Container cloud environment security threat visual alarm method and system

Abstract

The invention provides a container cloud environment security threat visual alarm method and system. The method comprises the steps that S1, environment information and original data are collected; s2, converting the environment information and the original data into time sequence data; s3, marking the time sequence data, and analyzing the time sequence data to obtain threat intelligence; and S4, visualizing the original data and the threat intelligence, and giving an alarm. The current environment and architecture are automatically judged, modules related to the current system are selectively started, information sources are rich, and the information density is large. The data is marked in a time sequence format, so that original characteristics of the data can be reserved to the maximum extent, and a data context call chain can be better reserved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and specifically, relates to a method and system for visualizing and warning security threats in a container cloud environment. More specifically, it is a visual warning system for security threat intelligence in a common container cloud environment, especially for logging abnormal container behaviors and an abnormal behavior analysis framework based on frequency and time sequence, providing a visualization tool that can intuitively analyze and locate container threat intelligence. Background Art

[0002] Container tools have developed rapidly in the past few years. Both large enterprises and individuals can use containers to quickly create and deploy applications. Public clouds use container tools to continuously provide users with diversified, customized, and quickly deployed SaaS applications, accelerating the arrival of the cloud-native era. In the cloud-native era, studying security threats in container cloud environments is more universal.

[0003] Unlike traditional host environments, the environment in containers is isolated. The host resources that applications in containers can access are strictly limited. Container escape methods can obtain host resources or permissions beyond the authority of the container cloud environment, thereby causing damage. The environment in the public cloud environment is often bound to the permissions of the cloud platform. Attackers who steal the permissions of the public cloud will cause further damage to the cloud platform infrastructure.

[0004] There are two main solutions for obtaining container escape intelligence in the container cloud environment: kernel module hooking and eBPF program to capture the key operating information of the Linux operating system kernel state. The kernel module solution uses the Linux kernel key function hook method to query and capture the current operating state of the operating system. This solution has problems such as intrusion into the kernel, incompatibility of multiple versions, high performance overhead, and low scalability.

[0005] At the same time, mounting kernel modules is a very dangerous operation. Kernel modules with security risks will cause the system to crash and restart, and the services on the host will suffer a devastating disaster.

[0006] The eBPF module can provide a safer loading method. The system will perform static analysis on eBPF before running to ensure that it will not damage the system kernel. The eBPF program can provide stronger compatibility. Its CO-RE feature allows the same program to be compatible with different systems and platforms, making it easier to deploy in heterogeneous systems.

[0007] eBPF can provide more powerful observability capabilities and can more comprehensively collect system calls, kprobe kernel functions, tracepoint binary points, sockets and other types of information. In the eBPF ecosystem, more attention is paid to system performance indicators. There are many solutions based on eBPF to detect system performance, but not enough attention is paid to system security indicators, especially container cloud security indicators. There is a visualization system for security threats in container cloud environments. Summary of the invention

[0008] In view of the defects in the prior art, the purpose of the present invention is to provide a method and system for visualizing and warning security threats in a container cloud environment.

[0009] A container cloud environment security threat visualization alarm method provided by the present invention includes:

[0010] Step S1: Collect environmental information and original data;

[0011] Step S2: converting the environmental information and the original data into time series data;

[0012] Step S3: Mark the time series data, analyze the time series data, and obtain threat intelligence;

[0013] Step S4: Visualize the original data and the threat intelligence, and issue a warning.

[0014] Preferably, in step S1, the environment information includes: the current environment kernel version, the architecture information of the current environment and the cloud platform information of the current environment;

[0015] The original data includes: system calls, kprobe kernel hooks and tracepoints.

