Vulnerability detection method and device

Abstract

The invention discloses a vulnerability detection method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of obtaining a to-be-detected container mirror image package; analyzing the container mirror image packet to obtain an abstract value of each mirror image layer contained in the container mirror image packet; for each mirror image layer, scanning the mirror image layer according to the corresponding abstract value, and obtaining files contained in the mirror image layer and a dependency relationship between the mirror image layer and other mirror image layers; and performing vulnerability detection on the file in the mirror image layer according to the dependency relationship and a preset vulnerability library to obtain a vulnerability detection result of the mirror image layer. According to the vulnerability detection method and device, accurate and fine-grained vulnerability detection is achieved, the mirror image layers in the container mirror image package serve as a detection unit, the dependency relationship between the mirror image layers is combined, accurate hierarchical vulnerability detection is conducted, the detection accuracy is improved, the mirror image layers where vulnerabilities are introduced can be accurately positioned, and then the vulnerabilities can be more conveniently and rapidly repaired.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a vulnerability detection method and device. Background Art

[0002] With the widespread adoption of container technology, container security issues have become increasingly prominent, especially the security of container images has become an important concern, and checking whether there are security vulnerabilities in container images is an important means to solve image security issues. Existing technologies usually perform overall vulnerability detection on the entire container image to obtain vulnerabilities in the container image.

[0003] In the process of implementing the present invention, the inventors found that the prior art has the following problems:

[0004] The overall vulnerability detection method can only identify the vulnerabilities in the container image, but cannot accurately determine the specific ownership of the vulnerability problem, which is not conducive to locating the source of the vulnerability and cannot meet actual needs well. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a method and device for vulnerability detection, which realizes accurate and fine-grained vulnerability detection. The image layer in the container image package is used as the detection unit, and the dependency relationship between the image layers is combined to perform accurate hierarchical vulnerability detection, which not only improves the accuracy of detection, but also can accurately locate the image layer that introduces the vulnerability, thereby making it easier to quickly repair the vulnerability.

[0006] To achieve the above object, according to one aspect of an embodiment of the present invention, a vulnerability detection method is provided, comprising:

[0007] Get the container image package to be tested;

[0008] Parsing the container image package to obtain a summary value of each image layer contained in the container image package;

[0009] For each of the image layers, the image layer is scanned according to the corresponding digest value to obtain the files contained in the image layer and the dependency relationship between the image layer and other image layers; according to the dependency relationship and the preset vulnerability library, vulnerability detection is performed on the files in the image layer to obtain the vulnerability detection result of the image layer, and then the vulnerability detection results of each of the image layers are obtained.

[0010] Optionally, after obtaining the files contained in the image layer and the dependency relationship between the image layer and other image layers, the method includes: determining the corresponding image layer identifier according to the summary value of the image layer; extracting the information of the files in the image layer to obtain image layer file information, and attaching the image layer file information to the image layer identifier; using the image layer identifier as an index and the dependency relationship between the image layer and other image layers as a corresponding index value, establishing an image layer dependency cache table, wherein the dependency relationship includes file information in the dependent image layer of the image layer.

[0011] Optionally, according to the dependency relationship and a preset vulnerability library, vulnerability detection is performed on files in the image layer to obtain vulnerability detection results of the image layer, including: reading image layer file information on the image layer identifier corresponding to the image layer and file information of the dependent image layer corresponding to the image layer identifier from the image layer dependency cache table; comparing the image layer file information with the file information of the dependent image layer to obtain the status of each file in the image layer; and according to the status of each file, performing file matching on each file in the image layer and the vulnerability library to obtain the vulnerability detection result of the image layer.

[0012] Optionally, according to the status of each of the files, each file in the image layer is matched with the vulnerability library to obtain a vulnerability detection result of the image layer, including: matching the file name of each file in the image layer with the vulnerability file name in the vulnerability library, and detecting whether there is a file vulnerability in the image layer that matches the vulnerability file name; in response to the existence of a file vulnerability in the image layer, associating the status of the file corresponding to the file vulnerability with the file vulnerability to obtain a file vulnerability detection result of the image layer, wherein the status of the file includes addition and modification.

[0013] Optionally, the vulnerability library is a component vulnerability library; based on the dependency relationship and the preset vulnerability library, vulnerability detection is performed on the files in the image layer, including: performing software component analysis on each file in the image layer to obtain components corresponding to each file; matching the components corresponding to each file in the image layer with the component vulnerability library, and detecting component vulnerabilities corresponding to each file in the image layer.

[0014] Optionally, scanning the image layer according to the corresponding digest value to obtain the files contained in the image layer includes: searching for the storage path of the image layer according to the digest value; accessing the storage path, and identifying the files contained in the image layer from the storage path.

