A container security protection method

Abstract

The present invention discloses a container security protection method, which belongs to the technical field of container security protection. The method first collects a system call sequence of a container for system resources in a safe state, and preprocesses the system call sequence to obtain the preprocessed system call sequence, then uses a neural network model to build a state prediction model, and uses the preprocessed system call sequence to train the state prediction model, so that the trained state prediction model can be used to monitor subsequent real-time system call sequences, thereby realizing monitoring of system function calls of the container during operation, realizing dynamic monitoring of the container, and being able to effectively detect unknown attack behaviors.

Description

Technical Field

[0001] The present invention belongs to the technical field of container safety protection, and in particular relates to a container safety protection method. Background Art

[0002] With the rapid development of the Internet, cloud computing has been widely used in various industries. Cloud computing is a technology that uses the Internet to store and manage data on remote servers and then access data through the Internet. Cloud resources can be private or public, and any Internet user can purchase or use public cloud resources. Docker container is one of the main products of cloud computing virtualization technology, which has promoted cloud computing from the era of virtual machines to the era of containers. Docker container is a lightweight virtualization packaging and software delivery tool that enables developers to package applications into images in a simple way, and package the application source code with the operating system, libraries and dependencies required to run the code in any environment into images and deliver them to users in a standardized executable component.

[0003] In the prior art, in order to protect the safe operation of containers, a static security detection method of images based on vulnerability scanning is often used to achieve container security protection. Although this method has a high accuracy rate, it can only monitor known attack behaviors and cannot effectively respond to unknown attack behaviors, making it impossible to effectively guarantee container security. Summary of the invention

[0004] The present invention provides a container security protection method to solve the technical problem that the existing method can only monitor known attack behaviors but cannot effectively deal with unknown attack behaviors, so that the container security cannot be effectively guaranteed.

[0005] A container security protection method, comprising:

[0006] Collecting a system call sequence of a container for a system resource in a safe state, and preprocessing the system call sequence to obtain a preprocessed system call sequence; wherein the system call sequence includes a plurality of system call functions;

[0007] A state prediction model is constructed by using a neural network model, and the state prediction model is trained by using the system call sequence after the preprocessing to obtain a trained state prediction model;

[0008] The first real-time system call sequence of the container during operation is collected, and the real-time system call sequence is used as supporting data, and the trained state prediction model is used to obtain the predicted system call sequence;

[0009] After collecting the first real-time system call sequence, collecting a second real-time system call sequence corresponding to the predicted system call sequence, and determining a container security monitoring result according to the predicted system call sequence and the second real-time system call sequence;

[0010] When the container safety monitoring result is that the container is operating abnormally, a container abnormality warning message is generated, and the container abnormality warning message is transmitted to a device or system designated by the staff.

[0011] In a possible implementation, the method further includes: when the container safety monitoring result indicates that the container is operating abnormally, executing a preset container safety protection measure.

[0012] In a possible implementation, collecting a system call sequence of a container for a system resource in a safe state and preprocessing the system call sequence to obtain a preprocessed system call sequence includes:

[0013] Collect the system call sequence of the container for system resources in a safe state;

[0014] The TF-IDF score of each system call sequence in the corpus is obtained, and the system call sequences whose TF-IDF scores are lower than a preset score threshold are removed to obtain the system call sequences after preprocessing.

[0015] In a possible implementation, a neural network model is used to construct a state prediction model, including: using an LSTM neural network model to construct a state prediction model.

[0016] In a possible implementation, the state prediction model is trained using the preprocessed system call sequence to obtain the trained state prediction model, including:

[0017] Based on the preprocessed system call sequence, cutting a plurality of system call subsequences with a length of N, and taking the next system call function of the system call subsequence as the expected label;

[0018] Initializing the hyperparameters of the state prediction model to obtain multiple hyperparameter sequences; wherein any two hyperparameter sequences are different from each other;

[0019] For any hyperparameter sequence, after applying the hyperparameter sequence to the state prediction model, the system call subsequence is used as input and combined with the expected label to obtain the fitness value corresponding to the hyperparameter sequence;

[0020] According to the fitness values ​​corresponding to the hyperparameter sequences, the optimal hyperparameter sequence with the best position in the solution space and the worst hyperparameter sequence with the worst position are determined;