[0016] Preferably, the step S3 includes:

[0017] The time series data is safety indicator data;

[0018] Step S3.1: Mark the interval recording points, capture the safety index data, make a difference between two adjacent recording points to obtain the safety index data of the interval time period, and obtain all the safety index data;

[0019] Step S3.2: According to built-in rules or custom rules, determine whether the security indicator data is combined to express a threat behavior of the container environment; if the result is yes, obtain threat intelligence; if the result is no, do not process;

[0020] In the step S3.1, the security indicator data of different containers are filtered through the file system namespace, i.e., mnt_ns;

[0021] The security indicator data includes: file access, process creation, network traffic, file system mounting, file link creation and file renaming;

[0022] The threat behavior is determined according to the built-in rule or the custom rule;

[0023] The built-in rules include: container escape-related rules, sensitive resource access-related rules, kernel function context-related rules, and high-risk cloud platform access path-related rules;

[0024] The container escape-related rules include: "the process in the container uses Capabilities to run a process with the host machine's root user-level permissions" and "mounting the host machine's file system";

[0025] The sensitive resource access related rules include: "access to host password hash", "access to / etc / sudoers configuration file";

[0026] The kernel function context-related rules include: "kernel function reading and writing", "kernel function execution";

[0027] The high-risk cloud platform access path-related rules include: "accessing the cloud platform metadata server" and "stealing the cloud platform access credential AccessKey".

[0028] Preferably, in step S3, the time series data is filtered in real time according to the container security risk strategy to obtain threat intelligence; the container security risk strategy includes: "high-risk system calls to access sensitive resources", "attempts to obtain high-authority Capabilities", "attempts to create connections to unfamiliar IP addresses", "initiation of high-risk requests to container engines or container scheduling platforms", "attempts to execute kernel vulnerability call chains under existing feature libraries", "access and read files with cloud platform credentials and upload or exploit them", "high-frequency execution of system environment scanning operations" and "timed triggered malicious calls to kernel functions".

[0029] A container cloud environment security threat visualization alarm system provided by the present invention includes:

[0030] Module M1: Collect environmental information and raw data;

[0031] Module M2: converting the environmental information and the original data into time series data;

[0032] Module M3: marking the time series data, analyzing the time series data, and obtaining threat intelligence;

[0033] Module M4: Visualize the raw data and the threat intelligence, and issue a warning.

[0034] Preferably, in the module M1, the environment information includes: the current environment kernel version, the architecture information of the current environment and the cloud platform information of the current environment;

[0035] The original data includes: system calls, kprobe kernel hooks and tracepoints.

[0036] Preferably, the module M3 includes:

[0037] The time series data is safety indicator data;

[0038] Module M3.1: Mark the interval recording points, capture them as safety index data, make a difference between two adjacent recording points to obtain the safety index data of the interval time period, and obtain all the safety index data;

[0039] Module M3.2: Determine whether the security indicator data is combined and expressed as a threat behavior of the container environment according to built-in rules or custom rules; if the result is yes, obtain threat intelligence; if the result is no, do not process;

[0040] In the module M3.1, the security indicator data of different containers are filtered through the file system namespace, i.e., mnt_ns;

[0041] The security indicator data includes: file access, process creation, network traffic, file system mounting, file link creation and file renaming;

[0042] The threat behavior is determined according to the built-in rule or the custom rule;

[0043] The built-in rules include: container escape-related rules, sensitive resource access-related rules, kernel function context-related rules, and high-risk cloud platform access path-related rules;

[0044] The container escape-related rules include: "the process in the container uses Capabilities to run a process with the host machine's root user-level permissions" and "mounting the host machine's file system";

[0045] The sensitive resource access related rules include: "access to host password hash", "access to / etc / sudoers configuration file";

[0046] The kernel function context-related rules include: "kernel function reading and writing", "kernel function execution";

[0047] The high-risk cloud platform access path-related rules include: "accessing the cloud platform metadata server" and "stealing the cloud platform access credential AccessKey".

[0048] Preferably, in the module M3, the time series data is filtered in real time according to the container security risk strategy to obtain threat intelligence; the container security risk strategy includes: "high-risk system calls to access sensitive resources", "attempts to obtain high-authority Capabilities", "attempts to create connections to unfamiliar IP addresses", "initial high-risk requests to container engines or container scheduling platforms", "attempts to execute kernel vulnerability call chains under existing feature libraries", "access and read files with cloud platform credentials and upload or exploit them", "high-frequency execution of system environment scanning operations" and "timed triggered malicious calls to kernel functions".

