Container cloud environment security threat visualized alarm method and system

Abstract

The application provides a container cloud environment security threat visual alarm method and system, which comprises the following steps: S1, collecting environment information and original data; S2, converting the environment information and the original data into time series data; S3, marking the time series data, analyzing the time series data, and obtaining threat intelligence; and S4, visualizing the original data and the threat intelligence and issuing a warning. The application can automatically determine the current environment and architecture, selectively start the modules related to the current system, and has abundant information sources and high information density. Marking the data in the time series format can maximize the preservation of the original characteristics of the data and better preserve the data context call chain.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method and system for visualizing and alerting security threats in container cloud environments. More specifically, it is a visual alerting system for security threat intelligence in common container cloud environments, particularly providing a visualization tool for intuitively analyzing and locating container threat intelligence through log recording of abnormal container behavior and a frequency- and time-series-based abnormal behavior analysis framework. Background Technology

[0002] Container tools have developed rapidly over the past few years, enabling both large enterprises and individuals to quickly create and deploy applications. Public clouds leverage container tools to continuously provide users with diverse, customized, and rapidly deployable SaaS applications, accelerating the arrival of the cloud-native era. In the cloud-native era, researching security threats in container cloud environments has even greater universality.

[0003] Unlike traditional host environments, container environments are isolated. Applications within containers have strictly limited access to host resources. Container escape techniques can exploit this limitation to gain unauthorized access to host resources or permissions in a container cloud environment, potentially causing damage. Furthermore, public cloud environments are often bound to cloud platform permissions; attackers stealing public cloud permissions can further damage the cloud platform infrastructure.

[0004] In container cloud environments, obtaining container escape intelligence primarily involves two methods: kernel module hooking and eBPF programs to capture critical runtime information in the Linux operating system kernel. The kernel module method hooks critical Linux kernel functions to query and capture the current operating system's runtime state. However, this method suffers from drawbacks such as kernel intrusion, version incompatibility, high performance overhead, and limited scalability.

[0005] At the same time, mounting kernel modules is an extremely dangerous operation. Kernel modules with security risks can cause the system to crash and restart, and services running on that host could be destroyed.

[0006] eBPF modules offer a more secure loading method. The system performs static analysis on eBPF before execution to ensure it does not damage the system kernel. eBPF programs offer stronger compatibility; their CO-RE feature allows a single program to be compatible with different systems and platforms, making it easier to deploy on heterogeneous systems.

[0007] eBPF offers more powerful observability capabilities, enabling more comprehensive collection of system calls, kprobe kernel functions, tracepoint binary data, and socket information. The eBPF ecosystem focuses more on system performance metrics, with many solutions based on eBPF for system performance monitoring. However, it doesn't place enough emphasis on system security metrics, especially container cloud security, and lacks a focus on visualization systems for security threats in container cloud environments. Summary of the Invention

[0008] To address the shortcomings of existing technologies, the purpose of this invention is to provide a method and system for visualizing and alerting security threats in container cloud environments.

[0009] A method for visualizing and alerting security threats in a container cloud environment, provided by the present invention, includes:

[0010] Step S1: Collect environmental information and raw data;

[0011] Step S2: Convert the environmental information and the original data into time-series data;

[0012] Step S3: Tag the time-series data, analyze the time-series data, and obtain threat intelligence;

[0013] Step S4: Visualize the raw data and the threat intelligence, and issue a warning.

[0014] Preferably, in step S1, the environment information includes: the current environment kernel version, the current environment architecture information, and the current environment cloud platform information;

[0015] The raw data includes: system calls, kprobe kernel hooks, and tracepoints.

[0016] Preferably, step S3 includes:

[0017] The time-series data refers to the security indicator data;

[0018] Step S3.1: Mark the interval recording points, capture the safety indicator data, and obtain the safety indicator data for the interval time period by subtracting two adjacent recording points, thus obtaining all the safety indicator data;

[0019] Step S3.2: Based on built-in rules or custom rules, determine whether the security indicator data is combined to express a threat behavior in the container environment; if the result is yes, then threat intelligence is obtained; if the result is no, then no processing is performed.