[0015] Optionally, before scanning the image layer according to the corresponding digest value, the method further includes: determining that there is no preset exemption command in the metadata of the image layer; in response to the presence of a preset exemption command in the metadata of the image layer, skipping the image layer and not performing vulnerability detection.

[0016] Optionally, after obtaining the vulnerability detection results of each of the image layers, the method further includes: obtaining vulnerability information according to the received vulnerability reverse query request; querying the target vulnerability detection result consistent with the vulnerability information from the vulnerability detection results of each of the image layers; and using the image layer corresponding to the target vulnerability detection result as the result of the vulnerability reverse query request.

[0017] According to a second aspect of an embodiment of the present invention, there is provided a vulnerability detection device, comprising:

[0018] A container image acquisition module is used to obtain the container image package to be tested;

[0019] A summary value acquisition module, used to parse the container image package to obtain the summary value of each image layer contained in the container image package;

[0020] The image layer detection module is used to scan the image layer according to the corresponding summary value for each of the image layers, obtain the files contained in the image layer, and the dependency relationship between the image layer and other image layers; perform vulnerability detection on the files in the image layer according to the dependency relationship and a preset vulnerability library, obtain the vulnerability detection result of the image layer, and then obtain the vulnerability detection results of each of the image layers.

[0021] Optionally, the vulnerability detection device also includes a cache module, which is used to: after obtaining the files contained in the image layer and the dependency relationship between the image layer and other image layers, determine the corresponding image layer identifier according to the summary value of the image layer; extract the information of the files in the image layer to obtain the image layer file information, and attach the image layer file information to the image layer identifier; use the image layer identifier as an index and the dependency relationship between the image layer and other image layers as a corresponding index value to establish an image layer dependency cache table, wherein the dependency relationship includes file information in the dependent image layer of the image layer.

[0022] Optionally, the image layer detection module is also used to: read the image layer file information on the image layer identifier corresponding to the image layer, and the file information of the dependent image layer corresponding to the image layer identifier from the image layer dependency cache table; compare the image layer file information with the file information of the dependent image layer to obtain the status of each file in the image layer; according to the status of each of the files, perform file matching on each file in the image layer and the vulnerability library to obtain the vulnerability detection result of the image layer.

[0023] Optionally, the image layer detection module is also used to: match the file names of each file in the image layer with the vulnerability file names in the vulnerability library, and detect whether there is a file vulnerability in the image layer that matches the vulnerability file name; in response to the existence of a file vulnerability in the image layer, associate the status of the file corresponding to the file vulnerability with the file vulnerability, and obtain the file vulnerability detection result of the image layer, wherein the status of the file includes addition and modification.

[0024] Optionally, the vulnerability library is a component vulnerability library; the image layer detection module is also used to: perform software component analysis on each file in the image layer to obtain components corresponding to each file; perform component matching between the components corresponding to each file in the image layer and the component vulnerability library, and detect component vulnerabilities corresponding to each file in the image layer.

[0025] Optionally, the image layer detection module is further used to: search for a storage path of the image layer according to the digest value; access the storage path, and identify files included in the image layer from the storage path.

[0026] Optionally, the vulnerability detection device also includes a detection confirmation module, which is used to: before scanning the image layer according to the corresponding digest value, determine whether there is a preset exemption command in the metadata of the image layer; in response to the presence of a preset exemption command in the metadata of the image layer, skip the image layer and do not perform vulnerability detection.

[0027] Optionally, the vulnerability detection device also includes a vulnerability reverse query module, which is used to: after obtaining the vulnerability detection results of each of the image layers, obtain vulnerability information according to the received vulnerability reverse query request; query the target vulnerability detection result consistent with the vulnerability information from the vulnerability detection results of each of the image layers; and use the image layer corresponding to the target vulnerability detection result as the result of the vulnerability reverse query request.

[0028] According to a third aspect of an embodiment of the present invention, there is provided an electronic device for vulnerability detection, comprising:

[0029] one or more processors;

[0030] a storage device for storing one or more programs,

[0031] When the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in the first aspect of the embodiment of the present invention.

[0032] According to a fourth aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present invention is implemented.

[0033] According to a fifth aspect of an embodiment of the present invention, there is provided a computer program product, including a computer program, wherein when the computer program is executed by a processor, the method provided in the first aspect of the embodiment of the present invention is implemented.