[0049] According to a computer-readable storage medium storing a computer program provided by the present invention, when the computer program is executed by a processor, the steps of the method for visualizing and warning of security threats in a container cloud environment are implemented.

[0050] An electronic device provided according to the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the method for visualizing and warning security threats in a container cloud environment are implemented.

[0051] Compared with the prior art, the present invention has the following beneficial effects:

[0052] 1. The present invention collects data through the eBPF program, automatically determines the current environment and architecture, and selectively opens modules related to the current system. The information source is rich and the information density is high. In other words, marking the data in a time series format can retain the original characteristics of the data to the maximum extent and better retain the data context call chain.

[0053] 2. The data processing flow provided by the present invention is real-time, efficient and supports customization. The present invention has built-in container escape-related rules, sensitive resource access-related rules, kernel function context-related rules, and high-risk cloud platform access path-related rules. It also supports users to customize the creation of rules and add them for use.

[0054] 3. The data presentation provided by the present invention is more intuitive. It presents the original data in the form of visual alarms, can accurately locate and analyze container cloud security threats, and presents threat intelligence in the form of visual alarms, which is helpful for comprehensive analysis of the security status of the current container cloud environment. The use of visual alarms to present it together with other system performance indicators can seamlessly integrate the cloud native environment.

[0055] 4. The tool technology involved in the present invention focuses on the potential security threats in the container cloud environment, and can extract and analyze the corresponding security threat intelligence to protect the applications in the container. In other words, the present invention can collect various container-related security time series indicators without the user's perception, and realize automatic analysis and aggregation analysis of raw data through built-in security policies and user-defined configurations, which is convenient for visualization of threat intelligence and location of high-risk security vulnerabilities. Finally, the container cloud security intelligence is visualized through a large-scale display, and an automatic alarm function is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0057] Figure 1 A flowchart of the operation of the container cloud environment security threat visualization alarm system provided by the present invention;

[0058] Figure 2 A flowchart of raw data collection and threat intelligence analysis for the container cloud environment provided by the present invention;

[0059] Figure 3 A flow chart for visualizing access to raw data and threat intelligence in a container cloud environment provided by the present invention. DETAILED DESCRIPTION

[0060] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0061] The present invention provides a visual alarm system for security threats in a container cloud environment. The system is installed in a non-trusted Linux environment and automatically starts different collection modules according to different system versions. Different collection modules collect different indicators related to container cloud security in the Linux environment to obtain structured container cloud security time series data. Points are buried at each potential threat to obtain the trigger sequence of high-risk operations. In view of the problem that black box operations existing in traditional security data cannot be located, the collected data related to container cloud security is exported to solve the problems of difficult collection and debugging. The system also incorporates its own operating status into the visual indicators to solve the problems of unstable operating status and unclear operating effect. Based on common container cloud security issues, a variety of indicator analysis solutions are built in. The original time series data and the analyzed time series indicators are simultaneously displayed, which are used to locate security issues and threat intelligence alarm operations respectively. The system automatically connects to the alarm system to support a variety of information reporting and alarm methods.

[0062] In other words, the present invention provides a visual alarm system for security threats in a container cloud environment, which can use the powerful extensibility of eBPF to write a collector, collect container security-related data from multiple information sources in the kernel state, and convert it into a unified time series format through a formatting tool. The user-state analysis program can convert the original container cloud security indicator analysis into corresponding container security threat intelligence in real time based on the built-in rule chain such as the program context, call frequency, resource access, and other custom indicator analysis tools that the user can choose to execute. Finally, all formatted time series raw data and threat intelligence are reported to the visualization platform to achieve a large-scale display and accurately locate container cloud security threats.

[0063] In addition, the data processing flow provided by the present invention is real-time, efficient and supports customization. The present invention has built-in rules related to container escape, sensitive resource access, kernel function context, and high-risk cloud platform access path. It also supports users to customize the creation of rules and add them for use.

