Threat assessment and multi-dimensional detection system and method for malicious container mirror image

Abstract

The invention provides a threat assessment and multi-dimensional detection system and method for a malicious container mirror image. The system comprises a user interaction node which is used for interacting with a user, sending various tasks, receiving corresponding results and outputting a detection report; the data acquisition node is used for downloading a mirror image description file and a mirror image configuration file from the container mirror image warehouse according to a data acquisition task, and downloading a mirror image layer file as required; the information analysis node is used for analyzing the multi-dimensional information of the container mirror image and extracting a command and a file which are executed by default when the container is started; and the threat detection node is used for analyzing the detected and extracted command and file and evaluating the threat degree of the container mirror image. According to the method, the file actually executed in the container mirror image is quickly positioned by analyzing the multi-dimensional information of the mirror image, threat evaluation and multi-dimensional detection of the malicious container mirror image can be realized without downloading the complete mirror image, the bandwidth and storage and computing resources in the mirror image detection process are greatly saved, and the malicious container mirror image is efficiently identified.

Description

Technical Field

[0001] The present invention relates to the technical field of container image security detection, and in particular to a threat assessment and multi-dimensional detection system and method for malicious container images. Background Art

[0002] In recent years, container technology has become the mainstream development and deployment model due to its advantages of easy deployment, sharing and simple operation during the development process. Containers are created and run based on images, which are mainly released and shared through centralized storage. Among them, Docker Hub is currently the largest public container image repository, officially maintained by Docker, hosting more than 10 million container images maintained by application officials and community users. Developers can freely build new images and upload them to the repository, and users can download images from the repository and run corresponding container instances on demand.

[0003] This sharing model has attracted the attention of attackers, who will build customized malicious images on a large scale and upload them to public image repositories, which may pose a security threat to users of container images. For example, attackers install the operating environment of mining software in the container image, configure the corresponding container instance to automatically start the mining software at runtime, and register a mainstream application name for the image in the repository to conceal the malicious purpose of the image. Since many users of container images do not have a deep understanding of the true content of the image before running the container, but directly refer to the image description and container startup command provided by the image developer, this will cause malicious containers to occupy the user's computing resources, profit for the attacker or achieve other attack purposes. Therefore, it is very necessary to be able to efficiently identify malware that may run in the container and evaluate the threat level of the image.

[0004] Through searching patent documents, it is found that the Chinese invention patent with publication number CN110008703A discloses a static detection method for malware in containers: by simulating the layer file mounting process of the container image to be detected, all executable files under the container perspective directory are extracted from the container image to be detected, and the API call sequence of these software is further extracted; a deep learning detection model is constructed and trained to obtain a hierarchical malware detection model; the extracted API call sequence is input into the hierarchical malware detection model to obtain the detection result. This type of method has a common problem, that is, it needs to consume a lot of storage and bandwidth resources to download the complete content of the image to the local test environment, and it is difficult to accurately locate the files that will be actually executed during the operation of the container, which requires a lot of computing resources and time costs to perform detection. Therefore, it is difficult to efficiently complete the large-scale malicious container image detection process.

[0005] In summary, in response to the above-mentioned problems of the prior art, studying a threat assessment and multi-dimensional detection system and method for malicious container images has become a key task that needs to be solved urgently. Summary of the invention

[0006] In view of the defects in the prior art, the purpose of the present invention is to provide a threat assessment and multi-dimensional detection system and method for malicious container images.

[0007] A threat assessment and multi-dimensional detection system for malicious container images provided by the present invention includes four nodes, namely a user interaction node, a data acquisition node, an information parsing node and a threat detection node, and the four nodes work together by exchanging data;

[0008] User interaction node: used for interaction with users, sending various tasks, receiving corresponding results and outputting detection reports. Various tasks include data acquisition tasks, information analysis tasks and threat detection tasks. The corresponding results include data acquisition results, information analysis results and threat detection results. Data acquisition tasks include image information acquisition tasks and image content acquisition tasks; information analysis tasks include image information analysis tasks and image content analysis tasks;

[0009] Data acquisition node: Downloads image description files and image configuration files from the container image repository according to the issued data acquisition tasks, and downloads image layer files on demand;

[0010] Information parsing node: used to parse the multi-dimensional information of the container image and extract the default commands and files executed when the container is started. The multi-dimensional information includes description information, configuration information, and content information.