[0020] In step S3.1, the security indicator data of different containers are filtered by the file system namespace, namely mnt_ns;

[0021] The security metrics data include: file access, process creation, network traffic, file system mounting, file link creation, and file renaming;

[0022] The threat behavior is determined based on the built-in rules or the custom rules;

[0023] The built-in rules include: rules related to container escape, rules related to access to sensitive resources, rules related to kernel function context, and rules related to access paths to high-risk cloud platforms;

[0024] The container escape-related rules include: "The process inside the container uses Capabilities to run a process with root user-level privileges on the host machine" and "Mount the host machine file system";

[0025] The rules related to accessing sensitive resources include: "Accessing the host machine password hash" and "Accessing the / etc / sudoers configuration file";

[0026] The kernel function context-related rules include: "kernel function read / write" and "kernel function execution";

[0027] The rules related to the high-risk cloud platform access path include: "Accessing the cloud platform metadata server" and "Stealing the cloud platform access credential AccessKey".

[0028] Preferably, in step S3, the time-series data is filtered in real time according to the container security risk strategy to obtain threat intelligence; the container security risk strategy includes: "high-risk system calls to access sensitive resources", "attempt to obtain high-privilege capabilities", "attempt to create connections to unfamiliar IP addresses", "initiate high-risk requests to container engines or container scheduling platforms", "attempt to execute kernel vulnerability call chains under existing feature libraries", "access and read files with cloud platform credentials and upload or exploit them", "perform high-frequency system environment scanning operations" and "malicious kernel function calls triggered at regular intervals".

[0029] A container cloud environment security threat visualization and alerting system provided by the present invention includes:

[0030] Module M1: Collects environmental information and raw data;

[0031] Module M2: Converts the environmental information and the raw data into time-series data;

[0032] Module M3: Marks the time-series data, analyzes the time-series data, and obtains threat intelligence;

[0033] Module M4: Visualizes the raw data and threat intelligence, and issues warnings.

[0034] Preferably, in module M1, the environment information includes: the current environment kernel version, the current environment architecture information, and the current environment cloud platform information;

[0035] The raw data includes: system calls, kprobe kernel hooks, and tracepoints.

[0036] Preferably, module M3 includes:

[0037] The time-series data refers to the security indicator data;

[0038] Module M3.1: Mark interval recording points, capture them as safety indicator data, and obtain the safety indicator data for the interval time period by subtracting two adjacent recording points, thus obtaining all the safety indicator data;

[0039] Module M3.2: Based on built-in rules or custom rules, determine whether the security indicator data is combined to express a threat behavior in the container environment; if yes, then threat intelligence is generated; if no, then no action is taken.

[0040] In module M3.1, the security indicator data of different containers are filtered through the file system namespace, namely mnt_ns;

[0041] The security metrics data include: file access, process creation, network traffic, file system mounting, file link creation, and file renaming;

[0042] The threat behavior is determined based on the built-in rules or the custom rules;

[0043] The built-in rules include: rules related to container escape, rules related to access to sensitive resources, rules related to kernel function context, and rules related to access paths to high-risk cloud platforms;

[0044] The container escape-related rules include: "The process inside the container uses Capabilities to run a process with root user-level privileges on the host machine" and "Mount the host machine file system";

[0045] The rules related to accessing sensitive resources include: "Accessing the host machine password hash" and "Accessing the / etc / sudoers configuration file";

[0046] The kernel function context-related rules include: "kernel function read / write" and "kernel function execution";

[0047] The rules related to the high-risk cloud platform access path include: "Accessing the cloud platform metadata server" and "Stealing the cloud platform access credential AccessKey".