[0064] The container escape-related rules include the process in the container using Capabilities to run a high-privilege process and mount the host file system;

[0065] The rules related to access to sensitive resources include access to the host password hash and access to the / etc / sudoers configuration file;

[0066] The kernel function context-related rules include high-privilege kernel function reading and writing, and high-privilege kernel function execution;

[0067] The high-risk cloud platform access path-related rules include accessing the cloud platform metadata server and stealing the cloud platform access credential AccessKey.

[0068] According to a container cloud environment security threat visualization alarm method provided by the present invention, the process of its software system includes:

[0069] Step S1: Collect environmental information and original data;

[0070] Step S2: converting the environmental information and the original data into time series data;

[0071] Step S3: Mark the time series data, analyze the time series data, and obtain threat intelligence;

[0072] Step S4: Visualize the original data and the threat intelligence, and issue a warning.

[0073] In the step S1, the environment information includes: the current environment kernel version, the architecture information of the current environment and the cloud platform information of the current environment;

[0074] The original data includes: system call, kprobe kernel hook, tracepoint;

[0075] The kprobe kernel hook is to track and debug the Linux system kernel function, and capture the kernel function execution parameters, return information and other contexts.

[0076] A container cloud environment security threat visualization alarm system provided by the present invention includes: an automatic collection function startup module, a raw time series data collection method, a self-monitoring status evaluation, a built-in & customized rule analysis method, and finally a visualization dashboard to display raw security time series data and threat intelligence.

[0077] Automatically start the acquisition module: By extracting the current operating system version information, select the acquisition module that matches the current operating system and automatically start it, and provide special acquisition modules for commonly used operating systems.

[0078] Container cloud security timing indicator collection module: Through the system buffer, ebpf_map and other media registered by the eBPF program, the kernel state parameter data is converted into timing data and passed to the collector.

[0079] Self-monitoring status evaluation: Self-operation status monitoring can be achieved through self-code tracking, which can comprehensively analyze its own operation status and reduce operation costs.

[0080] Built-in & custom rule analysis methods: identify high-risk behaviors through high-frequency abnormal execution, time-series function call chains, high-authority operation calls, abnormal resource access, etc., and display the analysis results as time-series indicators. The high frequency refers to the frequency that exceeds the frequency value of the built-in rule setting or the custom rule.

[0081] Visualization dashboard display module: It includes two aspects: one is the original data related to container cloud security, and the other is the security threat intelligence derived from rule analysis.

[0082] The present invention can automatically determine the current operating system environment and start the corresponding security information collection module; the security information includes: system call information, tracepoint information, socket connection information and other eBPF collectible information.

[0083] The present invention can automatically export the original collected data in the form of time series data, record the sequential logic and calling frequency of the same security event triggering, and facilitate subsequent use of rules for aggregate analysis.

[0084] The present invention enables self-monitoring means, facilitates the location and restoration of existing problems, has a certain degree of self-healing capability, and is also convenient for performance tuning based on self-monitoring information.

[0085] The present invention judges the threat situation according to the calling frequency of potential threat points, especially viruses with latent functions. Sudden high-frequency calling of a certain function can trigger rule filtering. The present invention will focus on the process in the container and report threat intelligence.

[0086] The present invention determines the threat situation based on the context of the threat intelligence point. The present invention can store time series data and can sort out the operations performed by a single process according to the event dimension. If it meets the characteristics of high-risk operations, the present invention will organize the information and report it as threat intelligence.

[0087] The present invention adopts a visualization solution, which is different from the traditional method of querying logs to locate problems. It can directly present the original container cloud security indicators in the form of visual charts according to event dimensions, and can aggregate them according to multiple dimensions such as process, time, and access resources to present high-risk operations.

[0088] The present invention can visualize container cloud security threat intelligence, sort out potential security risks according to time and associate them with original container cloud security indicators, and can assist security engineers in quickly locating and troubleshooting security threats.