[0021] According to the optimal hyperparameter sequence and the worst hyperparameter sequence, an adaptive multi-strategy fusion search method is used to search the hyperparameter sequence to obtain a hyperparameter sequence after a primary search;

[0022] For the hyperparameter sequence after the first-level search, a multi-sequence information fusion method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the second-level search;

[0023] For the hyperparameter sequence after the secondary search, a spiral guided search method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the tertiary search;

[0024] Repeat the first-level search, the second-level search, and the third-level search until the training end condition is met, re-determine the optimal hyperparameter sequence according to the hyperparameter sequence after the third-level search, and after decoding the optimal hyperparameter sequence, apply it to the state prediction model to obtain the trained state prediction model.

[0025] In a possible implementation, according to the optimal hyperparameter sequence and the worst hyperparameter sequence, an adaptive multi-strategy fusion search method is used to search the hyperparameter sequence to obtain a hyperparameter sequence after a primary search, including:

[0026] Determine the adaptive search radius according to the current training times;

[0027] For each hyperparameter sequence, based on the adaptive search radius, determine the adjacent hyperparameter sequences within the search range of the hyperparameter sequence;

[0028] Performing information exchange between the hyperparameter sequence and all adjacent hyperparameter sequences of the hyperparameter sequence to obtain a first information exchange item;

[0029] Performing information fusion on all adjacent hyperparameter sequences of the hyperparameter sequence to obtain a first information fusion item;

[0030] According to the optimal hyperparameter sequence, optimally guiding the hyperparameter sequence to obtain a first guided item;

[0031] According to the worst hyperparameter sequence, performing exclusion bootstrapping on the hyperparameter sequence to obtain a second bootstrapping item;

[0032] According to the first information exchange item, the first information fusion item, the first guidance item and the second guidance item, a search speed memory strategy is adopted to obtain the update speed of the hyperparameter sequence;

[0033] Based on the update speed of the hyperparameter sequence, the hyperparameter sequence is searched to obtain a hyperparameter sequence after a first-level search.

[0034] In a possible implementation, determining the adaptive search radius according to the current training times includes:

[0035] Determine the Euclidean distance between the upper limit of the hyperparameter and the lower limit of the hyperparameter, and after attenuating the Euclidean distance, obtain a minimum search radius;

[0036] After using the time function that increases with the number of training times to decay the Euclidean distance, the search radius increment is obtained;

[0037] An adaptive search radius is determined according to the minimum search radius and the search radius increment.

[0038] In a possible implementation, for the hyperparameter sequence after the primary search, a multi-sequence information fusion method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the secondary search, including:

[0039] For any hyperparameter sequence after the first-level search, the fusion control factor is used to fuse the information of the hyperparameter sequence with other hyperparameter sequences, and then the Euclidean distance between the hyperparameter sequence and other hyperparameter sequences is used for processing to obtain the unit fusion information of each hyperparameter encoding corresponding to each other hyperparameter sequence;

[0040] After merging the unit fusion information of each other hyperparameter sequence, the adaptive adjustment coefficient is used to adjust it to obtain the comprehensive information fusion item;

[0041] Based on the optimal hyperparameter sequence, a comprehensive information fusion item is used to perform a search to obtain a hyperparameter sequence after a secondary search.

[0042] In a possible implementation, for the hyperparameter sequence after the secondary search, a spiral guided search method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the tertiary search, including:

[0043] For the optimal hyperparameter sequence, nonlinear coefficients are used for adjustment to determine the basic position in the optimal direction;

[0044] For any hyperparameter sequence after the secondary search, the cosine function and the exponential function are used to exchange information between the hyperparameter sequence and the optimal hyperparameter sequence to determine the spiral update amount;

[0045] Based on the basic position in the optimal direction, the spiral update amount is used to update and obtain the hyperparameter sequence after the three-level search.

[0046] In a possible implementation, determining a container security monitoring result according to the predicted system call sequence and the second real-time system call sequence includes:

[0047] Obtaining a cosine similarity between the predicted system call sequence and the second real-time system call sequence;

[0048] It is determined whether the cosine similarity between the predicted system call sequence and the second real-time system call sequence is less than a preset similarity threshold; if so, it is determined that the container security monitoring result is that the container is operating abnormally; otherwise, it is determined that the container security monitoring result is that the container is operating normally.

