provided by the embodiment of the present invention, the process of each container in the cloud-edge collaborative environment is tracked to obtain the process information corresponding to each container; based on the process information corresponding to the container, the process of the container is detected for anomalies to obtain the process detection result corresponding to the container; according to the process detection result corresponding to the container, the real-time escape risk detection result of the container is determined, and according to the real-time escape risk detection result, it is determined whether to issue a risk alarm for the container; the operation log set corresponding to each container is determined; data analysis is performed on the operation log set corresponding to each container to obtain the data analysis result corresponding to each container; a preset data mining algorithm is applied to identify the escape risk of the operation log set corresponding to the container to obtain the first risk identification result corresponding to the container; each pre-built escape behavior identification model is applied to identify the operation log set of the container to obtain the escape behavior identification result output by each escape behavior identification model, and the escape behavior identification result output by each escape behavior identification model is used as the second risk identification result corresponding to the container; based on the data analysis result, the first risk identification result and the second risk identification result corresponding to the container, a potential escape risk detection result corresponding to the container is generated. By applying the method provided by the embodiment of the present invention, in a cloud-edge collaborative environment, the process information of each container can be obtained in real time through process tracking, and the process of each container can be detected for anomalies. From the perspective of whether the process is abnormal, it can be identified whether the container has an escape risk. When it is detected that the container has an escape risk, a risk alert can be issued to the container in real time. In addition, the operation logs of each container can be obtained through log collection, and data analysis, data mining, and machine learning model prediction can be performed based on the operation logs of each container to comprehensively identify whether the operation of the container has a container escape risk. Based on the method provided by the embodiment of the present invention, regardless of whether the operation of the container exceeds the current access rights, a comprehensive evaluation of whether the actual behavior of the container is a container escape behavior can be performed from multiple dimensions based on data reflecting the actual behavior of the container, such as the container process and the container operation log, which is conducive to accurately identifying malicious traffic, timely discovering container escape risks, and improving the security of the network environment.

[0090] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of tracking the process of each container in the cloud-edge collaborative environment and obtaining the process information corresponding to each container mentioned in step S101 includes:

[0091] For each of the containers, perform system call tracing on the process of the container to obtain process call data corresponding to the container;

[0092] In the method provided by the embodiment of the present invention, the ptrace system call or other similar mechanism is applied in each container to track the process of the container, monitor the system calls and other related call operations executed by the process, and use the call data of the process as the process call data corresponding to the container.

[0093] For each container, monitor the resource usage of the container process to obtain resource usage data corresponding to the container;

[0094] In the method provided by the embodiments of the present invention, resource usage and other data of container processes are monitored within each container using the proc file system or other similar mechanisms. Resource usage of processes within the container is used as resource usage data for that container. proc is a virtual file system that provides real-time information about the system and processes. It contains various files and directories, including data about process status, system resource usage, file descriptors opened by processes, kernel parameters, and more.

[0095] For each container, perform a process audit on the process of the container to obtain a process audit log corresponding to the container;

[0096] In the method provided by an embodiment of the present invention, security audits are performed on container processes within each container using the auditd service or other similar mechanisms to obtain audit logs for the container processes. The auditd service is an existing process that records system calls and kernel events and monitors specific file access, process activity, and other content based on pre-configured audit rules.

[0097] For each of the containers, the process call data, resource usage data, and process audit log corresponding to the container are used as the process information corresponding to the container.

[0098] In the method provided by the embodiment of the present invention, the process call data, resource usage data and process audit log corresponding to each container are used as the process information corresponding to each container.

[0099] Based on the method provided in the above embodiment, in the method provided in the embodiment of the present invention, the step S102 mentioned in the embodiment of the present invention includes performing abnormality detection on the process of the container based on the process information corresponding to the container to obtain the process detection result corresponding to the container, including:

[0100] Based on the process call data corresponding to the container, abnormal call behavior detection is performed on the process of the container to obtain the abnormal call behavior detection result corresponding to the container;

[0101] In the method provided by the embodiment of the present invention, the process call data of the container is used to detect whether there are abnormal calls in the process call behavior, such as detecting whether there are malicious processes attempting to attach to normal processes, and the detection result is used as the abnormal call behavior detection result of the container, that is, the abnormal call behavior detection result of the container represents whether the process of the container has abnormal call behavior.