[0089] The tool system described in the present invention is based on the collection of various security indicators in the container cloud environment. It can automatically label and format the original data, extract and analyze indicators according to security rules, and build security intelligence in the container cloud environment. The data collection probe is built using eBPF, and uses the kernel access capability of the system eBPF to collect the running status of kernel-mode programs and automatically filter and report container cloud security-related data. On this basis, the data is formatted into a time series log, and the corresponding threat intelligence is analyzed and reported according to the rules, providing operation and maintenance personnel with a visual presentation of security intelligence.

[0090] A container cloud environment security threat visualization alarm system provided by the present invention includes automatically and selectively opening a collection module, using an eBPF program to collect system container cloud security-related data and mark it, and performing container cloud security threat intelligence analysis based on the characteristics of time series data. Finally, the original data and threat intelligence are reported and visualized as an alarm:

[0091] Container cloud security data collection module: automatically determines the current system environment and starts a compatible collection module, labels the collected data and passes it to the user-state program. The user-state program automatically collects and labels the collected data to complete the data collection work.

[0092] Container cloud security data analysis module: further analyzes the data collected in the previous stage, and obtains threat intelligence of the current container cloud environment based on multi-dimensional analysis of time, call frequency, and access resources.

[0093] First, in terms of the time dimension, the system periodically captures security indicator data and automatically subtracts it from the last recorded point to extract all security indicator data for the previous time period. It then distinguishes the data based on the file system namespace of different containers, i.e., mnt_ns, and extracts all security indicator data for each container environment.

[0094] Then, we analyze the built-in indicator correlation. For example, escaping using privileged containers is often accompanied by the creation of new processes, the application of high-privilege Capabilities, and the execution of host namespace programs. For example, when escaping using CAP_SYS_PTRACE, there will be scanning and access to the / proc file system by processes in the container, changes to processes in the host namespace, and traffic across file namespaces.

[0095] In other words, the present invention models common container environment threats. The basic security indicator information, that is, the security indicator data, includes file access, process creation, network traffic, file system mounting, file link creation, and file renaming. The characteristics of the threats in the container environment are expressed using a combination of basic security information indicators. Once the combination of these indicator information is recorded, it can be determined that high-risk behaviors have occurred in the container, and these high-risk behaviors are recorded as container threat indicators, that is, threat intelligence.

[0096] The present invention uses the file system namespace, namely mnt_ns, to filter out behaviors in different containers, filter out behaviors in normal containers, and eliminate interference factors.

[0097] Container cloud security data visualization alarm module: The collected original indicators and threat intelligence obtained through analysis are uniformly reported and visualized to facilitate rapid problem location and assessment of the security status of the current container cloud environment.

[0098] The present invention provides a container cloud environment security threat visualization alarm system, which includes a data collection module that automatically obtains environmental information, a threat intelligence analysis process based on time series data, and finally a means of rapid threat location through visualization alarm access.

[0099] Specifically, the automatically collected system information includes the current system's kernel version, system architecture, runtime status, and the security of the container cloud environment, including the permissions of processes within the container and the cloud platform environment information.

[0100] Specifically, the security threat intelligence includes the escape behavior of applications in the container, the unauthorized access behavior of resources of applications in the container, and the use of cloud platform access credentials.

[0101] Specifically, the threat intelligence collection module implements system calls, kprobe functions, tracepoints, and socket data sources based on eBPF technology, and transmits and reports them to user-mode programs through kernel buffers or ebpf_map mechanisms.

[0102] Specifically, the data tagging and formatting refers to formatting the original data into time series log data according to the process name, function call chain, and call frequency in multiple dimensions to facilitate subsequent analysis and judgment.

[0103] Specifically, the threat intelligence analysis rules refer to built-in rules for analyzing security threats in the container cloud environment and rules that can be customized by users. These customized rules can be declared and created when the present invention is started.

[0104] Specifically, the built-in rules for analyzing security threats in container cloud environments include: common container escape behavior rules, common sensitive resource access rules, kernel function context-sensitive call rules, common high-risk cloud resource path rules, and sudden high-frequency call rules based on call frequency.