[0049] The present invention provides a container security protection method, which first collects the system call sequence of the container for system resources in a safe state, and preprocesses the system call sequence to obtain the preprocessed system call sequence, then uses a neural network model to build a state prediction model, and uses the preprocessed system call sequence to train the state prediction model, so that the trained state prediction model can be used to monitor subsequent real-time system call sequences, thereby realizing monitoring of system function calls of the container during operation, realizing dynamic monitoring of the container, and being able to effectively detect unknown attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0051] Figure 1 A flowchart of a container security protection method provided by an embodiment of the present invention.

[0052] The above drawings have shown clear embodiments of the present invention, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present invention in any way, but to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0053] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0054] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0055] like Figure 1 As shown, an embodiment of the present invention provides a container security protection method, including:

[0056] S101, collecting a system call sequence of a container for a system resource in a safe state, and preprocessing the system call sequence to obtain a preprocessed system call sequence; wherein the system call sequence includes a plurality of system call functions;

[0057] All hardware resources and some software resources (such as I / O resources, network resources, CPU (Central Processing Unit / Processor, central processing unit) and other resources) required for the application in the container to run need to be requested from the host kernel through system calls for use. The embodiment of the present invention abstracts the process of an application applying for certain resources from the kernel through a system call interface as an application using language requests to communicate with the system kernel, and compares the system call request sequence issued by the application to a natural language. Each system call function is compared to a word in a natural language, and each system call sequence is compared to a sentence in a natural language, so that prediction and exception analysis can be achieved.

[0058] Optionally, the ADFA-LD dataset can be used as a sequence of system calls to system resources by the container in a safe state, thereby achieving data learning.

[0059] S102, constructing a state prediction model using a neural network model, and training the state prediction model using the system call sequence after the preprocessing to obtain a trained state prediction model;

[0060] Since there is a time correlation between different system calls, a neural network model with time prediction capability can be used to construct a state prediction model. However, the state prediction model cannot be used directly after construction, so it is necessary to train the state prediction model using the system call sequence after the preprocessing.

[0061] Optionally, since the system call functions in each system call sequence may be natural languages, they can be encoded using one-hot encoding and then used as inputs of the state prediction model.

[0062] In order to facilitate data processing, various system call functions can also be mapped to numerical values ​​and normalized to reduce data complexity.

[0063] S103, collecting the first real-time system call sequence during the operation of the container, and using the real-time system call sequence as supporting data, using the trained state prediction model to obtain a predicted system call sequence;

[0064] For example, the length of data to be predicted is M, and the first real-time system call sequence with a data length of N is collected. After the first real-time system call sequence is input into the trained state prediction model, the corresponding prediction system call function at the N+1th time point is obtained; then the prediction system call functions corresponding to the 2nd to Nth time points in the first real-time system call sequence are reconstructed as input to obtain the prediction system call function corresponding to the N+2th time point; and so on, until the number of obtained prediction system call functions is M, and the prediction system call sequence is obtained.

[0065] S104, after collecting the first real-time system call sequence, collecting a second real-time system call sequence corresponding to the predicted system call sequence, and determining a container security monitoring result according to the predicted system call sequence and the second real-time system call sequence;

[0066] Whether the container operation process is abnormal can be determined by determining the similarity between the predicted system call sequence and the second real-time system call sequence.

[0067] S105. When the container safety monitoring result is that the container is operating abnormally, a container abnormality warning message is generated, and the container abnormality warning message is transmitted to a device or system designated by a staff member.

[0068] The present invention provides a container security protection method, which first collects the system call sequence of the container for system resources in a safe state, and preprocesses the system call sequence to obtain the preprocessed system call sequence, then uses a neural network model to build a state prediction model, and uses the preprocessed system call sequence to train the state prediction model, so that the trained state prediction model can be used to monitor subsequent real-time system call sequences, thereby realizing monitoring of system function calls of the container during operation, realizing dynamic monitoring of the container, and being able to effectively detect unknown attack behaviors.

[0069] In a possible implementation, the method further includes: when the container safety monitoring result indicates that the container is operating abnormally, executing a preset container safety protection measure.