[0034] An embodiment of the invention has the following advantages or beneficial effects: by obtaining a container image package to be detected; parsing the container image package to obtain summary values ​​of each image layer contained in the container image package; for each image layer, scanning the image layer according to the corresponding summary value to obtain the files contained in the image layer, and the dependency relationship between the image layer and other image layers; performing vulnerability detection on the files in the image layer according to the dependency relationship and a preset vulnerability library to obtain the vulnerability detection result of the image layer, and then obtaining the vulnerability detection result of each image layer. A technical solution realizes an accurate and fine-grained vulnerability detection method, using the image layer in the container image package as the detection unit, and combining the dependency relationship between the image layers to perform accurate hierarchical vulnerability detection, which not only improves the accuracy of detection, but also can accurately locate the image layer that introduces the vulnerability, thereby making it easier to quickly repair the vulnerability. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0036] Figure 1 is a schematic diagram of the main process of the vulnerability detection method according to an embodiment of the present invention;

[0037] Figure 2 is a flow chart of a vulnerability detection method according to a reference embodiment of the present invention;

[0038] Figure 3 Schematic diagram of the principle of the vulnerability detection method of the embodiment of the present invention;

[0039] Figure 4 is a schematic diagram of main modules of a device for vulnerability detection according to an embodiment of the present invention;

[0040] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0041] Figure 6 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0042] It should be noted that the acquisition, storage and application of user personal information involved in the technical solution of the present disclosure are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0043] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0044] The current overall vulnerability detection method can only identify the vulnerabilities in the container image, but cannot accurately determine the specific ownership of the vulnerability problem, which is not conducive to locating the source of the vulnerability and cannot meet actual needs well.

[0045] In order to solve the above problems existing in the prior art, the present invention proposes a vulnerability detection method, which obtains the files of each image layer and the dependency relationship between other image layers based on the summary value of each image layer in the container image package obtained by parsing, and then performs hierarchical vulnerability detection on the files of each image layer according to the dependency relationship, thereby realizing accurate and fine-grained vulnerability detection. The image layer in the container image package is used as the detection unit, and accurate hierarchical vulnerability detection is performed in combination with the dependency relationship between the image layers. Not only the accuracy of the detection is improved, but also the image layer that introduces the vulnerability can be accurately located, thereby making it easier to quickly repair the vulnerability.

[0046] Figure 1 FIG. 1 is a schematic diagram of the main process of the vulnerability detection method according to an embodiment of the present invention. Figure 1 As shown, the vulnerability detection method of the embodiment of the present invention includes the following steps S101 to S103.

[0047] Step S101: Obtain a container image package to be detected.

[0048] Specifically, container technology allows applications to be packaged with their environment to ensure that they run consistently in various environments. The container image is the core of this packaging, which includes the code, runtime system tools, system libraries, and settings required for the application to run. With the promotion and application of container technology, container security issues, especially the security of container images, have become an important concern. An embodiment of the present invention aims to provide a vulnerability detection method for a container image package. After receiving a vulnerability detection task for a container image package, the storage location of the container image package to be detected is obtained by parsing the vulnerability detection task, and the storage location is accessed to pull or load the container image package to be detected to the local. Specifically, the pull command of the application container engine Docker can be used to pull the container image package to the local, or the load command can be used to load the container image package to the local.

[0049] Step S102: Parse the container image package to obtain a summary value of each image layer contained in the container image package.

[0050] Specifically, the embodiment of the present invention determines the vulnerability detection method from the perspective of the construction principle of the container image package, and granularizes the container image package into a hierarchical architecture. Usually, the bottom layer of the container image package is an operating system layer, the upper image layer contains the operating environment, and the upper layer is the application code. These layers are superimposed together when building the image to form a container image package that can be deployed in the end.

[0051] The vulnerability detection system uses the history command of the application container engine Docker to view the historical layer information of the specified container image package. Through this command, you can obtain layer information such as the creation time, size, and comments of each image layer of the container image package, and generate a summary value for the corresponding image layer based on the layer information.

[0052] Step S103: For each of the image layers, scan the image layer according to the corresponding digest value to obtain the files contained in the image layer and the dependency relationship between the image layer and other image layers; perform vulnerability detection on the files in the image layer according to the dependency relationship and a preset vulnerability library to obtain the vulnerability detection result of the image layer, and then obtain the vulnerability detection results of each of the image layers.

[0053] Specifically, based on the summary value of each image layer in the container image package obtained above, the creation time of each image layer is extracted, and the hierarchical position of each image layer in the container image package is determined according to the creation time. According to the determined hierarchical position, the bottom image layer is used as the detection starting point, and each image layer is detected layer by layer from bottom to top.

[0054] For each detected image layer, first scan and obtain the files contained in the image layer and the dependency relationship between the image layer and other image layers, such as the dependent image layer in which the image layer has a dependency relationship with other image layers, and the information of the files contained in the dependent image layer. At the same time, establish the association relationship between each scanned file and the image layer, and the association relationship between the dependency relationship and the image layer, so as to clarify the attribution of the scanning results. Furthermore, according to the preset vulnerability library, vulnerability detection is performed on the files in the image layer, and then the vulnerability detection results of the image layer are generated according to the information of the files in the dependent image layer in the dependency relationship.