[0105] Specifically, the visualization tool refers to the open source tool Prometheus. The present invention formats the original data and the analyzed container cloud security threat intelligence into indicator information, quickly presents a visualization dashboard through Prometheus, and can be seamlessly integrated with the cloud native environment.

[0106] Specifically, the alarm system refers to a system that can automatically trigger alarm events based on the top-level threat intelligence of the container cloud environment, filter related alarms with the help of whitelist configuration, or configure a specified alarm method by itself.

[0107] A container cloud environment security threat visualization alarm system provided by the present invention includes:

[0108] Container cloud security data collection module: automatically determines the current system environment and starts a compatible collection module, labels the collected data and passes it to the user-state program. The user-state program automatically collects and labels the collected data to complete the data collection work.

[0109] Container cloud security data analysis module: further analyzes the data collected in the previous stage, and obtains threat intelligence of the current container cloud environment based on multi-dimensional analysis of time, call frequency, and access resources.

[0110] Container cloud security data visualization alarm module: The collected original indicators and threat intelligence obtained through analysis are uniformly reported and visualized to facilitate rapid problem location and assessment of the security status of the current container cloud environment.

[0111] The preferred examples of the present invention are further described below.

[0112] Step 1: Deploy the present invention in any container cloud environment. The present invention will automatically collect various basic information in the current environment, including the version of the kernel of the current environment, the architecture information of the current environment, and the cloud platform information of the current environment. Based on this information, the corresponding security acquisition module will be enabled. These modules are packaged in the binary file provided by the present invention and can be loaded on demand according to the current environment.

[0113] Step 2: Collect the container cloud security collection module. This module uses the eBPF tool to collect the original data related to container cloud security, such as system calls, kprobe kernel hooks, tracepoints, etc. exposed in the system kernel.

[0114] These raw data are sent to the user-mode process through ebpf_map and kernel buffer for further analysis and conversion.

[0115] Step 3: Convert the raw data collected in the previous step into a time series data metric that can be stored in a structured manner. The raw data can be converted into a time series data metric by adding a time series label to it through timed sampling according to time changes. In this process, the user-mode program will read the data from the kernel-mode ebpf_map and parse it through a pre-defined configuration file. This step will parse the structure data in the ebpf_map into the context information of the process running, and add the context information of the corresponding process to each piece of information, including but not limited to the process name, executable file, open file handle, accessed resource information, process privilege information, etc., and then add the corresponding event information for conversion into time series information.

[0116] Specifically, the original data is converted into time series data through time sampling;

[0117] Specifically, the automatic addition of context is implemented as follows: the original data in ebpf_map is reintegrated and defined through the user-mode "built-in configuration file", and after the definition is completed, it becomes the program context.

[0118] Step 4: Start the built-in rule analyzer for analyzing container cloud security threat intelligence to analyze and process the original security indicators: continuously read the original security indicator information, filter out the applications in the container by means of the container namespace, and classify and extract all indicator context information corresponding to the process in a certain container according to the Pid information of the process; then, through the built-in container security risk strategy, that is, access sensitive resources through high-risk system calls, attempt to obtain high-authority Capabilities, attempt to create a connection to an unfamiliar IP address, initiate a high-risk request to the container engine or container scheduling platform, attempt to execute the kernel vulnerability call chain under the existing feature library, access and read files with cloud platform credentials and upload or use them, perform high-frequency system environment scanning operations, and regularly trigger malicious calls to kernel functions. A series of strategies and other strategies that users can choose are used to make a unified and comprehensive evaluation of the relevant threat intelligence. The present invention models common container environment threats. The basic security indicator information includes file access, process creation, network traffic, file system mounting, file link creation, file renaming, etc. The characteristics of the threat of the container environment can be expressed using a combination of basic security information indicators. Once the combination of these indicator information is recorded, it can be judged that a high-risk behavior has occurred in the container. Analyze threat intelligence for security risks such as container escape, container lateral movement, and cloud platform resource access. The threat intelligence analysis method here is the same as above;

[0119] The threat intelligence specifically refers to the threats related to container escape, sensitive resource access, container lateral movement, and cloud platform resource access mentioned above.