[0102] Based on the resource usage data corresponding to the container, abnormal resource usage behavior detection is performed on the process of the container to obtain the abnormal resource usage behavior detection result corresponding to the container;

[0103] In the method provided by the embodiment of the present invention, the resource usage data of the container is used to detect whether its process has abnormal resource usage, such as detecting whether sensitive file resources are accessed for a long time, and the detection result is used as the abnormal resource usage behavior detection result of the container, that is, the abnormal resource usage behavior detection result of the container represents whether the process of the container has abnormal resource usage behavior.

[0104] Based on the process audit log corresponding to the container, abnormal activity of the container process is identified to obtain abnormal activity monitoring results corresponding to the container;

[0105] In the method provided by an embodiment of the present invention, whether there is abnormal activity in the container process is detected through the process audit log of the container, and the detection result is used as the abnormal activity monitoring result of the container, that is, the abnormal activity monitoring result of the container represents whether there is abnormal activity in the process of the container.

[0106] The abnormal call behavior detection result, the abnormal resource usage behavior detection result and the abnormal activity monitoring result are used as the process detection result corresponding to the container.

[0107] In the method provided by an embodiment of the present invention, for each container, the abnormal call behavior detection results, abnormal resource usage behavior detection results and abnormal activity monitoring results corresponding to the container are used as the process detection results of the container. Subsequently, it can be determined whether to issue a risk alert based on dimensions such as abnormal call behavior, abnormal resource usage behavior and abnormal activity.

[0108] exist Figure 1 Based on the method shown, Figure 2 As shown, in the method provided by the embodiment of the present invention, the process of performing data analysis on the operation log set corresponding to each container mentioned in step S105 to obtain the data analysis result corresponding to each container includes:

[0109] S201: For each operation log set corresponding to the container, extract data from each operation log in the operation log set using a specified field, obtain target log data corresponding to each operation log, and use each target log data as the log data set corresponding to the container;

[0110] In the method provided by the embodiments of the present invention, various log fields can be pre-specified, such as user ID, operation type, IP address, and timestamp. During data analysis, for each container's operation log set, log data corresponding to the specified log fields is extracted from each operation log therein, and the extracted log data is combined to form the log data set corresponding to the container.

[0111] S202: For each container, based on the log data set corresponding to the container, determine multiple characteristic indicators corresponding to the container; the multiple characteristic indicators correspond one-to-one to multiple preset characteristic dimensions;

[0112] In the method provided by the embodiment of the present invention, multiple feature dimensions can be set in advance according to actual needs, such as operation frequency, user activity pattern, abnormal behavior and other dimensions, and the feature analysis strategy corresponding to each feature dimension can be configured. During the data analysis process, the log data corresponding to each feature dimension can be obtained from the log data set of the container, and the log data corresponding to each feature dimension can be processed based on the feature analysis strategy corresponding to each feature dimension. For example, the indicator is calculated according to a predetermined calculation method to obtain the feature indicator corresponding to each feature dimension, and the feature indicator corresponding to each feature dimension is used as the feature indicator corresponding to the corresponding container. It can be understood that the feature indicator corresponding to each feature dimension is the result obtained by processing the corresponding log data based on the feature analysis strategy corresponding to the feature dimension.

[0113] S203: For each container, based on the log data set corresponding to the container, determine multiple statistical indicators corresponding to the container; the multiple statistical indicators correspond one-to-one to multiple preset statistical dimensions;

[0114] In the method provided by the embodiment of the present invention, multiple statistical dimensions, such as the number of operations and error rate, can be pre-set according to actual needs, and the statistical method corresponding to each statistical dimension can be configured. During the data analysis process, the log data corresponding to each statistical dimension can be obtained from the log data set of the container. Based on the statistical method corresponding to each statistical dimension, the log data corresponding to the statistical dimension can be statistically analyzed, and the statistical results can be used as the statistical indicators corresponding to the statistical dimension. The statistical indicators corresponding to each statistical dimension are used as the statistical indicators corresponding to the container.

[0115] S204: For each container, based on the log data set corresponding to the container, perform an operation trend analysis on the container to obtain an operation trend analysis result corresponding to the container;

[0116] In the method provided by the embodiments of the present invention, an operation trend analysis strategy can be pre-configured based on actual needs to analyze the changing trends of container operations, such as the trend of an increase or decrease in operation volume. During the data analysis process, based on the pre-configured operation trend analysis strategy, the log data required for analysis is obtained from the container's log data set. Trend analysis is then performed on the log data based on the operation trend analysis strategy, and the analysis results are used as the operation trend analysis results corresponding to the container.

[0117] S205: For each container, the characteristic indicators corresponding to the container, the statistical indicators corresponding to the container, and the operation trend analysis result are used as the data analysis result corresponding to the container.