[0055] Finally, the vulnerability detection results of each image layer are summarized to obtain the vulnerability detection results of each image layer in the container image package.

[0056] The embodiment of the present invention fully considers the dependencies between various image layers, and also adds the dependencies to the vulnerability detection of each image layer, thereby clarifying the impact domain of the vulnerability problem and the introduction layer of the vulnerability problem, thereby realizing accurate and fine-grained vulnerability detection.

[0057] According to one embodiment of the present invention, before scanning the image layer according to the corresponding digest value, the method also includes: determining that there is no preset exemption command in the metadata of the image layer; in response to the presence of a preset exemption command in the metadata of the image layer, skipping the image layer and not performing vulnerability detection.

[0058] Specifically, in order to improve the efficiency of vulnerability detection, the execution commands of some image layers are mostly used for testing and are used very rarely, and in order to better adapt to the needs of different business scenarios, the commands executed by individual image layers in some business scenarios are not closely related to the business scenarios, so the embodiment of the present invention collects the free-test command set composed of free-test commands in advance. Before scanning the image layer according to the corresponding summary value, the free-test command set is called, and it is determined that there is no free-test command in the metadata of the current image layer, which means that the current image layer needs to perform hierarchical vulnerability detection. Accordingly, if there is a free-test command in the metadata of the current image layer, it means that the current image layer does not need to perform vulnerability detection, and the image layer is skipped and no vulnerability detection is performed.

[0059] According to another embodiment of the present invention, scanning the image layer according to the corresponding digest value to obtain the files contained in the image layer includes: searching for the storage path of the image layer according to the digest value; accessing the storage path, and identifying the files contained in the image layer from the storage path.

[0060] Specifically, based on the summary values ​​of each image layer obtained by parsing the container image package as above, the local storage path of the image layer is found through the summary value. Then the storage path is accessed, the content in the storage path is scanned, all files are identified therefrom, and the association relationship between the file and the image layer is established, and all files contained in the image layer are clarified. In addition, for image layers with dependencies, the image layers on which they depend, that is, the dependent image layers, are also stored in the image layers, and the information of the files contained in the dependent image layers (such as file name, file version number, file size, etc.) is also recorded here. The embodiment of the present invention uses the dependent image layers of the current image layer and the file information of the dependent image layers as dependencies.

[0061] According to another embodiment of the present invention, the vulnerability library is a component vulnerability library; based on the dependency relationship and the preset vulnerability library, vulnerability detection is performed on the files in the image layer, including: performing software component analysis on each file in the image layer to obtain components corresponding to each file; matching the components corresponding to each file in the image layer with the component vulnerability library, and detecting component vulnerabilities corresponding to each file in the image layer.

[0062] Specifically, in addition to performing vulnerability detection on files in each image layer, the embodiments of the present invention can also perform vulnerability detection on components corresponding to the files in a more fine-grained manner. Software component analysis (SCA) technology is used to perform software component analysis on each file in the image layer to obtain components corresponding to each file. The components corresponding to each file are then matched with the component vulnerability library by component name or component ID, and the component vulnerabilities existing in the current image layer are determined by matching to provide more fine-grained vulnerability detection.

[0063] It can be understood that the methods for detecting various vulnerabilities of files in each image layer in the embodiments of the present invention are applicable to vulnerability detection of components. As long as the vulnerability library includes a component vulnerability library, hierarchical component vulnerability detection can be performed on the container image package according to the vulnerability detection method provided in the embodiments of the present invention.

[0064] According to another embodiment of the present invention, after obtaining the vulnerability detection results of each of the image layers, the method further includes: obtaining vulnerability information according to the received vulnerability reverse query request; querying the target vulnerability detection result consistent with the vulnerability information from the vulnerability detection results of each of the image layers; and using the image layer corresponding to the target vulnerability detection result as the result of the vulnerability reverse query request.

[0065] Specifically, based on the vulnerability detection results of each mirror layer obtained by the hierarchical vulnerability detection of the embodiment of the present invention, the embodiment of the present invention also has a vulnerability reverse query capability. After obtaining the vulnerability detection results of each mirror layer, parse the received vulnerability reverse query request to obtain relevant information of the vulnerability to be reversed, such as the vulnerability file or vulnerability component name, vulnerability category, vulnerability characteristics, etc. According to the vulnerability information, query the target vulnerability detection results that are consistent with the vulnerability information from the vulnerability detection results of each mirror layer, that is, according to the vulnerability information, reverse query the source of the vulnerability information from the vulnerability detection results. The mirror layer where the queried target vulnerability detection result is located is returned to the vulnerability reverse query requester, which realizes the precise positioning of the vulnerability problem, and then the vulnerability can be repaired efficiently and quickly to avoid business impact.