[0120] Step 5: The raw data indicators and container cloud security threat indicators obtained in steps 3 and 4 are uniformly connected to the visual alarm platform. The visual alarm platform can support the regular capture of indicators from many nodes, and centrally store and display the corresponding indicator information.

[0121] By visualizing the overall information, the changes in the number of system calls over a period of time are presented in a centralized manner; for some high-risk system calls, the visualization platform will centrally display the resource information accessed by the high-risk system calls and the context of the dangerous operation. For threat intelligence, the visualization platform will display the information summary, process context, reasons for triggering threat intelligence, potential security vulnerability risks, and mitigation solutions.

[0122] Step 6: The visualization system of the present invention will automatically connect to the alarm system. When high-risk threat intelligence such as container escape, sensitive resource access, cluster lateral movement, cloud platform AccessKey access, etc. appears, the corresponding callback function can be automatically triggered to implement the alarm. In other words, the high risk involves container escape, sensitive resource access, cluster lateral movement, cloud platform AccessKey access, and high-level dangers that affect system security.

[0123] In other words, the container application's scanning of permissions and sending of abnormal traffic are considered low-level threats; attempts to escape from the container and lateral movement are considered medium-level threats; successful container escape, lateral movement, and access to node sensitive resources and cloud platform AccessKey are considered high-level threats. Users can customize the threat level that triggers an alarm and the contact information after the alarm is triggered.

[0124] Supports black and white alarm lists, and uses whitelist strategies to allow certain processes to execute corresponding strategies without triggering alarms. Supports automatic blocking strategies, that is, when high-risk operations are triggered, supports emergency response measures such as directly rescheduling a container and disconnecting the network connection to reduce the explosion radius.

[0125] The present invention also provides a container cloud environment security threat visualization alarm system, which can be implemented by executing the process steps of the container cloud environment security threat visualization alarm method, that is, technical personnel in this field can understand the container cloud environment security threat visualization alarm method as a preferred implementation of the container cloud environment security threat visualization alarm system.

[0126] A container cloud environment security threat visualization alarm system provided by the present invention includes:

[0127] Module M1: Collect environmental information and raw data;

[0128] Module M2: converting the environmental information and the original data into time series data;

[0129] Module M3: marking the time series data, analyzing the time series data, and obtaining threat intelligence;

[0130] Module M4: Visualize the raw data and the threat intelligence, and issue a warning.

[0131] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0132] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A container cloud environment security threat visualization alarm method, characterized in that: include: Step S1: Collect environmental information and original data; Step S2: converting the environmental information and the original data into time series data; Step S3: Mark the time series data, analyze the time series data, and obtain threat intelligence; Step S4: Visualize the original data and the threat intelligence, and issue a warning.

2. The container cloud environment security threat visualization alarm method according to claim 1 is characterized in that: In the step S1, the environment information includes: the current environment kernel version, the architecture information of the current environment and the cloud platform information of the current environment; The original data includes: system calls, kprobe kernel hooks and tracepoints.

3. The container cloud environment security threat visualization alarm method according to claim 2 is characterized in that: In the step S3, it includes: The time series data is safety indicator data; Step S3.1: Mark the interval recording points, capture them as safety index data, make a difference between two adjacent recording points to obtain the safety index data of the interval time period, and obtain all the safety index data; Step S3.2: According to built-in rules or custom rules, determine whether the security indicator data is combined to express a threat behavior of the container environment; if the result is yes, obtain threat intelligence; if the result is no, do not process; In the step S3.1, the security indicator data of different containers are filtered through the file system namespace, i.e., mnt_ns; The security indicator data includes: file access, process creation, network traffic, file system mounting, file link creation and file renaming; The threat behavior is determined according to the built-in rule or the custom rule; The built-in rules include: container escape-related rules, sensitive resource access-related rules, kernel function context-related rules, and high-risk cloud platform access path-related rules; The container escape-related rules include: "the process in the container uses Capabilities to run a process with the host machine's root user-level permissions" and "mounting the host machine's file system"; The sensitive resource access related rules include: "access host password hash", "access / etc / sudoers configuration file"; The kernel function context-related rules include: "kernel function reading and writing", "kernel function execution"; The high-risk cloud platform access path related rules include: "accessing the cloud platform metadata server" and "stealing the cloud platform access credential AccessKey".