[0048] Preferably, in module M3, the time-series data is filtered in real time according to the container security risk policy to obtain threat intelligence; the container security risk policy includes: "high-risk system calls to access sensitive resources", "attempt to obtain high-privilege capabilities", "attempt to create connections to unfamiliar IP addresses", "initiate high-risk requests to container engines or container scheduling platforms", "attempt to execute kernel vulnerability call chains under existing feature libraries", "access and read files with cloud platform credentials and upload or exploit them", "perform high-frequency system environment scanning operations" and "malicious kernel function calls triggered at regular intervals".

[0049] According to the present invention, a computer-readable storage medium storing a computer program is provided, wherein when the computer program is executed by a processor, the steps of the container cloud environment security threat visualization and alarm method are implemented.

[0050] An electronic device according to the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the container cloud environment security threat visualization and alarm method.

[0051] Compared with the prior art, the present invention has the following beneficial effects:

[0052] 1. This invention collects data through an eBPF program, automatically determines the current environment and architecture, and selectively enables modules related to the current system. The information sources are rich and the information density is high. In other words, tagging the data in a time-series format can preserve the original characteristics of the data to the greatest extent and better preserve the data context call chain.

[0053] 2. The data processing flow provided by this invention is real-time, efficient and customizable. This invention has built-in rules related to container escape, access to sensitive resources, kernel function context, and access paths to high-risk cloud platforms. It also supports users to create and add custom rules.

[0054] 3. The data presentation provided by this invention is more intuitive. The raw data is presented in a visual alarm manner, which can accurately locate and analyze container cloud security threats. The presentation of threat intelligence in a visual alarm manner helps to comprehensively analyze the security status of the current container cloud environment. The visual alarm method is presented together with other system performance indicators, which can be seamlessly integrated into the cloud-native environment.

[0055] 4. The tools and technologies involved in this invention revolve around potential security threats in container cloud environments, and can extract and analyze corresponding security threat intelligence to safeguard applications within containers. In other words, this invention can collect various container-related security time-series indicators without the user's awareness, and achieve automatic analysis and aggregation of raw data through built-in security policies and user-defined configurations, which facilitates threat intelligence visualization and high-risk security vulnerability location. Finally, it visualizes container cloud security intelligence through a dashboard and provides automatic alarm functions. Attached Figure Description

[0056] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0057] Figure 1 A flowchart illustrating the operation of the container cloud environment security threat visualization and alerting system provided by this invention;

[0058] Figure 2 This invention provides a flowchart for raw data collection and threat intelligence analysis in a container cloud environment.

[0059] Figure 3 This invention provides a flowchart for the visualization of raw data and threat intelligence in a container cloud environment. Detailed Implementation

[0060] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0061] This invention provides a visual alarm system for security threats in container cloud environments. Installed in an untrusted Linux environment, it automatically activates different data collection modules based on different system versions. These modules collect various container cloud security-related metrics from the Linux environment, resulting in structured container cloud security time-series data. It embeds data points at potential threat locations to obtain the trigger sequence of high-risk operations. Addressing the issue of black-box operations that cannot be located using traditional security data, it exports container cloud security-related data, solving the problems of difficult data collection and debugging. It also incorporates its own operational status into the visual metrics, resolving issues of unstable operation and unclear operational effects. Based on common container cloud security issues, it incorporates multiple indicator analysis schemes. It simultaneously exposes the raw time-series data and the analyzed time-series metrics, respectively used for locating security issues and reporting and alarming threats. It automatically connects to the alarm system, supporting multiple information reporting and alarm methods.

[0062] In other words, this invention provides a container cloud environment security threat visualization and alerting system. Leveraging the powerful extensibility of eBPF, it enables the development of data collectors to gather container security-related data from multiple information sources in the kernel space. Based on this data, a formatting tool converts it into a unified time-series format. User-space analysis programs can, in real time, transform raw container cloud security metrics into corresponding container security threat intelligence based on built-in rule chains such as program context, call frequency, and resource access status, as well as other custom metric analysis tools that users can choose to execute. Finally, all formatted time-series raw data and threat intelligence are reported to a visualization platform, enabling a comprehensive dashboard display and precise location of container cloud security threats.