[0066] Figure 2 is a flow chart of a vulnerability detection method according to a reference embodiment of the present invention. As another embodiment of the present invention, Figure 2 As shown, the vulnerability detection method may include:

[0067] Step S201: Obtain the container image package to be detected.

[0068] Step S202: Parse the container image package to obtain a summary value of each image layer contained in the container image package.

[0069] Step S203: For each of the image layers, scan the image layer according to the corresponding digest value to obtain files contained in the image layer and dependencies between the image layer and other image layers.

[0070] Step S204: determine the corresponding image layer identifier according to the summary value of the image layer; extract the information of the file in the image layer to obtain the image layer file information, and attach the image layer file information to the image layer identifier; use the image layer identifier as an index and the dependency relationship between the image layer and other image layers as a corresponding index value to establish an image layer dependency cache table, where the dependency relationship includes file information in the dependent image layer of the image layer.

[0071] Specifically, since the layered vulnerability detection needs to take into account the dependencies between image layers, in order to relieve the pressure on the vulnerability detection system and improve the efficiency of vulnerability detection, after obtaining the files contained in the image layer and the dependencies between the image layer and other image layers, a unique identification code generation tool is used to generate the corresponding image layer ID according to the summary value of the image layer. At the same time, the information of the files in the current image layer is extracted, such as the file name, file version, file size, etc., to form the image layer file information, and the extracted image layer file information is attached to the image layer ID to complete the construction of the cache data related to the current image layer.

[0072] Furthermore, the embodiment of the present invention uses the above-mentioned image layer ID with image layer file information as the key, and the dependency of the image layer as the corresponding value, to establish a key-value pair relationship, and stores it in a pre-established image layer dependency cache table, so that when performing vulnerability detection on the image layer, the corresponding dependency can be quickly and accurately queried from the image layer dependency cache table through the image layer ID, while alleviating the pressure on the vulnerability detection system.

[0073] Step S205: read the image layer file information on the image layer identifier corresponding to the image layer and the file information of the dependent image layer corresponding to the image layer identifier from the image layer dependency cache table; compare the image layer file information and the file information of the dependent image layer to obtain the status of each file in the image layer.

[0074] Specifically, based on the files and dependencies obtained by scanning the image layer, vulnerability detection is performed on the image layer. The image layer file information on the current image layer ID and the dependency corresponding to the image layer ID are read from the above-mentioned image layer dependency cache table, and the dependency includes a specific dependent image layer and the file information of the dependent image layer. Compare the image layer file information and the file information of the dependent image layer to determine whether each file of the current image layer has a dependency relationship with each file in the dependent image layer, and determine the status of each file. If a file of the image layer is not in the file information of the dependent image layer, it can be determined that the file is a new file of the current image layer; if it is consistent with the file information of the dependent image layer, it means that the file of the image layer is a file that references the dependent image layer, and the vulnerability detection result of the file in the dependent image layer can be directly used; if it is the same as the file name in the file information of the dependent image layer, but the version is different, then it means that the file of the image layer is an updated file of the file in the dependent image layer; in addition, if the file in the dependent image layer does not appear in the image layer file information of the current image layer, it means that the current image layer has deleted the file. Combining these comparison results, the status of each file in the image layer is obtained.

[0075] Step S206: Match the file names of each file in the image layer with the vulnerability file names in the vulnerability library to detect whether there is a file vulnerability in the image layer that matches the vulnerability file name.

[0076] Specifically, the vulnerability library of the embodiment of the present invention can be a file vulnerability library or a component vulnerability library. The file vulnerability library is used to detect whether there are vulnerabilities in each file in the image layer, and the component vulnerability library is used to detect whether there are vulnerabilities in each component in the image layer. The construction of the vulnerability library is continuously updated and improved based on business experience and historical vulnerabilities, and the information of the discovered vulnerability files or vulnerability components (such as file name, component name, file identifier, component identifier, etc.) is added to the vulnerability library. Preferably, the vulnerability library can be constructed according to preset sorting rules, such as storing vulnerability files of the same category in a table, or storing them in groups according to the business scope described in the vulnerability file, so as to improve matching efficiency.

[0077] Furthermore, the file names of each file in the image layer are matched with the vulnerability file names in the vulnerability library. If a match is found, it means that the file in the image layer is a vulnerable file. If no match is found, it means that no vulnerability has been detected in the file in the image layer, and the file does not have a vulnerability risk and is a safe file.

[0078] Step S207: In response to the existence of a file vulnerability in the image layer, the status of the file corresponding to the file vulnerability is associated with the file vulnerability to obtain the file vulnerability detection result of the image layer, and then the vulnerability detection results of each of the image layers are obtained, wherein the status of the file includes addition and modification.