4. The method for visualizing and warning security threats in a container cloud environment according to claim 3 is characterized in that: In the step S3, the time series data is filtered in real time according to the container security risk strategy to obtain threat intelligence; The container security risk strategy includes: "high-risk system calls to access sensitive resources", "attempts to obtain high-authority Capabilities", "attempts to create connections to unfamiliar IP addresses", "initiation of high-risk requests to container engines or container scheduling platforms", "attempts to execute kernel vulnerability call chains under existing feature libraries", "access and read files with cloud platform credentials and upload or exploit them", "high-frequency execution of system environment scanning operations" and "timed triggered malicious calls to kernel functions".

5. A container cloud environment security threat visualization warning system, characterized in that: include: Module M1: Collect environmental information and raw data; Module M2: converting the environmental information and the original data into time series data; Module M3: marking the time series data, analyzing the time series data, and obtaining threat intelligence; Module M4: Visualize the raw data and the threat intelligence, and issue a warning.

6. The container cloud environment security threat visualization warning system according to claim 5 is characterized in that: In the module M1, the environment information includes: the current environment kernel version, the architecture information of the current environment and the cloud platform information of the current environment; The original data includes: system calls, kprobe kernel hooks and tracepoints.

7. The container cloud environment security threat visualization warning system according to claim 6 is characterized in that: The module M3 includes: The time series data is safety indicator data; Module M3.1: Mark the interval recording points, capture them as safety index data, make a difference between two adjacent recording points to obtain the safety index data of the interval time period, and obtain all the safety index data; Module M3.2: Determine whether the security indicator data is combined and expressed as a threat behavior of the container environment according to built-in rules or custom rules; if the result is yes, obtain threat intelligence; if the result is no, do not process; In the module M3.1, the security indicator data of different containers are filtered through the file system namespace, i.e., mnt_ns; The security indicator data includes: file access, process creation, network traffic, file system mounting, file link creation and file renaming; The threat behavior is determined according to the built-in rule or the custom rule; The built-in rules include: container escape-related rules, sensitive resource access-related rules, kernel function context-related rules, and high-risk cloud platform access path-related rules; The container escape-related rules include: "the process in the container uses Capabilities to run a process with the host machine's root user-level permissions" and "mounting the host machine's file system"; The sensitive resource access related rules include: "access host password hash", "access / etc / sudoers configuration file"; The kernel function context-related rules include: "kernel function reading and writing", "kernel function execution"; The high-risk cloud platform access path related rules include: "accessing the cloud platform metadata server" and "stealing the cloud platform access credential AccessKey".

8. The container cloud environment security threat visualization warning system according to claim 7 is characterized in that: In the module M3, the time series data is filtered in real time according to the container security risk strategy to obtain threat intelligence; the container security risk strategy includes: "high-risk system calls to access sensitive resources", "attempts to obtain high-authority Capabilities", "attempts to create connections to unfamiliar IP addresses", "initiation of high-risk requests to container engines or container scheduling platforms", "attempts to execute kernel vulnerability call chains under existing feature libraries", "access and read files with cloud platform credentials and upload or exploit them", "high-frequency execution of system environment scanning operations" and "timed triggered malicious calls to kernel functions".

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the container cloud environment security threat visualization alarm method described in any one of claims 1 to 4 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is executed by a processor, the steps of the container cloud environment security threat visualization alarm method described in any one of claims 1 to 4 are implemented.

Images