[0011] Threat detection node: Based on the analysis results of the image information by the information analysis node, the extracted commands and files are analyzed to evaluate the threat level faced by the container image.

[0012] Preferably, the user interaction node includes a user interaction module, a communication scheduling module and a detection report output module;

[0013] User interaction module: receives user input to confirm the image list to be detected;

[0014] Test report output module: used to summarize the corresponding results and form the test report output;

[0015] Communication scheduling module: completes communication with other nodes and task distribution by sending various tasks and receiving corresponding results.

[0016] Preferably, the data acquisition node includes an image information acquisition module and an image content acquisition module;

[0017] Image information acquisition module: according to the issued image information acquisition task, request the container image repository interface to download the image description file and image configuration file, and return the result to the communication scheduling module;

[0018] Image content acquisition module: According to the image content acquisition task issued, download the layer file of the image and return the result to the communication scheduling module.

[0019] Preferably, the information parsing node includes an image information parsing module and an image content parsing module;

[0020] Image information parsing module: according to the issued image information parsing task, parse the image description file, establish the correspondence between the layer command and the image layer file; parse the image configuration file, extract the command executed when the corresponding container is started, and determine the layer where the container execution file is located based on the image description file parsing result, and return the result to the communication scheduling module, and then notify the data acquisition node to download the image layer file on demand;

[0021] Image content parsing module: extracts files executed by the container according to the issued image content parsing tasks. For the executed script files, recursively parses the executed script files to extract all files executed by the script nested, and returns the results to the communication scheduling module.

[0022] Preferably, the threat detection node includes a file analysis module and a command analysis module;

[0023] File analysis module: uses anti-virus tools to analyze the executable files of the container;

[0024] Command analysis module: For images that execute cryptocurrency mining software, analyze whether the mining pool address or wallet address is configured in the command parameters; check whether the main application declared in the image description corresponds to the actually executed application, so as to evaluate whether the image adopts the Typo poisoning technique when uploading, and return the result to the communication scheduling module.

[0025] The present invention also provides a method for threat assessment and multi-dimensional detection of malicious container images, which uses the above-mentioned threat assessment and multi-dimensional detection system for malicious container images, including the following steps:

[0026] Step S1: used for interaction with users, sending various tasks, receiving corresponding results and outputting detection reports. Various tasks include data acquisition tasks, information analysis tasks and threat detection tasks. The corresponding results include data acquisition results, information analysis results and threat detection results. Data acquisition tasks include image information acquisition tasks and image content acquisition tasks; information analysis tasks include image information analysis tasks and image content analysis tasks;

[0027] Step S2: according to the issued data acquisition task, download the image description file and image configuration file from the container image repository, and download the image layer file as needed;

[0028] Step S3: used to parse the multi-dimensional information of the container image and extract the commands and files executed by default when the container is started, the multi-dimensional information includes description information, configuration information and content information;

[0029] Step S4: According to the analysis result of the image information by the information analysis node, the commands and files extracted by the detection are analyzed to evaluate the threat level faced by the container image.

[0030] Preferably, step S1 includes the following sub-steps:

[0031] Step S1.1: receiving user input information and confirming the image list to be detected;

[0032] Step S1.2: Sending a mirror information acquisition task to a data acquisition node;

[0033] Step S1.3: receiving the image information acquisition result returned by the data acquisition node, and sending the image information parsing task to the information parsing node;

[0034] Step S1.4: receiving the image information parsing result returned by the information parsing node, and sending the image content acquisition task to the data acquisition node;

[0035] Step S1.5: receiving the image content acquisition result returned by the data acquisition node, and sending the image content parsing task to the information parsing node;

[0036] Step S1.6: receiving the image content parsing result returned by the information parsing node, and sending the threat detection task to the threat detection node;

[0037] Step S1.7: Receive the threat detection results returned by the threat detection node, summarize the data acquisition results, information analysis results and threat detection results, and form a detection report.

[0038] Preferably, step S2 includes the following sub-steps:

[0039] Step S2.1: receiving a task for acquiring image information;

[0040] Step S2.2: If the required image information already exists, the result is returned directly;

[0041] Step S2.3: If there is no ready-made image information, request the container image repository interface to download the image description file and image configuration file, and return the obtained results;

[0042] Step S2.4: receiving a mirror content acquisition task;

[0043] Step S2.5: If the image layer file already exists, the result is returned directly;

[0044] Step S2.6: If there is no image layer file, request the container image repository interface, download the corresponding image layer file, and return the result.