[0118] In the method provided by the embodiment of the present invention, the data analysis result of the container is composed of the characteristic indicators corresponding to the container, the statistical indicators and the operation trend analysis result corresponding to the container.

[0119] exist Figure 1 Based on the method shown in FIG. 1 , in the method provided by an embodiment of the present invention, the process of applying a preset data mining algorithm in step S106 to identify the escape risk of the operation log set corresponding to the container and obtaining a first risk identification result corresponding to the container includes:

[0120] Performing association rule mining on the operation log set corresponding to the container to obtain an association rule mining result; the association rule mining result includes an event association relationship between each operation log in the operation log set corresponding to the container;

[0121] In the method provided by the embodiments of the present invention, a data mining algorithm combines association rule mining and cluster analysis. During the data mining process, association rule mining is performed on a collection of container operation logs using pre-set association rules. This identifies the relationships between the various events reflected in the operation logs and generates association rule mining results.

[0122] Perform cluster analysis on the operation log set corresponding to the container to obtain cluster analysis results;

[0123] In the method provided by the embodiment of the present invention, cluster analysis is performed on each operation log in the operation log set based on the similarity of each operation log in the operation log set, that is, each operation log is grouped according to similarity to identify whether there are isolated objects therein, and obtain a cluster analysis result.

[0124] Based on the association rule mining result and the cluster analysis result, anomaly detection is performed on the operation log set corresponding to the container to obtain an anomaly detection result, and the anomaly detection result is used as the first risk identification result corresponding to the container.

[0125] In the method provided by the embodiment of the present invention, the association rule mining results and cluster analysis results are combined to identify anomalies of each operation log in the operation log set. That is, the event association relationship and similarity between each operation log are combined to detect whether there are behaviors that are significantly different from the normal pattern. The detection result is used as the first risk identification result corresponding to the container.

[0126] exist Figure 1 Based on the method shown, Figure 3 As shown, the method provided in the embodiment of the present invention further includes:

[0127] S301: monitoring whether a predetermined operation occurs in the cloud-edge collaborative environment; the predetermined operation is a container creation operation or a container update operation;

[0128] In the method provided by an embodiment of the present invention, a security monitoring service is deployed to monitor whether container creation operations or container update operations occur in the cloud-edge collaborative environment, that is, to monitor whether new containers are created in the cloud-edge collaborative environment or whether existing containers are updated.

[0129] S302: When the predetermined operation occurs in the cloud-edge collaborative environment, determine a target container corresponding to the predetermined operation;

[0130] In the method provided by an embodiment of the present invention, when a predetermined operation, namely a container creation operation or a container update operation, is monitored, the container associated with the current operation is used as the target container. For example, if a container creation operation is monitored, the newly created container is used as the target container; if a container update operation is monitored, the container currently being updated is used as the target container.

[0131] S303: Determine whether the target container is a container in a preset whitelist;

[0132] In the method provided by the embodiment of the present invention, a whitelist can be pre-configured. For containers whose operations are to be ignored, the corresponding container names can be configured in the whitelist. When a predetermined operation is monitored, the container name of the current target container can be compared with the container names in the preset whitelist. If the container name of the target container matches any container name in the whitelist, the target container is considered to be a container in the whitelist. If the container name of the target container is different from any container name in the whitelist, the target container is considered not to be a container in the whitelist.

[0133] S304: If the target container is not a container in the whitelist, determine whether the current permission of the target container is within a preset permission range;

[0134] In the method provided by an embodiment of the present invention, if the target container is not a container in the whitelist, the current permission information of the target container is obtained from the container configuration data of the target container, and it is determined whether the current permission of the target container is within the preset permission range based on the current permission information of the target container.

[0135] In the method provided by the embodiment of the present invention, if the target container is a container in the whitelist, the current processing process can be terminated without further judgment.

[0136] S305: If the current permission of the target container is not within the permission range, perform an early warning operation on the target container.

[0137] In the method provided by an embodiment of the present invention, if the current permissions of the target container are not within the preset permission range, an early warning process is performed on the target container, such as terminating the container or triggering an alarm. If the current permissions of the target container are within the preset permission range, no action is required.

[0138] Based on the method provided by the embodiment of the present invention, it is possible to detect in real time whether the permissions of newly created containers and updated containers are reasonable, and to promptly issue warning operations to containers whose permissions exceed the scope, which is conducive to preventing the risk of container escape.