[0079] Specifically, when a file in the image layer matches a vulnerable file from the vulnerability library, it is determined that there is a file vulnerability in the current image layer. Obtain the status of each file by comparing the image layer file information and the file information of the dependent image layer. Find the status of the file corresponding to the file vulnerability. At this time, it may be a newly added file or a modified and updated file. Since the directly referenced file can directly call the file vulnerability detection result of the dependent image layer after the above comparison, there is no need to consider this situation at this time. Correspondingly, compared to the files deleted from the dependent image layer, they no longer exist in the current image layer, so they do not need to be considered. Further, the file status is associated with the corresponding file vulnerability to obtain the final file vulnerability detection result of the image layer.

[0080] Figure 3: It is a schematic diagram of the principle of the vulnerability detection method of an embodiment of the present invention. The figure shows the vulnerability detection of components. Taking a container image package containing 4 layers of image layers as an example, the container image package is parsed to obtain the summary values ​​of each image layer contained in the container image package, and then the corresponding image layer ID is determined according to the summary value. For each image layer, the image layer is scanned according to the corresponding summary value, the files contained in the image layer are obtained, and the software component analysis is performed on each file to obtain the components corresponding to each file, and the association relationship between the image layer ID and each component is established. Combined with the dependency relationship between the image layer and other image layers, the components corresponding to each file in the image layer are matched with the vulnerability components in the component vulnerability library to obtain the component vulnerability detection results of the image layer. Finally, the component vulnerability detection results of each image layer are comprehensively summarized to obtain the component vulnerability detection results of each image layer in the container image package.

[0081] The embodiment of the present invention not only performs vulnerability detection on files of each image layer or components corresponding to the files, but also takes into account the dependency relationship between each image layer. By comparing the file information of two image layers with a dependency relationship, or comparing the component information of two image layers with a dependency relationship, it is determined that there is a file vulnerability or a component vulnerability in the current image layer, and the status of the file or component is also associated with the detected file vulnerability, so as to clarify whether the current file vulnerability is introduced due to addition or update, and to more accurately record the vulnerability information and the impact domain of the vulnerability, thereby realizing hierarchical and accurate vulnerability detection.

[0082] In addition, the vulnerability detection method provided by the embodiment of the present invention not only realizes the precise positioning of the vulnerability, but also identifies unnecessary duplicate files by comparing each image layer with the files of the image layer on which it depends, and deletes unnecessary duplicate files, thereby optimizing the construction of the container image package and reducing the size of the container image package.

[0083] At the same time, the embodiment of the present invention also solves the problem of incomplete detection in the existing overall vulnerability detection methods. In a container image package, for referenced files in an image layer with a dependency relationship, for example, image layer 4 references file 1 in its dependent image layer 2, then when image layer 4 deletes file 1, file 1 is not actually deleted, but marked as "deleted". Since file 1 has a mark, the file cannot be scanned when the vulnerability detection is performed on the entire container image package, resulting in incomplete detection. The hierarchical vulnerability detection method of the embodiment of the present invention uses the hierarchy as the vulnerability detection unit, and each image layer must perform vulnerability detection (except the image layer of the exempted command), which avoids the problem of incomplete detection and realizes comprehensive vulnerability detection of the container image package.

[0084] In summary, the embodiments of the present invention implement an accurate and fine-grained vulnerability detection method, which uses the image layer in the container image package as the detection unit and combines the dependencies between the image layers to perform accurate hierarchical vulnerability detection. This not only improves the accuracy of detection and accurately locates the image layer that introduces the vulnerability to facilitate rapid repair of the vulnerability, but also optimizes the construction of the container image package to avoid unnecessary duplicate files, while also truly achieving comprehensive vulnerability detection.

[0085] Figure 4 Schematic diagram of the main modules of the device for vulnerability detection according to an embodiment of the present invention. Figure 4 As shown, the vulnerability detection device 400 mainly includes a container image acquisition module 401, a container image acquisition module 402 and an image layer detection module 403.

[0086] The container image acquisition module 401 is used to acquire the container image package to be detected;

[0087] A digest value acquisition module 402 is used to parse the container image package to obtain the digest value of each image layer contained in the container image package;

[0088] The image layer detection module 403 is used to scan the image layer according to the corresponding summary value for each of the image layers, obtain the files contained in the image layer, and the dependency relationship between the image layer and other image layers; perform vulnerability detection on the files in the image layer according to the dependency relationship and a preset vulnerability library, obtain the vulnerability detection result of the image layer, and then obtain the vulnerability detection results of each of the image layers.

[0089] According to one embodiment of the present invention, the vulnerability detection device 400 also includes a cache module (not shown in the figure), which is used to: after obtaining the files contained in the image layer and the dependency relationship between the image layer and other image layers, determine the corresponding image layer identifier according to the summary value of the image layer; extract the information of the files in the image layer to obtain the image layer file information, and attach the image layer file information to the image layer identifier; use the image layer identifier as an index and the dependency relationship between the image layer and other image layers as a corresponding index value to establish an image layer dependency cache table, wherein the dependency relationship includes file information in the dependent image layer of the image layer.