[0063] Furthermore, the data processing flow provided by this invention is real-time, efficient, and customizable. This invention has built-in rules related to container escape, access to sensitive resources, kernel function context, and access paths to high-risk cloud platforms. It also supports users to create and add custom rules.

[0064] The container escape rules include processes within the container using Capabilities to run high-privilege processes and mounting the host file system.

[0065] The rules related to accessing sensitive resources include accessing the host machine password hash and accessing the / etc / sudoers configuration file;

[0066] The kernel function context-related rules include high-privilege kernel function read / write and high-privilege kernel function execution;

[0067] The rules related to high-risk cloud platform access paths include accessing the cloud platform metadata server and stealing cloud platform access credentials (AccessKey).

[0068] According to the present invention, a method for visualizing and alerting security threats in a container cloud environment includes the following software system process:

[0069] Step S1: Collect environmental information and raw data;

[0070] Step S2: Convert the environmental information and the original data into time-series data;

[0071] Step S3: Tag the time-series data, analyze the time-series data, and obtain threat intelligence;

[0072] Step S4: Visualize the raw data and the threat intelligence, and issue a warning.

[0073] In step S1, the environment information includes: the current environment kernel version, the current environment architecture information, and the current environment cloud platform information;

[0074] The raw data includes: system calls, kprobe kernel hooks, and tracepoints;

[0075] The kprobe kernel hook is used to trace and debug Linux system kernel functions, capturing context such as kernel function execution parameters and return information.

[0076] The container cloud environment security threat visualization and alarm system provided by the present invention includes: an automatic data collection module, a raw time-series data collection method, a self-monitoring status assessment, a rule analysis method based on built-in and custom rules, and finally, a visualization dashboard to display the raw security time-series data and threat intelligence.

[0077] Automatic data acquisition module activation: By extracting the current operating system version information, the system automatically activates the data acquisition module that matches the current operating system, and provides special data acquisition modules for commonly used operating systems.

[0078] The container cloud security timing indicator acquisition module converts kernel-mode parameter data into timing data and transmits it to the collector through media such as the system buffer registered by the eBPF program and ebpf_map.

[0079] Self-monitoring status assessment: By implementing self-monitoring of its own running status through self-code tracking, it can comprehensively analyze its own running status and reduce running overhead.

[0080] Built-in and custom rule analysis methods: High-risk behaviors are identified through methods such as high-frequency abnormal execution, time-series function call chains, high-privilege operation calls, and abnormal resource access, and the analysis results are displayed as time-series indicators. "High frequency" refers to frequencies exceeding the frequency values ​​set by the built-in rules or custom rules.

[0081] The visualization dashboard module includes two aspects: one is the raw data related to container cloud security, and the other is the security threat intelligence derived from rule analysis.

[0082] This invention can automatically determine the current operating system environment and activate the corresponding security information collection module; the security information includes: system call information, tracepoint information, socket connection information, and other eBPF collectable information.

[0083] This invention can automatically export the raw collected data as time-series data, record the sequential logic and call frequency of the same security event, and facilitate subsequent aggregation and analysis using rules.

[0084] This invention employs a self-monitoring mechanism, which facilitates the location and recovery of its own problems, has a certain degree of self-healing ability, and also makes it easy to optimize performance based on self-monitoring information.

[0085] This invention determines the threat situation based on the frequency of calls to potential threat points, especially for viruses with latent functions. A sudden high frequency of calls to a certain function can trigger rule filtering. This invention will focus on the processes within the container and report threat intelligence.

[0086] This invention determines the threat situation based on the context of threat intelligence points. This invention can store time-series data and sort out the operations executed by a single process according to the event dimension. If it meets the characteristics of high-risk operations, this invention will organize and report the information as threat intelligence.

[0087] This invention employs a visualization solution, which differs from the traditional method of querying logs to locate problems. It can directly present the original container cloud security indicators through visual charts based on event dimensions. It can aggregate multiple dimensions such as process, time, and accessed resources to present high-risk operations.