[0070] For example, the container security protection measure may be to stop the operation of an abnormal container to prevent the server from being hacked. However, it is worth noting that this protection measure is only an example, and other security protection measures may also be used to protect the security of the container.

[0071] In a possible implementation, collecting a system call sequence of a container for a system resource in a safe state and preprocessing the system call sequence to obtain a preprocessed system call sequence includes:

[0072] Collect the system call sequence of the container for system resources in a safe state;

[0073] The TF-IDF (Term Frequency-Inverse Document Frequency) score of each system call sequence in the corpus is obtained, and the system call sequences with TF-IDF scores lower than a preset score threshold are removed to obtain the system call sequences after preprocessing.

[0074] In a possible implementation, a neural network model is used to construct a state prediction model, including: using an LSTM neural network model to construct a state prediction model.

[0075] In a possible implementation, the state prediction model is trained using the preprocessed system call sequence to obtain the trained state prediction model, including:

[0076] Based on the preprocessed system call sequence, cutting a plurality of system call subsequences with a length of N, and taking the next system call function of the system call subsequence as the expected label;

[0077] Initializing the hyperparameters of the state prediction model to obtain multiple hyperparameter sequences; wherein any two hyperparameter sequences are different from each other;

[0078] For any hyperparameter sequence, after applying the hyperparameter sequence to the state prediction model, the system call subsequence is used as input and combined with the expected label to obtain the fitness value corresponding to the hyperparameter sequence;

[0079] The method for obtaining the fitness value corresponding to the hyperparameter sequence may include: after applying the hyperparameter sequence to the state prediction model, taking the system call subsequence as input to obtain the actual output; obtaining the error function value according to the actual output and the expected label; adding the error function value to a very small constant (such as 0.0001), taking the inverse, and obtaining the fitness value corresponding to the hyperparameter sequence.

[0080] According to the fitness values ​​corresponding to the hyperparameter sequences, the optimal hyperparameter sequence with the best position in the solution space and the worst hyperparameter sequence with the worst position are determined;

[0081] According to the optimal hyperparameter sequence and the worst hyperparameter sequence, an adaptive multi-strategy fusion search method is used to search the hyperparameter sequence to obtain a hyperparameter sequence after a primary search;

[0082] For the hyperparameter sequence after the first-level search, a multi-sequence information fusion method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the second-level search;

[0083] For the hyperparameter sequence after the secondary search, a spiral guided search method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the tertiary search;

[0084] Repeat the first-level search, the second-level search, and the third-level search until the training end condition is met, re-determine the optimal hyperparameter sequence according to the hyperparameter sequence after the third-level search, and after decoding the optimal hyperparameter sequence, apply it to the state prediction model to obtain the trained state prediction model.

[0085] The state prediction model training method provided by the embodiment of the present invention not only has a fast search speed and a good search effect, but can also effectively avoid falling into a local optimum, thereby improving the accuracy of state prediction.

[0086] In a possible implementation, according to the optimal hyperparameter sequence and the worst hyperparameter sequence, an adaptive multi-strategy fusion search method is used to search the hyperparameter sequence to obtain a hyperparameter sequence after a primary search, including:

[0087] Determine the adaptive search radius according to the current training times;

[0088] For each hyperparameter sequence, based on the adaptive search radius, determine the adjacent hyperparameter sequences within the search range of the hyperparameter sequence;

[0089] The hyperparameter sequence is exchanged with all adjacent hyperparameter sequences of the hyperparameter sequence, and the first information exchange item is obtained as follows: in, represents the i-th hyperparameter sequence during the t-th training process, Represents a hyperparameter sequence The jth adjacent hyperparameter sequence within the search range, J represents the hyperparameter sequence The total number of adjacent hyperparameter sequences within the search range of , α1 represents the first coefficient, i = 1, 2, …, N, N represents the total number of hyperparameter sequences;

[0090] Information fusion is performed on all adjacent hyperparameter sequences of the hyperparameter sequence, and the first information fusion item is obtained as follows: Wherein, α2 represents the second coefficient;

[0091] According to the optimal hyperparameter sequence, the hyperparameter sequence is optimally guided, and the first guided item is obtained as follows: Among them, α3 represents the third coefficient, represents the optimal hyperparameter sequence;

[0092] According to the worst hyperparameter sequence, the hyperparameter sequence is subjected to exclusion bootstrapping, and the second bootstrapping item is obtained as follows: Among them, α4 represents the fourth coefficient, represents the worst hyperparameter sequence;

[0093] According to the first information exchange item, the first information fusion item, the first guidance item and the second guidance item, the update speed of the hyperparameter sequence is obtained by using the search speed memory strategy: Where ω represents the inertia weight, Represents the hyperparameter sequence during the tth training process The update speed, Represents the hyperparameter sequence during the t+1th training process The update speed.