[0090] According to another embodiment of the present invention, the image layer detection module 403 is also used to: read the image layer file information on the image layer identifier corresponding to the image layer, and the file information of the dependent image layer corresponding to the image layer identifier from the image layer dependency cache table; compare the image layer file information with the file information of the dependent image layer to obtain the status of each file in the image layer; according to the status of each of the files, perform file matching on each file in the image layer and the vulnerability library to obtain the vulnerability detection result of the image layer.

[0091] According to another embodiment of the present invention, the image layer detection module 403 is further used to: match the file names of each file in the image layer with the vulnerability file names in the vulnerability library, and detect whether there is a file vulnerability in the image layer that matches the vulnerability file name; in response to the existence of a file vulnerability in the image layer, associate the status of the file corresponding to the file vulnerability with the file vulnerability, and obtain the file vulnerability detection result of the image layer, wherein the status of the file includes addition and modification.

[0092] According to another embodiment of the present invention, the vulnerability library is a component vulnerability library; the image layer detection module 403 is further used to: perform software component analysis on each file in the image layer to obtain components corresponding to each file; perform component matching between the components corresponding to each file in the image layer and the component vulnerability library, and detect component vulnerabilities corresponding to each file in the image layer.

[0093] According to another embodiment of the present invention, the image layer detection module 403 is further used to: search for a storage path of the image layer according to the summary value; access the storage path, and identify files contained in the image layer from the storage path.

[0094] According to another embodiment of the present invention, the vulnerability detection device 400 also includes a detection confirmation module (not shown in the figure), which is used to: before scanning the image layer according to the corresponding digest value, determine whether there is a preset exemption command in the metadata of the image layer; in response to the presence of a preset exemption command in the metadata of the image layer, skip the image layer and do not perform vulnerability detection.

[0095] According to another embodiment of the present invention, the vulnerability detection device 400 also includes a vulnerability reverse query module (not shown in the figure), which is used to: after obtaining the vulnerability detection results of each of the image layers, obtain vulnerability information according to the received vulnerability reverse query request; query the target vulnerability detection result consistent with the vulnerability information from the vulnerability detection results of each of the image layers; and use the image layer corresponding to the target vulnerability detection result as the result of the vulnerability reverse query request.

[0096] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention can be applied.

[0097] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0098] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications, such as vulnerability detection applications, etc., can be installed on terminal devices 501, 502, 503 (only as an example).

[0099] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0100] Server 505 can be a server that provides various services, such as a background management server that provides support for vulnerability detection performed by users using terminal devices 501, 502, and 503 (only as an example). The background management server can obtain the container image package to be detected; parse the container image package to obtain the summary value of each image layer contained in the container image package; for each of the image layers, scan the image layer according to the corresponding summary value, obtain the files contained in the image layer, and the dependency relationship between the image layer and other image layers; perform vulnerability detection on the files in the image layer according to the dependency relationship and the preset vulnerability library, obtain the vulnerability detection result of the image layer, and then obtain the vulnerability detection result of each of the image layers, etc., and feed back the processing result (such as vulnerability detection result, etc. - only as an example) to the terminal device.

[0101] It should be noted that the vulnerability detection method provided in the embodiment of the present invention is generally executed by the server 505 , and accordingly, the vulnerability detection device is generally set in the server 505 .

[0102] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0103] Reference below Figure 6 , Figure 6 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. Figure 6 The terminal device or server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0104] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0105] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0106] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are executed.

[0107] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination thereof.

[0108] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0109] The units involved in the embodiments of the present invention may be implemented in software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor including: a container image acquisition module, a summary value acquisition module and an image layer detection module.

[0110] The names of these modules do not, in some cases, limit the modules themselves. For example, a container image acquisition module may also be described as a "module for acquiring a container image package to be detected."

[0111] On the other hand, the present invention also provides a computer-readable medium, which may be included in the device described in the embodiment; or it may exist independently without being assembled into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by a device, the device includes: obtaining a container image package to be detected; parsing the container image package to obtain the summary value of each image layer contained in the container image package; for each image layer, scanning the image layer according to the corresponding summary value, obtaining the files contained in the image layer, and the dependency relationship between the image layer and other image layers; according to the dependency relationship and the preset vulnerability library, performing vulnerability detection on the files in the image layer, obtaining the vulnerability detection result of the image layer, and then obtaining the vulnerability detection result of each image layer.