[0088] This invention visualizes container cloud security threat intelligence, allowing for the analysis of potential security risks over time and their correlation with original container cloud security indicators. This can assist security engineers in quickly locating and investigating security threats.

[0089] The tool system described in this invention collects various security indicators based on container cloud environments. It can automatically tag and format raw data, extract and analyze indicators according to security rules, and construct security intelligence in the container cloud environment. The data collection probe is built using eBPF, leveraging the kernel access capabilities of the system's eBPF to collect kernel-mode program execution status and automatically filter and report container cloud security-related data. Based on this, the data is formatted into time-series logs, analyzed according to rules, and corresponding threat intelligence is reported, providing operations and maintenance personnel with a visualized security intelligence dashboard.

[0090] A container cloud environment security threat visualization and alerting system provided by the present invention includes automatically and selectively activating a data collection module, using an eBPF program to collect and tag system container cloud security-related data, performing container cloud security threat intelligence analysis based on the characteristics of time-series data, and finally reporting and visualizing the raw data and threat intelligence as alerts.

[0091] Container cloud security data acquisition module: Automatically determines the current system environment, starts a compatible acquisition module, tags the acquired data and passes it to the user-space program. The user-space program automatically collects the acquired data and tags it, completing the data acquisition work.

[0092] Container cloud security data analysis module: Further analyzes the data collected in the previous stage, and obtains threat intelligence of the current container cloud environment based on multiple dimensions such as time, call frequency, and accessed resources.

[0093] First, in terms of time dimension, this system periodically captures security indicator data and automatically subtracts it from the previous record point to extract all security indicator data for the previous time period. Then, based on the file system namespace of different containers, i.e., mnt_ns, it can distinguish and extract all security indicator data for each container environment.

[0094] Next, the analysis is conducted through the built-in correlation indicators. For example, escaping using privileged containers is often accompanied by three characteristics: the creation of new processes, the application of high-privilege capabilities, and the execution of programs in the host namespace. For instance, when escaping using CAP_SYS_PTRACE, there will be characteristics such as scanning and accessing the / proc file system by processes inside the container, modifying processes in the host namespace, and traffic across file namespaces.

[0095] In other words, this invention models common threats to container environments. Basic security indicators, namely security indicator data, include file access, process creation, network traffic, file system mounting, file link creation, and file renaming. The characteristics of threats to container environments are expressed using combinations of basic security information indicators. Once these combinations of indicator information are recorded, it can be determined that high-risk behaviors have occurred within the container. These high-risk behaviors are recorded as container threat indicators, i.e., threat intelligence.

[0096] This invention uses file system namespaces, specifically mnt_ns, to filter out behaviors within different containers, identify behaviors within normal containers, and eliminate interfering factors.

[0097] The container cloud security data visualization and alerting module: It unifies and visualizes the raw indicators collected and the threat intelligence obtained from analysis, making it easy to quickly locate problems and assess the security status of the current container cloud environment.

[0098] The present invention provides a container cloud environment security threat visualization and alarm system, which includes an automatic environmental information acquisition and data collection module, a threat intelligence analysis process based on time-series data, and finally, rapid threat location through visualization and alarm access.

[0099] Specifically, the automatically collected system information includes the current system kernel version, system architecture, runtime status, and the security of the container cloud environment, including the permissions of processes within the container and the cloud platform environment information to which it belongs.

[0100] Specifically, the security threat intelligence includes escape behavior of applications within containers, unauthorized access to resources by applications within containers, and exploitation of cloud platform access credentials.

[0101] Specifically, the threat intelligence collection module, based on eBPF technology, transmits and reports system calls, kprobe functions, tracepoints, and socket data sources to user-space programs through kernel buffers or the ebpf_map mechanism.

[0102] Specifically, the data tagging and formatting refers to formatting the raw data into time-series log data according to multiple dimensions such as process name, function call chain, and call frequency, so as to facilitate subsequent analysis and judgment.