[0045] Preferably, the multi-dimensional information includes description information, configuration information, and content information, and step S3 includes the following sub-steps:

[0046] Step S3.1: receiving the image information parsing task;

[0047] Step S3.2: If the system already has the parsed image information, the result is returned directly;

[0048] Step S3.3: Parse the image description file and establish the correspondence between the layer command and the image layer file;

[0049] Step S3.4: Parse the image configuration file, extract the command executed by the container corresponding to the image when it is started, and return the result to the communication scheduling module;

[0050] Step S3.5: receiving the image content parsing task;

[0051] Step S3.6: If the parsed image content already exists, the result is returned directly;

[0052] Step S3.7: Parse the image layer file, extract the file executed by the container according to the execution command started by the container, and for the executed script file, use recursive parsing to extract the software actually called by the script, and return the result to the communication scheduling module.

[0053] Preferably, step S4 includes the following sub-steps:

[0054] Step S4.1: receiving a threat detection task;

[0055] Step S4.2: If there is already a detection task, return the result directly;

[0056] Step S4.3: Analyze the executable file of the container using an anti-virus tool;

[0057] Step S4.4: For the image that executes the cryptocurrency mining software, analyze whether the mining pool address or wallet address is configured in the command parameters;

[0058] Step S4.5: Check whether the main application declared in the image description corresponds to the actually executed application, and evaluate the threat level of the container image;

[0059] Step S4.6: Return the result to the communication scheduling module.

[0060] Compared with the prior art, the present invention has the following beneficial effects:

[0061] 1. The present invention first parses the multi-dimensional information of the container image, establishes the relationship between layer commands and layer files, and extracts the commands executed by the corresponding container instance at runtime, so as to accurately locate the files that the container may run. The malicious detection process of the files can focus on the files that may actually be executed in the image, without actually running the container or fully detecting the executable files in the image, which greatly saves computing resources.

[0062] 2. The present invention determines in advance the file executed by the corresponding container at startup by analyzing the configuration file of the container image, and then determines the image layer where the container execution file is located in conjunction with the image description file. In this way, only the image layer file containing the container execution file needs to be downloaded, and there is no need to download the complete content of the image. The image layer where the underlying system files occupy a large space is basically avoided, which greatly saves bandwidth and storage resources, and can efficiently complete the threat assessment and multi-dimensional detection of massive malicious container images. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0064] Figure 1 It is a structural diagram of a threat assessment and multi-dimensional detection system for malicious container images in an embodiment of the present invention;

[0065] Figure 2 It is a flowchart of a threat assessment and multi-dimensional detection method for malicious container images in an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0067] By parsing the multi-dimensional information of the image, the present invention can quickly locate the files actually executed in the container image, and can implement threat assessment and multi-dimensional detection of malicious container images without downloading the complete image, which greatly saves bandwidth, storage and computing resources in the image detection process and efficiently identifies malicious container images.

[0068] Embodiment 1:

[0069] Figure 1 It is a structural diagram of a threat assessment and multi-dimensional detection system for malicious container images in an embodiment of the present invention.

[0070] like Figure 1 As shown, this embodiment provides a threat assessment and multi-dimensional detection system for malicious container images, including four nodes, namely a user interaction node, a data acquisition node, an information parsing node and a threat detection node. The four nodes work together by exchanging data.

[0071] User interaction node: used to interact with users, send various tasks, receive corresponding results and output detection reports. Various tasks include data acquisition tasks, information analysis tasks and threat detection tasks. The corresponding results include data acquisition results, information analysis results and threat detection results. Data acquisition tasks include image information acquisition tasks and image content acquisition tasks; information analysis tasks include image information analysis tasks and image content analysis tasks.

[0072] Specifically, the user interaction node includes a user interaction module, a communication scheduling module and a detection report output module.

[0073] User interaction module: receives user input to confirm the list of images to be detected.

[0074] Test report output module: used to summarize the corresponding results and form the test report output.

[0075] Communication scheduling module: completes communication with other nodes and task distribution by sending various tasks and receiving corresponding results.

[0076] Specifically, a data acquisition task is sent to a data acquisition node according to a list of images to be detected, an information parsing task is sent to an information parsing node according to a data acquisition result, a threat detection task is sent to a threat detection node according to an information parsing result, and data acquisition results, information parsing results, and threat detection results are received at the same time.