[0139] exist Figure 1 On the basis of the method shown, the method provided in the embodiment of the present invention further includes:

[0140] Performing a security scan on each of the containers to obtain a security scan result corresponding to each of the containers;

[0141] The method provided by the embodiments of the present invention can periodically perform security scans on each container in the cloud-edge collaborative environment. Specifically, vulnerability scanning and security testing can be performed on the container image to obtain security scan results for each container. The security scan results of each container indicate whether the container has security risks.

[0142] For each of the containers, it is determined whether to perform an early warning operation on the container according to the security scan result corresponding to the container.

[0143] In the method provided in an embodiment of the present invention, if the security scan result corresponding to a container indicates that the container presents a security risk, an alert operation is performed on the container. If the security scan result indicates that the container does not present a security risk, no alert operation is required for the container. The alert operation can be configured as needed, and the specific operation can be the same as or different from the alert operation described in step S305 in the previous embodiment.

[0144] Based on the method provided in the embodiment of the present invention, security scans can be performed on all containers in the cloud-edge collaborative environment on a regular basis, which is conducive to timely discovery of security risks such as container vulnerabilities for risk prevention.

[0145] To better illustrate the method provided by the embodiment of the present invention, based on the methods provided by the previous embodiments and in combination with actual application scenarios, the embodiment of the present invention provides another method for detecting container escape risks in a cloud-edge collaborative environment. Next, the method provided by the embodiment of the present invention is briefly described in combination with actual service implementation. The specific implementation process of the method provided by the embodiment of the present invention mainly includes:

[0146] Create an isolated container network space;

[0147] In an embodiment of the present invention, an isolated container network space is created in a cloud-edge collaborative environment, and a unique identifier is assigned to each container. A separately isolated container network space can enhance security, and an isolated container network can prevent malicious code or attacks from spreading from one container to another. Each container has its own network namespace and IP address, port space, network policy, etc., so the communication between containers can be better controlled and monitored, which also helps to avoid resource competition between containers and improve the overall system resource utilization and performance. Specifically, using virtual LAN technology, an independent virtual LAN is created for each container at the physical network layer. Using network namespace technology, an independent network stack is created for each container at the operating system layer. Using software-defined network technology, a virtual network topology is created for each container at the application layer.

[0148] Deploy security proxy services;

[0149] In an embodiment of the present invention, a security proxy service is deployed in a cloud-edge collaborative environment. The service is responsible for intercepting and inspecting network communications between containers, and filtering and forwarding network traffic according to preset security policies. The security proxy service can serve as the front end of the firewall to control and monitor traffic in and out of the network. It can filter and block malicious traffic based on set policies and rules, thereby enhancing network security, and can also be used to detect and mitigate distributed denial of service (DDoS) attacks. It can identify abnormal traffic patterns and take measures to filter or block malicious traffic to ensure normal service availability. The specific implementation of the security proxy service mainly includes:

[0150] Using transparent proxy technology, a global proxy server is set up in the cloud-edge collaborative environment. By modifying the routing table or firewall rules, all network communications between containers are forced to be forwarded to the proxy server. The proxy server can receive client requests, forward them directly to the target server, and return the response to the client, usually without modifying the request or response content.

[0151] Using non-transparent proxy technology, a local proxy server is set up in the cloud-edge collaborative environment. By modifying the container's internal configuration files or environment variables, network communications between specified containers are actively forwarded to the proxy server. After receiving the request, the proxy server may modify the request or response content, then forward the request to the target server and ultimately return the response to the client. This proxy server can be used for content filtering, caching, or load balancing.

[0152] Using dynamic proxy technology, a distributed proxy service is set up in the cloud-edge collaborative environment. By dynamically injecting or removing the corresponding proxy module within the container, network communications between containers that need to be monitored or controlled are forwarded to the proxy service in real time. The proxy service can dynamically adjust its behavior based on different conditions (such as request content, load, time, etc.). For example, it may select different backend servers based on the type of request.

[0153] Deploy a security monitoring service;

[0154] In an embodiment of the present invention, a security monitoring service is deployed in a cloud-edge collaborative environment. This service is responsible for monitoring process activities within the container and performing detection and alarm according to preset security rules. The security monitoring service can monitor and detect security events and abnormal activities in the system and network in real time, including but not limited to malware activities, unauthorized access attempts, abnormal traffic patterns, login failures, abnormal file access, etc., and can promptly issue alarms for abnormal events. The specific implementation of the security monitoring service mainly includes:

[0155] Using process tracking technology, such as the ptrace system call or other similar mechanisms within the container, processes running inside the container can be tracked and intercepted, and system calls or other sensitive operations performed by them can be detected and alerted. Ptrace is a system call that allows one process to control the execution of another. Ptrace can be used to monitor whether malicious processes attempt to attach to other processes to determine whether an alert is needed.