[0103] Specifically, the threat intelligence analysis rules refer to the built-in rules for analyzing security threats in container cloud environments, as well as user-defined rules. These user-defined rules can be declared and created when the invention is launched.

[0104] Specifically, the built-in rules for analyzing security threats in container cloud environments include: rules for common container escape behaviors, rules for common sensitive resource access, rules for kernel function context-sensitive calls, rules for common high-risk cloud resource paths, and rules for sudden high-frequency calls based on call frequency.

[0105] Specifically, the visualization tool refers to the open-source tool Prometheus. This invention formats the raw data and the analyzed container cloud security threat intelligence into indicator information, and quickly presents a visual dashboard through Prometheus, which can be seamlessly integrated with the cloud-native environment.

[0106] Specifically, the alarm system refers to an alarm system that can automatically trigger alarm events based on top-level threat intelligence of the container cloud environment. It can filter relevant alarms using a whitelist configuration, or users can configure specific alarm methods themselves.

[0107] A container cloud environment security threat visualization and alerting system provided by the present invention includes:

[0108] Container cloud security data acquisition module: Automatically determines the current system environment, starts a compatible acquisition module, tags the acquired data and passes it to the user-space program. The user-space program automatically collects the acquired data and tags it, completing the data acquisition work.

[0109] Container cloud security data analysis module: Further analyzes the data collected in the previous stage, and obtains threat intelligence of the current container cloud environment based on multiple dimensions such as time, call frequency, and accessed resources.

[0110] The container cloud security data visualization and alerting module: It unifies and visualizes the raw indicators collected and the threat intelligence obtained from analysis, making it easy to quickly locate problems and assess the security status of the current container cloud environment.

[0111] The preferred embodiments of the present invention will be further described below.

[0112] Step one: Deploy this invention in any container cloud environment. This invention will automatically collect various basic information about the current environment, including the kernel version, architecture information, and cloud platform information. Based on this information, corresponding security collection modules will be activated. These modules are packaged in the binary files provided by this invention and can be loaded as needed according to the current environment.

[0113] Step 2: Collect data from the container cloud security collection module. This module uses the eBPF tool to collect raw data related to container cloud security, such as system calls exposed in the system kernel, kprobe kernel hooks, and tracepoints.

[0114] These raw data are sent to the user-space process via ebpf_map and kernel buffer for further parsing and transformation.

[0115] Step three involves transforming the raw data collected in the previous step into time-series data metrics that can be stored in a structured manner. The raw data changes over time, and time-series tags are added through periodic sampling to convert it into metrics. During this process, the user-space program reads data from the kernel-space ebpf_map and parses it using a predefined configuration file. This step parses the structured data in ebpf_map into process execution context information, tagging each piece of information with the corresponding process context information, including but not limited to the process name, executable file, open file handles, accessed resource information, and process privilege information. Then, corresponding event information is added to facilitate the conversion into time-series information.

[0116] Specifically, time sampling is used to transform raw data into time-series data;

[0117] Specifically, the automatic addition of context is implemented by re-defining the original data in ebpf_map through the user-space "built-in configuration file". Once defined, it becomes the program context.

[0118] Step four involves activating the built-in rule analyzer for analyzing container cloud security threat intelligence to process the raw security indicators: continuously reading raw security indicator information, filtering applications within containers by container namespace, and extracting all indicator context information corresponding to a process within a container based on process PID information; then, using built-in container security risk policies, including strategies such as accessing sensitive resources through high-risk system calls, attempting to acquire high-privilege capabilities, attempting to create connections to unfamiliar IP addresses, initiating high-risk requests to the container engine or container scheduling platform, attempting to execute kernel vulnerability call chains under existing feature libraries, accessing and reading files with cloud platform credentials and uploading or exploiting them, frequently performing system environment scanning operations, and periodically triggered malicious kernel function calls, as well as other user-selectable strategies, to comprehensively evaluate the relevant threat intelligence. This invention models common container environment threats, with basic security indicator information including file access, process creation, network traffic, file system mounting, file link creation, and file renaming. The characteristics of threats in the container environment can be expressed using combinations of basic security information indicators. Once these combinations of indicator information are recorded, it can be determined that high-risk behavior has occurred within the container. Analyze threat intelligence regarding security risks such as container escape, lateral movement of containers, and access to cloud platform resources. The threat intelligence analysis method here is the same as above;

[0119] The threat intelligence specifically refers to the threats related to container escape, access to sensitive resources, lateral movement of containers, and access to cloud platform resources mentioned above.