[0094] Based on the update speed of the hyperparameter sequence, the hyperparameter sequence is searched, and the hyperparameter sequence after the first-level search is obtained as follows: in, Represents the hyperparameter sequence after the first level search

[0095] The adaptive multi-strategy fusion search method provided by the embodiment of the present invention can make each hyperparameter sequence keep a certain distance from each other during the movement in the solution space, which helps to maintain diversity and reduce the possibility of falling into the local optimum in the process of exploring more space. At the same time, it can effectively search in the direction of the optimal position and stay away from the worst position, which helps to improve the search ability and thus improve the operation efficiency of the algorithm.

[0096] In a possible implementation, determining the adaptive search radius according to the current training times includes:

[0097] Determine the Euclidean distance between the upper limit of the hyperparameter and the lower limit of the hyperparameter, and after attenuating the Euclidean distance, the minimum search radius is obtained: (dist(X max -X min )) / 4; where X max represents the upper limit sequence of parameters, X min Represents the parameter lower limit sequence, dist(X max -X min ) represents the Euclidean distance between the upper parameter limit sequence and the lower parameter limit sequence;

[0098] After using the time function that increases with the number of training times to decay the Euclidean distance, the search radius increment is obtained: dist(X max -X min )*(2t / T); where T represents the preset maximum number of training times;

[0099] According to the minimum search radius and the search radius increment, the adaptive search radius is determined as: R = (dist (Xmax -X min )) / 4+dist(X max -X min )*(2t / T); where R represents the adaptive search radius.

[0100] The embodiment of the present invention constructs an adaptive search radius that can be continuously changed and increased as the number of training times increases, and can effectively fuse information on sequences to achieve surface homogeneity.

[0101] In a possible implementation, for the hyperparameter sequence after the primary search, a multi-sequence information fusion method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the secondary search, including:

[0102] For any hyperparameter sequence after the first-level search, the fusion control factor is used to fuse the information of the hyperparameter sequence with other hyperparameter sequences, and then the Euclidean distance between the hyperparameter sequence and other hyperparameter sequences is used for processing, and the unit fusion information of each hyperparameter encoding corresponding to each other hyperparameter sequence is obtained as follows: in, represents the d-th dimension parameter in the hyperparameter sequence after the n-th level search during the t-th training process, d = 1, 2, ..., D, D represents the total dimension of the hyperparameter sequence, Represents the d-th dimension parameter in the m-th other hyperparameter sequence, dist mn represents the Euclidean distance between the hyperparameter sequence after the nth level search and the mth other hyperparameter sequence, ξ mn represents the first fusion control factor, λ represents the fusion coefficient, e represents the natural constant, η represents the fusion range control factor, X min,d represents the d-th dimension parameter in the parameter upper limit sequence, X max,d represents the d-th dimension parameter in the parameter lower limit sequence, β represents the adaptive second fusion control factor; β=(Tβ max -t*(β max -β min )) / T,β max represents the maximum value of the second fusion control factor, β min Indicates the minimum value of the second fusion control factor;

[0103] After merging the unit fusion information of each other hyperparameter sequence, the adaptive adjustment coefficient is used for adjustment, and the comprehensive information fusion item is obtained as follows: I represents the total number of other hyperparameter sequences;

[0104] Based on the optimal hyperparameter sequence, the comprehensive information fusion item is used for search, and the hyperparameter sequence after the secondary search is obtained as follows: Among them, X best,d represents the d-th dimension parameter in the optimal hyperparameter sequence, Represents the d-th dimension parameter in the hyperparameter sequence after the n-th secondary search.