[0156] Using process monitoring technology, the proc file system or other similar mechanisms within the container can monitor and sample processes running within the container, detecting and alerting on resource usage or other abnormal behavior. proc is a virtual file system that provides real-time information about the system and processes. It contains various files and directories, including information about process status, system resource usage, file descriptors opened by processes, kernel parameters, and more. By collecting this information, you can monitor proc access and detect potential security issues, such as whether a process is accessing sensitive file resources. Regularly checking process information in the proc file system can identify abnormal processes or resource usage patterns.

[0157] Using process auditing technology, use the auditd service or other similar mechanisms inside the container to audit and record the processes running inside the container, and detect and alarm the logs or other suspicious events generated by them. Auditd is a user space daemon of the audit subsystem of the Linux kernel. It is responsible for recording system calls and kernel events for security auditing. Audit rules can be configured by editing the configuration file. For example, rules can be set to monitor access to specific files, the activities of specific processes, and so on. After the service performs a security audit on the process based on the audit rules, the corresponding audit log can be generated. Tools such as ausearch and aureport can be used to query and analyze audit logs to monitor the security status of the system and identify abnormal activities.

[0158] Deploy a security audit service;

[0159] In this embodiment of the present invention, a security audit service is deployed in a cloud-edge collaborative environment. This service is responsible for recording operation logs inside and outside the container and analyzing and evaluating them according to preset security standards. The security audit service can be used to analyze and audit system and network logs, detect abnormal behavior and security incidents, and track and analyze possible security threats and attack patterns. Through log auditing, potential security issues can be quickly identified and countermeasures can be taken in a timely manner. The specific implementation of the security audit service mainly includes:

[0160] Using log collection technology, a log server is set up in the cloud-edge collaborative environment. By configuring log sources or log agents inside and outside the container, all container-related operation logs are collected to the log server.

[0161] Using log analysis technology, a log analyzer is set up in a cloud-edge collaborative environment. By applying data mining, machine learning, artificial intelligence and other technologies, the collected operation logs are analyzed and evaluated, and corresponding scores or reports are generated based on preset security standards.

[0162] Using log display technology, a log displayer is set up in the cloud-edge collaborative environment. By using visualization, interactive, real-time and other technologies, the log analysis results are displayed and presented, and corresponding query, filtering, sorting and other functions are provided.

[0163] The log analysis process mainly includes:

[0164] Data collection and preprocessing: Collect data from various log sources (such as system logs, application logs, and security logs). Clean the raw log data, such as addressing missing values, duplicate records, and inconsistent data formats, to ensure data quality. Standardize the cleaned data and convert it to a consistent format, such as a unified timestamp format.

[0165] Feature data extraction: Extract key fields from logs, such as user ID, operation type, IP address, timestamp, etc.

[0166] Feature analysis: Based on key fields extracted from logs, calculate features such as operation frequency, user activity patterns, and abnormal behaviors.

[0167] Basic statistical analysis: Based on the key fields extracted from the log, calculate the basic statistical indicators of the log, such as the number of operations and error rate.

[0168] Trend analysis: Identify long-term trends and patterns, such as growth or decline in operation volume, based on key fields in the logs.

[0169] Apply data mining techniques: Utilize association rule mining to discover relationships between different events in the log; use cluster analysis to group log entries by similarity and identify anomalous groups. Combine association rule mining and cluster analysis results to perform anomaly detection and identify behaviors that differ significantly from normal patterns and may indicate security threats.

[0170] Apply machine learning technology: Use multiple machine learning algorithms to build models for identifying evasive behaviors. For example, use labeled security log samples to train classification models (such as decision trees and support vector machines) to identify potential security threats. Use labeled log samples to train unsupervised learning models (such as isolation forests and principal component analysis) to detect abnormal behavior. Use labeled log text samples and natural language processing (NLP) technology to train models that identify security-related events or warnings. Based on log data samples, train deep learning models (such as convolutional neural networks and recurrent neural networks) to process complex log data and discover advanced patterns and anomalies. Use cross-validation and test sets to evaluate the accuracy and effectiveness of each model. During the log analysis process, apply each model to analyze the current log data.

[0171] Security score: Based on preset security standards (such as compliance and risk level), the security score is calculated using the above analysis results. A weighted algorithm can be used to combine various indicators to generate a score.

[0172] Report Generation: Automatically generate reports containing analysis results, anomalies, trend charts, and security recommendations. Reports can include: Summary (overview of log analysis), Detailed Analysis (detailed description of key findings and anomalies), Security Score (based on pre-set criteria), and Recommendations (improvement measures and risk mitigation suggestions).