[0120] Step 5: Integrate the raw data metrics and container cloud security threat metrics obtained in Steps 3 and 4 into the visualization alerting platform. This visualization alerting platform can periodically capture metrics from many nodes, centrally store and display the corresponding metric information.

[0121] The visualization platform provides a comprehensive overview of system call frequency changes over a given period. For high-risk system calls, it displays the resource information accessed by the call and the context of the dangerous operation. For threat intelligence, the platform provides a summary of the information, process context, the reason for triggering the threat intelligence, potential security vulnerabilities, and mitigation solutions.

[0122] Step Six: The visualization system of this invention will automatically connect to the alarm system. When high-risk threat intelligence such as container escape, access to sensitive resources, lateral movement of the cluster, or access to the cloud platform AccessKey is detected, the corresponding callback function can be automatically triggered to issue an alarm. In other words, the high-risk refers to high-level dangers involving container escape, access to sensitive resources, lateral movement of the cluster, and access to the cloud platform AccessKey that affect system security.

[0123] In other words, container applications scanning permissions and sending abnormal traffic are considered low-level threats; attempts to escape containers or move laterally are considered medium-level threats; and successful escape of containers, lateral movement, and access to sensitive node resources or cloud platform AccessKeys are considered high-level threats. Users can customize the threat level to trigger an alert and the contact method after triggering an alert.

[0124] It supports blacklists and whitelists for alerts, allowing certain processes to execute corresponding policies without triggering alerts. It also supports automatic blocking policies, meaning that when a high-risk operation is triggered, it supports emergency response measures such as directly rescheduling a container or disconnecting network connections to reduce the hazard radius.

[0125] The present invention also provides a container cloud environment security threat visualization and alarm system. The container cloud environment security threat visualization and alarm system can be implemented by executing the process steps of the container cloud environment security threat visualization and alarm method. That is, those skilled in the art can understand the container cloud environment security threat visualization and alarm method as a preferred embodiment of the container cloud environment security threat visualization and alarm system.

[0126] A container cloud environment security threat visualization and alerting system provided by the present invention includes:

[0127] Module M1: Collects environmental information and raw data;

[0128] Module M2: Converts the environmental information and the raw data into time-series data;

[0129] Module M3: Marks the time-series data, analyzes the time-series data, and obtains threat intelligence;

[0130] Module M4: Visualizes the raw data and threat intelligence, and issues warnings.

[0131] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0132] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method for visualizing and alerting security threats in a container cloud environment, characterized in that, Comprising: Step S1: collecting environment information and raw data; Step S2: converting the environment information and the raw data into time series data; Step S3: marking the time series data, analyzing the time series data, and obtaining threat intelligence; Step S4: visualizing the raw data and the threat intelligence and issuing a warning; In the step S1, the environment information includes: the current environment kernel version, the architecture information of the current environment, and the cloud platform information of the current environment; The raw data includes: system calls, kprobe kernel hooks, and tracepoints; In the step S3, comprising: The time series data; Step S3.1: marking interval recording points, grabbing security indicator data, and obtaining the security indicator data of the interval time period after the difference between adjacent two recording points, and obtaining all the security indicator data; Step S3.2: according to the built-in rules or custom rules, judging whether the security indicator data is combined to express the threat behavior of the container environment; the result is yes, then the threat intelligence is obtained; the result is no, then it is not processed; In the step S3.1, the security indicator data of different containers is filtered through the file system namespace mnt_ns; The security indicator data includes: file access, process creation, network traffic, file system mounting, file link creation, and file renaming; The threat behavior is determined according to the built-in rules or the custom rules; The built-in rules include: container escape related rules, sensitive resource access related rules, kernel function context related rules, and high-risk cloud platform access path related rules; The container escape related rules include: "process in container uses Capabilities to run process with host root user level permission" and "mounts host file system"; The sensitive resource access related rules include: "accesses host password hash", "accesses / etc / sudoers configuration file"; The kernel function context related rules include: "kernel function read-write", "kernel function execution"; The high-risk cloud platform access path related rules include: "accesses cloud platform metadata server", "steals cloud platform access credential AccessKey".