[0105] The multi-sequence information fusion method provided in the embodiment of the present invention can fuse all sequence information to realize the search of the optimal position; in the early stage of the algorithm, all sequences are relatively scattered, which can greatly improve the global search capability; in the later stage of the algorithm, all sequences are gathered together, which can also expand the search range to a certain extent.

[0106] In a possible implementation, for the hyperparameter sequence after the secondary search, a spiral guided search method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the tertiary search, including:

[0107] For the optimal hyperparameter sequence, nonlinear coefficients are used for adjustment to determine the basic position in the optimal direction: Among them, π represents pi;

[0108] For any hyperparameter sequence after the secondary search, the cosine function and the exponential function are used to exchange information between the hyperparameter sequence and the optimal hyperparameter sequence, and the spiral update amount is determined as: Where r1 represents the first random number between (0,1), r2 represents the second random number between (0,1), represents the hyperparameter sequence after the kth secondary search;

[0109] Based on the basic position in the optimal direction, the spiral update amount is used for updating, and the hyperparameter sequence after the three-level search is obtained as follows: in, Represents the hyperparameter sequence after the third-level search

[0110] The spiral guided search method provided in the embodiment of the present invention can make all hyperparameter sequences based on a certain position related to the optimal position, and search in the solution space in a spiral shape, which can effectively improve the global search capability. Combined with the aforementioned diversity search process, it can effectively avoid falling into the local optimum while speeding up the algorithm training speed.

[0111] In a possible implementation, determining a container security monitoring result according to the predicted system call sequence and the second real-time system call sequence includes:

[0112] Obtaining a cosine similarity between the predicted system call sequence and the second real-time system call sequence;

[0113] It is determined whether the cosine similarity between the predicted system call sequence and the second real-time system call sequence is less than a preset similarity threshold; if so, it is determined that the container security monitoring result is that the container is operating abnormally; otherwise, it is determined that the container security monitoring result is that the container is operating normally.

[0114] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The schemes in the embodiments of the present invention may be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0115] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0118] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0119] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A container security protection method, characterized in that: include: Collecting a system call sequence of a container for a system resource in a safe state, and preprocessing the system call sequence to obtain a preprocessed system call sequence; wherein the system call sequence includes a plurality of system call functions; A state prediction model is constructed by using a neural network model, and the state prediction model is trained by using the system call sequence after the preprocessing to obtain a trained state prediction model; The first real-time system call sequence of the container during operation is collected, and the real-time system call sequence is used as supporting data, and the trained state prediction model is used to obtain the predicted system call sequence; After collecting the first real-time system call sequence, collecting a second real-time system call sequence corresponding to the predicted system call sequence, and determining a container security monitoring result according to the predicted system call sequence and the second real-time system call sequence; When the container safety monitoring result is that the container is operating abnormally, a container abnormality warning message is generated, and the container abnormality warning message is transmitted to a device or system designated by the staff; The state prediction model is trained using the preprocessed system call sequence to obtain a trained state prediction model, including: Based on the preprocessed system call sequence, cutting a plurality of system call subsequences with a length of N, and taking the next system call function of the system call subsequence as the expected label; Initializing the hyperparameters of the state prediction model to obtain multiple hyperparameter sequences; wherein any two hyperparameter sequences are different from each other; For any hyperparameter sequence, after applying the hyperparameter sequence to the state prediction model, the system call subsequence is used as input and combined with the expected label to obtain the fitness value corresponding to the hyperparameter sequence; According to the fitness values ​​corresponding to the hyperparameter sequences, the optimal hyperparameter sequence with the best position in the solution space and the worst hyperparameter sequence with the worst position are determined; According to the optimal hyperparameter sequence and the worst hyperparameter sequence, an adaptive multi-strategy fusion search method is used to search the hyperparameter sequence to obtain a hyperparameter sequence after a primary search; For the hyperparameter sequence after the first-level search, a multi-sequence information fusion method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the second-level search; For the hyperparameter sequence after the secondary search, a spiral guided search method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the tertiary search; Repeat the first-level search, the second-level search, and the third-level search until the training end condition is met, re-determine the optimal hyperparameter sequence according to the hyperparameter sequence after the third-level search, and after decoding the optimal hyperparameter sequence, apply it to the state prediction model to obtain the trained state prediction model.

2. The container safety protection method according to claim 1, characterized in that: Also includes: When the container safety monitoring result is that the container is operating abnormally, a pre-set container safety protection measure is executed.