[0173] Deploy secure monitoring services;

[0174] In an embodiment of the present invention, a security monitoring service is deployed in a cloud-edge collaborative environment. The service is responsible for monitoring newly created or updated containers in the environment in real time, and determining whether to issue an alarm based on whether the container complies with security specifications. The security monitoring service can monitor newly created or updated containers, and automatically detect whether the permissions of the container are reasonable. If the permissions are too large, the container can be directly terminated or an alarm can be triggered according to the configured monitoring policy. The monitoring service can also regularly perform vulnerability scans and security checks on container images. It can identify known vulnerabilities and weaknesses in the container, and help to promptly repair and strengthen the security protection of the container. The specific implementation of the security monitoring service mainly includes:

[0175] Install and deploy a listener in the cloud-edge collaborative environment to monitor the creation and update of containers in the environment in real time. Once a container change is detected, the container is checked for permissions. If it is detected that the corresponding permissions of the container are too large or there are some configurations that may affect the security of the host, the container is terminated. Regarding permissions, you can query the SecurityContext configuration content of the container Pod to query the maximum permission range in the container, or you can query the ServiceAccount information associated with the container Pod to query the permission range of the Kubernetes cluster resources that can be manipulated in the container.

[0176] The monitoring service can also be set to scan all containers regularly, and if any problems are found, the container can be terminated directly.

[0177] The listener service allows for whitelisting, allowing certain containers greater permissions. This can be done by tagging specific containers with specific labels, causing the listener service to ignore those containers when scanning for listeners. Whitelisting can also be configured by specifying container names.

[0178] The method provided by the embodiment of the present invention isolates the container network and uses a network security agent to allow the tenant's container to use only its own network namespace and cannot directly access the network where the host machine is located. Through security monitoring, security auditing, security monitoring and other services, behavioral analysis, interception, alarm and other operations are performed on the container cluster environment, which is conducive to timely detection of container escape risks and reduces the possibility of host machine damage. It can effectively prevent containers from escalating privileges and escaping through dangerous configurations, dangerous mounting, related program vulnerabilities or kernel vulnerabilities, thereby improving the security of containers in the cloud-edge collaborative environment.

[0179] and Figure 1 Corresponding to the method for detecting container escape risk in a cloud-edge collaborative environment shown in FIG, an embodiment of the present invention further provides a device for detecting container escape risk in a cloud-edge collaborative environment, for detecting Figure 1 The specific implementation of the method shown in is shown in the structural diagram. Figure 4 Shown, including:

[0180] The process tracking unit 401 is used to track the process of each container in the cloud-edge collaborative environment and obtain the process information corresponding to each container;

[0181] The process detection unit 402 is configured to perform an anomaly detection on the process of each container based on the process information corresponding to the container, and obtain a process detection result corresponding to the container;

[0182] The real-time alarm unit 403 is configured to determine, for each container, a real-time escape risk detection result of the container based on the process detection result corresponding to the container, and determine whether to issue a risk alarm for the container based on the real-time escape risk detection result;

[0183] A first determining unit 404 is configured to determine an operation log set corresponding to each container;

[0184] The data analysis unit 405 is configured to perform data analysis on the operation log set corresponding to each container to obtain a data analysis result corresponding to each container;

[0185] The data mining unit 406 is configured to apply a preset data mining algorithm to each container to identify the escape risk of the operation log set corresponding to the container, and obtain a first risk identification result corresponding to the container;

[0186] The second determining unit 407 is configured to determine a model set, wherein the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for recognizing escape behavior;

[0187] The risk identification unit 408 is configured to apply each of the escape behavior identification models to each of the containers to perform identification processing on the operation log set corresponding to the container, obtain an escape behavior identification result output by the escape behavior identification model, and use the escape behavior identification result output by each of the escape behavior identification models as a second risk identification result corresponding to the container;

[0188] The third determining unit 409 is configured to generate, for each container, a potential escape risk detection result corresponding to the container based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

[0189] By applying the device provided by the embodiment of the present invention, in a cloud-edge collaborative environment, the process information of each container can be obtained in real time through process tracking, and the process of each container can be detected for anomalies. From the perspective of whether the process is abnormal, it can be identified whether the container has an escape risk. When it is detected that the container has an escape risk, a risk alert can be issued to the container in real time. In addition, the operation logs of each container can be obtained through log collection, and data analysis, data mining, and machine learning model prediction can be performed based on the operation log of each container to comprehensively identify whether the operation of the container has a container escape risk. Based on the device provided by the embodiment of the present invention, regardless of whether the operation of the container exceeds the current access rights, a comprehensive evaluation of whether the actual behavior of the container is a container escape behavior can be performed from multiple dimensions based on data reflecting the actual behavior of the container, such as the container process and the container operation log, which is conducive to accurately identifying malicious traffic, timely discovering container escape risks, and improving the security of the network environment.