[0077] Data acquisition node: Downloads image description files and image configuration files from the container image repository according to the issued data acquisition tasks, and downloads image layer files on demand.

[0078] The data acquisition node includes an image information acquisition module and an image content acquisition module.

[0079] Image information acquisition module: According to the issued image information acquisition task, it requests the container image repository interface to download the image description file and image configuration file, and returns the result to the communication scheduling module.

[0080] The image description file downloaded by the data acquisition node includes the statistical information files of repository, tag, and image in the hierarchical management structure of the image repository, as well as the manifest file of the image. The statistical information file includes the number of image downloads, image layer information, and function descriptions provided by the developer. The manifest file contains the hash values ​​of the image configuration file and the image layer file, which are used as parameters to request the download of the image configuration file and the image layer file.

[0081] The image configuration file downloaded by the data acquisition node contains the hash value of the image layer, the command executed by the image layer and the execution time, the image's Entrypoint, Cmd, Workdir and other configurations.

[0082] Image content acquisition module: According to the image content acquisition task issued, download the layer file of the image and return the result to the communication scheduling module.

[0083] Information parsing node: used to parse the multi-dimensional information of the container image and extract the commands and files executed by default when the container is started. The multi-dimensional information includes description information, configuration information, and content information.

[0084] The information parsing node includes an image information parsing module and an image content parsing module.

[0085] Image information parsing module: According to the issued image information parsing task, parse the image description file and establish the correspondence between the layer command and the image layer file; parse the image configuration file, extract the command executed when the corresponding container is started, and determine the layer where the container execution file is located based on the image description file parsing result, and return the result to the communication scheduling module, thereby notifying the data acquisition node to download the image layer file on demand.

[0086] Image content parsing module: extracts files executed by the container according to the issued image content parsing tasks. For the executed script files, recursively parses the executed script files to extract all files executed by the script nested, and returns the results to the communication scheduling module.

[0087] Threat detection node: Based on the analysis results of the image information by the information analysis node, the extracted commands and files are analyzed to evaluate the threat level faced by the container image.

[0088] The threat detection node includes a file analysis module and a command analysis module.

[0089] File analysis module: Use anti-virus tools to analyze the executable files of the container.

[0090] The anti-virus tools used in the file analysis module can be implemented based on a variety of technologies and methods. Common working principles include signature detection, behavioral analysis, heuristic analysis, etc.

[0091] In this embodiment, VirusTotal is used as an anti-virus tool, and anti-virus tools based on different principles and provided by dozens of security vendors are used to scan files.

[0092] Command analysis module: For images that execute cryptocurrency mining software, analyze whether the mining pool address or wallet address is configured in the command parameters; check whether the main application declared in the image description corresponds to the actually executed application, so as to evaluate whether the image adopts poisoning techniques such as Typo when uploading, and return the results to the communication scheduling module.

[0093] The command analysis module uses regular expressions to extract the mining pool address and wallet address from the command according to the preset mining software configuration mode, and verifies the legitimacy of the format of the extracted mining pool address and wallet address.

[0094] Embodiment 2:

[0095] Figure 2 It is a flowchart of a threat assessment and multi-dimensional detection method for malicious container images in an embodiment of the present invention.

[0096] like Figure 2 As shown, this embodiment provides a threat assessment and multi-dimensional detection method for malicious container images, including the following steps:

[0097] Step S1: used for interaction with users, sending various tasks, receiving corresponding results and outputting detection reports. Various tasks include data acquisition tasks, information analysis tasks and threat detection tasks. The corresponding results include data acquisition results, information analysis results and threat detection results. Data acquisition tasks include image information acquisition tasks and image content acquisition tasks; information analysis tasks include image information analysis tasks and image content analysis tasks.

[0098] Specifically, step S1 includes the following sub-steps:

[0099] Step S1.1: receiving user input information and confirming the image list to be detected;

[0100] Step S1.2: Sending a mirror information acquisition task to a data acquisition node;

[0101] Step S1.3: receiving the image information acquisition result returned by the data acquisition node, and sending the image information parsing task to the information parsing node;

[0102] Step S1.4: receiving the image information parsing result returned by the information parsing node, and sending the image content acquisition task to the data acquisition node;

[0103] Step S1.5: receiving the image content acquisition result returned by the data acquisition node, and sending the image content parsing task to the information parsing node;

[0104] Step S1.6: receiving the image content parsing result returned by the information parsing node, and sending the threat detection task to the threat detection node;

[0105] Step S1.7: Receive the threat detection results returned by the threat detection node, summarize the data acquisition results, information analysis results and threat detection results, and form a detection report.