2. The container cloud environment security threat visualized alerting method of claim 1, wherein, In the step S3, according to the container security risk policy, the time series data is filtered in real time to obtain threat intelligence; The container security risk policy includes: "high-risk system call accesses sensitive resource", "attempts to obtain high permission Capabilities", "attempts to create connection to unknown IP address", "initiates high-risk request to container engine or container scheduling platform", "attempts to execute kernel vulnerability call chain in existing feature library", "accesses and reads file with cloud platform credential and uploads or utilizes", "high frequency execution of system internal environment scanning operation", and "timed triggered kernel function malicious call".

3. A container cloud environment security threat visualized alerting system, characterized in that, Comprising: Module M1: collecting environment information and raw data; Module M2: converting the environment information and the raw data into time series data; Module M3: labeling the time series data, analyzing the time series data to obtain threat intelligence; Module M4: visualizing the raw data and the threat intelligence and issuing a warning; In the module M1, the environment information includes: a current environment kernel version, architecture information of the current environment, and cloud platform information of the current environment; The raw data includes: system calls, kprobe kernel hooks, and tracepoints; In the module M3, it includes: The time series data; Module M3.1: labeling interval recording points, capturing security indicator data as security indicator data of an interval period obtained by subtracting adjacent two recording points, and obtaining all the security indicator data; Module M3.2: determining whether the security indicator data is combined to express a threat behavior of a container environment according to built-in rules or custom rules; if the result is yes, threat intelligence is obtained; if the result is no, it is not processed; In the module M3.1, the security indicator data of different containers is filtered through a file system namespace mnt_ns; The security indicator data includes: file access, process creation, network traffic, file system mounting, file link creation, and file renaming; The threat behavior is determined according to the built-in rules or the custom rules; The built-in rules include: container escape related rules, sensitive resource access related rules, kernel function context related rules, and high-risk cloud platform access path related rules; The container escape related rules include: "a process in a container uses Capabilities to run a process with the root user level permission of a host computer" and "mounts a file system of a host computer"; The sensitive resource access related rules include: "accesses a password hash of a host computer" and "accesses an / etc / sudoers configuration file"; The kernel function context related rules include: "kernel function read-write" and "kernel function execution"; The high-risk cloud platform access path related rules include: "accesses a cloud platform metadata server" and "steals a cloud platform access credential AccessKey".

4. The container cloud environment security threat visualized alerting system of claim 3, wherein, In the module M3, the time series data is filtered in real time to obtain threat intelligence according to a container security risk policy; The container security risk policy includes: "high-risk system call access to sensitive resources", "attempt to obtain high permission Capabilities", "attempt to create a connection to a strange IP address", "initiate a high-risk request to a container engine or a container scheduling platform", "attempt to execute a kernel vulnerability call chain in an existing feature library", "access and read a file with a cloud platform credential and upload or utilize", "high-frequency execution of system internal environment scanning operations", and "timed triggering of malicious kernel function calls".

5. A computer readable storage medium storing a computer program, characterized in that, The computer program is executed by a processor to implement the steps of the container cloud environment security threat visualization and warning method of any one of claims 1 to 2.

6. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is executed by a processor to implement the steps of the container cloud environment security threat visualization and warning method of any one of claims 1 to 2.

Images