3. The container safety protection method according to claim 1, characterized in that: Collecting a system call sequence of a container for a system resource in a safe state, and preprocessing the system call sequence to obtain a preprocessed system call sequence, including: Collect the system call sequence of the container for system resources in a safe state; The TF-IDF score of each system call sequence in the corpus is obtained, and the system call sequences whose TF-IDF scores are lower than a preset score threshold are removed to obtain the system call sequences after preprocessing.

4. The container safety protection method according to claim 1, characterized in that: A neural network model is used to build a state prediction model, including: using an LSTM neural network model to build a state prediction model.

5. The container safety protection method according to claim 1, characterized in that: According to the optimal hyperparameter sequence and the worst hyperparameter sequence, an adaptive multi-strategy fusion search method is used to search the hyperparameter sequence to obtain a hyperparameter sequence after the first-level search, including: Determine the adaptive search radius according to the current training times; For each hyperparameter sequence, based on the adaptive search radius, determine the adjacent hyperparameter sequences within the search range of the hyperparameter sequence; Performing information exchange between the hyperparameter sequence and all adjacent hyperparameter sequences of the hyperparameter sequence to obtain a first information exchange item; Performing information fusion on all adjacent hyperparameter sequences of the hyperparameter sequence to obtain a first information fusion item; According to the optimal hyperparameter sequence, optimally guiding the hyperparameter sequence to obtain a first guided item; According to the worst hyperparameter sequence, performing exclusion bootstrapping on the hyperparameter sequence to obtain a second bootstrapping item; According to the first information exchange item, the first information fusion item, the first guidance item and the second guidance item, a search speed memory strategy is adopted to obtain the update speed of the hyperparameter sequence; Based on the update speed of the hyperparameter sequence, the hyperparameter sequence is searched to obtain a hyperparameter sequence after a first-level search.

6. The container safety protection method according to claim 5, characterized in that: Determine the adaptive search radius based on the current training times, including: Determine the Euclidean distance between the upper limit of the hyperparameter and the lower limit of the hyperparameter, and after attenuating the Euclidean distance, obtain a minimum search radius; After using the time function that increases with the number of training times to decay the Euclidean distance, the search radius increment is obtained; An adaptive search radius is determined according to the minimum search radius and the search radius increment.

7. The container safety protection method according to claim 6, characterized in that: For the hyperparameter sequence after the first-level search, a multi-sequence information fusion method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the second-level search, including: For any hyperparameter sequence after the first-level search, the fusion control factor is used to fuse the information of the hyperparameter sequence with other hyperparameter sequences, and then the Euclidean distance between the hyperparameter sequence and other hyperparameter sequences is used for processing to obtain the unit fusion information of each hyperparameter encoding corresponding to each other hyperparameter sequence; After merging the unit fusion information of each other hyperparameter sequence, the adaptive adjustment coefficient is used to adjust it to obtain the comprehensive information fusion item; Based on the optimal hyperparameter sequence, a comprehensive information fusion item is used to perform a search to obtain a hyperparameter sequence after a secondary search.

8. The container safety protection method according to claim 7, characterized in that: For the hyperparameter sequence after the secondary search, the spiral guided search method is used to search the hyperparameter sequence to obtain the hyperparameter sequence after the third-level search, including: For the optimal hyperparameter sequence, nonlinear coefficients are used for adjustment to determine the basic position in the optimal direction; For any hyperparameter sequence after the secondary search, the cosine function and the exponential function are used to exchange information between the hyperparameter sequence and the optimal hyperparameter sequence to determine the spiral update amount; Based on the basic position in the optimal direction, the spiral update amount is used to update and obtain the hyperparameter sequence after the three-level search.

9. The container safety protection method according to claim 1, characterized in that: Determining a container security monitoring result according to the predicted system call sequence and the second real-time system call sequence includes: Obtaining a cosine similarity between the predicted system call sequence and the second real-time system call sequence; It is determined whether the cosine similarity between the predicted system call sequence and the second real-time system call sequence is less than a preset similarity threshold; if so, it is determined that the container security monitoring result is that the container is operating abnormally; otherwise, it is determined that the container security monitoring result is that the container is operating normally.

Images