[0112] The technical solution according to the embodiment of the present invention has the following advantages or beneficial effects: by obtaining a container image package to be detected; parsing the container image package to obtain the summary value of each image layer contained in the container image package; for each image layer, scanning the image layer according to the corresponding summary value to obtain the files contained in the image layer, and the dependency relationship between the image layer and other image layers; performing vulnerability detection on the files in the image layer according to the dependency relationship and a preset vulnerability library to obtain the vulnerability detection result of the image layer, and then obtaining the vulnerability detection result of each image layer. The technical solution realizes an accurate and fine-grained vulnerability detection method, takes the image layer in the container image package as the detection unit, and combines the dependency relationship between the image layers to perform accurate hierarchical vulnerability detection, which not only improves the accuracy of the detection, but also can accurately locate the image layer that introduces the vulnerability, thereby making it easier to quickly repair the vulnerability.

[0113] The specific implementation methods described herein do not constitute limitations on the scope of protection of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A vulnerability detection method, characterized in that: include: Get the container image package to be tested; Parsing the container image package to obtain a summary value of each image layer contained in the container image package; For each of the image layers, the image layer is scanned according to the corresponding digest value to obtain the files contained in the image layer and the dependency relationship between the image layer and other image layers; according to the dependency relationship and the preset vulnerability library, vulnerability detection is performed on the files in the image layer to obtain the vulnerability detection result of the image layer, and then the vulnerability detection results of each of the image layers are obtained.

2. The method according to claim 1, characterized in that After obtaining the files contained in the image layer and the dependency relationship between the image layer and other image layers, the method includes: Determine a corresponding image layer identifier according to the summary value of the image layer; Extracting information of the file in the image layer to obtain image layer file information, and attaching the image layer file information to the image layer identifier; An image layer dependency cache table is established with the image layer identifier as an index and the dependency relationship between the image layer and other image layers as a corresponding index value, wherein the dependency relationship includes file information in the dependent image layer of the image layer.

3. The method according to claim 2, characterized in that According to the dependency relationship and the preset vulnerability library, vulnerability detection is performed on the files in the image layer to obtain the vulnerability detection result of the image layer, including: Read the image layer file information on the image layer identifier corresponding to the image layer and the file information of the dependent image layer corresponding to the image layer identifier from the image layer dependency cache table; Compare the image layer file information with the dependent image layer file information to obtain the status of each file in the image layer; According to the status of each of the files, each file in the image layer is matched with the vulnerability library to obtain a vulnerability detection result of the image layer.

4. The method according to claim 3, characterized in that: According to the status of each of the files, each file in the image layer is matched with the vulnerability library to obtain a vulnerability detection result of the image layer, including: Match the file names of each file in the image layer with the vulnerability file names in the vulnerability library, and detect whether there is a file vulnerability in the image layer that matches the vulnerability file name; In response to the existence of a file vulnerability in the image layer, the status of a file corresponding to the file vulnerability is associated with the file vulnerability to obtain a file vulnerability detection result of the image layer, wherein the status of the file includes addition and modification.

5. The method according to claim 1, characterized in that The vulnerability library is a component vulnerability library; According to the dependency relationship and the preset vulnerability library, vulnerability detection is performed on the files in the image layer, including: Performing software component analysis on each file in the image layer to obtain components corresponding to each file; Components corresponding to each file in the image layer are matched with the component vulnerability library to detect component vulnerabilities corresponding to each file in the image layer.

6. The method according to claim 1, characterized in that Scanning the image layer according to the corresponding digest value to obtain the files contained in the image layer includes: Find the storage path of the image layer according to the summary value; The storage path is accessed, and files contained in the image layer are identified from the storage path.

7. The method according to claim 1, characterized in that Before scanning the image layer according to the corresponding digest value, the method further includes: Determining that there is no preset test-free command in the metadata of the image layer; In response to a preset exemption command existing in the metadata of the image layer, the image layer is skipped and vulnerability detection is not performed.

8. The method according to claim 1, characterized in that: After obtaining the vulnerability detection results of each of the image layers, the method further includes: Obtain vulnerability information based on the received vulnerability reverse query request; Querying a target vulnerability detection result that is consistent with the vulnerability information from the vulnerability detection results of each of the image layers; The image layer corresponding to the target vulnerability detection result is used as the result of the vulnerability reverse query request.

9. A vulnerability detection device, characterized in that: include: A container image acquisition module is used to obtain the container image package to be detected; A summary value acquisition module, used to parse the container image package to obtain the summary value of each image layer contained in the container image package; The image layer detection module is used to scan the image layer according to the corresponding summary value for each of the image layers, obtain the files contained in the image layer, and the dependency relationship between the image layer and other image layers; perform vulnerability detection on the files in the image layer according to the dependency relationship and a preset vulnerability library, obtain the vulnerability detection result of the image layer, and then obtain the vulnerability detection results of each of the image layers.

10. A mobile electronic device terminal, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 8.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images