[0190] exist Figure 4 Based on the device shown, the device provided by the embodiment of the present invention can be further expanded into multiple units. The functions of each unit can be found in the descriptions of the various embodiments provided in the previous text for the method for detecting container escape risks in a cloud-edge collaborative environment, and no further examples will be given here.

[0191] An embodiment of the present invention also provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned method for detecting container escape risks in the cloud-edge collaborative environment.

[0192] The embodiment of the present invention further provides an electronic device, the structural diagram of which is shown in FIG. Figure 5 As shown, it specifically includes a memory 501 and one or more instructions 502, wherein the one or more instructions 502 are stored in the memory 501 and are configured to be executed by one or more processors 503 to perform the following operations:

[0193] Track the process of each container in the cloud-edge collaborative environment to obtain the process information corresponding to each container;

[0194] For each of the containers, based on the process information corresponding to the container, perform anomaly detection on the process of the container to obtain a process detection result corresponding to the container;

[0195] For each of the containers, determining a real-time escape risk detection result of the container based on the process detection result corresponding to the container, and determining whether to issue a risk alert for the container based on the real-time escape risk detection result;

[0196] Determine an operation log set corresponding to each container;

[0197] Performing data analysis on the operation log set corresponding to each container to obtain data analysis results corresponding to each container;

[0198] For each of the containers, applying a preset data mining algorithm to perform escape risk identification on the operation log set corresponding to the container, and obtaining a first risk identification result corresponding to the container;

[0199] Determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior;

[0200] For each of the containers, applying each of the escape behavior recognition models to perform recognition processing on the operation log set corresponding to the container, obtaining an escape behavior recognition result output by the escape behavior recognition model, and using the escape behavior recognition result output by each of the escape behavior recognition models as the second risk recognition result corresponding to the container;

[0201] For each of the containers, a potential escape risk detection result corresponding to the container is generated based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

[0202] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple. For relevant parts, refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0203] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0204] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting container escape risks in a cloud-edge collaborative environment, characterized in that: include: Track the process of each container in the cloud-edge collaborative environment to obtain the process information corresponding to each container; For each of the containers, based on the process information corresponding to the container, perform anomaly detection on the process of the container to obtain a process detection result corresponding to the container; For each of the containers, determining a real-time escape risk detection result of the container based on the process detection result corresponding to the container, and determining whether to issue a risk alert for the container based on the real-time escape risk detection result; Determine an operation log set corresponding to each container; Performing data analysis on the operation log set corresponding to each container to obtain data analysis results corresponding to each container; For each of the containers, applying a preset data mining algorithm to perform escape risk identification on the operation log set corresponding to the container, and obtaining a first risk identification result corresponding to the container; Determine a model set; the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for identifying escape behavior; For each of the containers, applying each of the escape behavior recognition models to perform recognition processing on the operation log set corresponding to the container, obtaining an escape behavior recognition result output by the escape behavior recognition model, and using the escape behavior recognition result output by each of the escape behavior recognition models as the second risk recognition result corresponding to the container; For each of the containers, a potential escape risk detection result corresponding to the container is generated based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

2. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: Tracking the process of each container in the cloud-edge collaborative environment to obtain process information corresponding to each container includes: For each of the containers, perform system call tracing on the process of the container to obtain process call data corresponding to the container; For each container, monitor the resource usage of the container process to obtain resource usage data corresponding to the container; For each container, perform a process audit on the process of the container to obtain a process audit log corresponding to the container; For each of the containers, the process call data, resource usage data, and process audit log corresponding to the container are used as the process information corresponding to the container.

3. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 2 is characterized in that: The performing abnormality detection on the process of the container based on the process information corresponding to the container to obtain the process detection result corresponding to the container includes: Based on the process call data corresponding to the container, abnormal call behavior detection is performed on the process of the container to obtain the abnormal call behavior detection result corresponding to the container; Based on the resource usage data corresponding to the container, abnormal resource usage behavior detection is performed on the process of the container to obtain the abnormal resource usage behavior detection result corresponding to the container; Based on the process audit log corresponding to the container, identify abnormal activities of the container process and obtain abnormal activity monitoring results corresponding to the container; The abnormal call behavior detection result, the abnormal resource usage behavior detection result and the abnormal activity monitoring result are used as the process detection result corresponding to the container.

4. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: The performing data analysis on the operation log set corresponding to each container to obtain the data analysis result corresponding to each container includes: For each operation log set corresponding to the container, extract data from each operation log in the operation log set using a specified field, obtain target log data corresponding to each operation log, and use each target log data as the log data set corresponding to the container; For each of the containers, based on the log data set corresponding to the container, determining a plurality of characteristic indicators corresponding to the container; the plurality of characteristic indicators corresponding to the plurality of preset characteristic dimensions one by one; For each of the containers, based on the log data set corresponding to the container, determining a plurality of statistical indicators corresponding to the container; the plurality of statistical indicators corresponding to the plurality of preset statistical dimensions; For each of the containers, performing an operation trend analysis on the container based on a log data set corresponding to the container to obtain an operation trend analysis result corresponding to the container; For each container, each characteristic index corresponding to the container, each statistical index corresponding to the container, and an operation trend analysis result are used as the data analysis result corresponding to the container.

5. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: The applying a preset data mining algorithm to perform escape risk identification on the operation log set corresponding to the container to obtain a first risk identification result corresponding to the container includes: Performing association rule mining on the operation log set corresponding to the container to obtain an association rule mining result; the association rule mining result includes an event association relationship between each operation log in the operation log set corresponding to the container; Perform cluster analysis on the operation log set corresponding to the container to obtain cluster analysis results; Based on the association rule mining result and the cluster analysis result, anomaly detection is performed on the operation log set corresponding to the container to obtain an anomaly detection result, and the anomaly detection result is used as the first risk identification result corresponding to the container.

6. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: Also includes: Monitoring whether a predetermined operation occurs in the cloud-edge collaborative environment; the predetermined operation is a container creation operation or a container update operation; When the predetermined operation occurs in the cloud-edge collaborative environment, determining a target container corresponding to the predetermined operation; Determine whether the target container is a container in a preset whitelist; If the target container is not a container in the whitelist, determining whether the current permission of the target container is within a preset permission range; If the current permission of the target container is not within the permission range, a warning operation is performed on the target container.

7. The method for detecting container escape risk in a cloud-edge collaborative environment according to claim 1 is characterized in that: Also includes: Performing a security scan on each of the containers to obtain a security scan result corresponding to each of the containers; For each of the containers, it is determined whether to perform an early warning operation on the container according to the security scan result corresponding to the container.

8. A device for detecting container escape risks in a cloud-edge collaborative environment, characterized in that: include: A process tracking unit is used to track the process of each container in the cloud-edge collaborative environment and obtain process information corresponding to each container; a process detection unit, configured to perform an anomaly detection on the process of each container based on the process information corresponding to the container, and obtain a process detection result corresponding to the container; A real-time alarm unit is configured to determine, for each container, a real-time escape risk detection result of the container based on a process detection result corresponding to the container, and determine whether to issue a risk alarm for the container based on the real-time escape risk detection result; A first determining unit, configured to determine a set of operation logs corresponding to each of the containers; A data analysis unit, configured to perform data analysis on the operation log set corresponding to each container, and obtain a data analysis result corresponding to each container; a data mining unit configured to apply a preset data mining algorithm to each of the containers to identify the escape risk of the operation log set corresponding to the container, and obtain a first risk identification result corresponding to the container; A second determining unit is configured to determine a model set, wherein the model set includes at least one pre-built escape behavior recognition model; each of the escape behavior recognition models is a machine learning model for recognizing escape behavior; a risk identification unit configured to apply each of the escape behavior identification models to each of the containers, perform identification processing on the operation log set corresponding to the container, obtain an escape behavior identification result output by the escape behavior identification model, and use the escape behavior identification result output by each of the escape behavior identification models as a second risk identification result corresponding to the container; The third determining unit is configured to generate, for each of the containers, a potential escape risk detection result corresponding to the container based on the data analysis result corresponding to the container, the first risk identification result corresponding to the container, and the second risk identification result corresponding to the container.

9. A storage medium, characterized in that: The storage medium includes stored instructions, wherein, when the instructions are executed, the device where the storage medium is located is controlled to execute the method for detecting container escape risks in a cloud-edge collaborative environment as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes a memory and one or more instructions, wherein one or more instructions are stored in the memory and are configured to be executed by one or more processors to implement the method for detecting container escape risks in a cloud-edge collaborative environment as described in any one of claims 1 to 7.

Images