[0106] Step S2: According to the issued data acquisition task, the image description file and the image configuration file are downloaded from the container image repository, and the image layer file is downloaded as needed.

[0107] Specifically, step S2 includes the following sub-steps:

[0108] Step S2.1: receiving a task for acquiring image information;

[0109] Step S2.2: If the required image information already exists, the result is returned directly;

[0110] Step S2.3: If there is no ready-made image information, request the container image repository interface to download the image description file and image configuration file, and return the obtained results;

[0111] Step S2.4: receiving a mirror content acquisition task;

[0112] Step S2.5: If the image layer file already exists, the result is returned directly;

[0113] Step S2.6: If there is no image layer file, request the container image repository interface, download the corresponding image layer file, and return the result.

[0114] Step S3: used to parse the multi-dimensional information of the container image and extract the commands and files executed by default when the container is started. The multi-dimensional information includes description information, configuration information and content information.

[0115] Step S3 includes the following sub-steps:

[0116] Step S3.1: receiving the image information parsing task;

[0117] Step S3.2: If the system already has the parsed image information, the result is returned directly;

[0118] Step S3.3: Parse the image description file and establish the correspondence between the layer command and the image layer file;

[0119] Step S3.4: Parse the image configuration file, extract the command executed by the container corresponding to the image when it is started, and return the result to the communication scheduling module;

[0120] Step S3.5: receiving the image content parsing task;

[0121] Step S3.6: If the parsed image content already exists, the result is returned directly;

[0122] Step S3.7: Parse the image layer file, extract the file executed by the container according to the execution command started by the container, and for the executed script file, use recursive parsing to extract the software actually called by the script, and return the result to the communication scheduling module.

[0123] Step S4: According to the analysis result of the image information by the information analysis node, the commands and files extracted by the detection are analyzed to evaluate the threat level faced by the container image.

[0124] Step S4 includes the following sub-steps:

[0125] Step S4.1: receiving a threat detection task;

[0126] Step S4.2: If there is already a detection task, return the result directly;

[0127] Step S4.3: Analyze the executable file of the container using an anti-virus tool;

[0128] Step S4.4: For the image that executes the cryptocurrency mining software, analyze whether the mining pool address or wallet address is configured in the command parameters;

[0129] Step S4.5: Check whether the main application declared in the image description corresponds to the actually executed application, and evaluate the threat level of the container image;

[0130] Step S4.6: Return the result to the communication scheduling module.

[0131] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0132] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A threat assessment and multi-dimensional detection system for malicious container images, characterized in that: It includes four nodes, namely a user interaction node, a data acquisition node, an information analysis node and a threat detection node, and the four nodes work together by exchanging data; The user interaction node is used to interact with the user, send various tasks, receive corresponding results and output detection reports. The various tasks include data acquisition tasks, information analysis tasks and threat detection tasks. The corresponding results include data acquisition results, information analysis results and threat detection results. The data acquisition tasks include image information acquisition tasks and image content acquisition tasks; the information analysis tasks include image information analysis tasks and image content analysis tasks; The data acquisition node: downloads the image description file and the image configuration file from the container image repository according to the issued data acquisition task, and downloads the image layer file as needed; The information parsing node is used to parse the multi-dimensional information of the container image and extract the commands and files executed by default when the container is started. The multi-dimensional information includes description information, configuration information and content information. The threat detection node: analyzes the commands and files extracted by the detection according to the analysis result of the image information by the information analysis node, and evaluates the threat level faced by the container image.

2. According to claim 1, a threat assessment and multi-dimensional detection system for malicious container images is characterized in that: The user interaction node includes a user interaction module, a communication scheduling module and a detection report output module; The user interaction module receives user input to confirm the image list to be detected; The test report output module is used to summarize the corresponding results and form a test report output; The communication scheduling module completes communication with other nodes and task distribution by sending various tasks and receiving corresponding results.

3. According to claim 1, a threat assessment and multi-dimensional detection system for malicious container images is characterized in that: The data acquisition node includes a mirror information acquisition module and a mirror content acquisition module; The image information acquisition module: requests the container image repository interface to download the image description file and the image configuration file according to the issued image information acquisition task, and returns the result to the communication scheduling module; The image content acquisition module: downloads the layer file of the image according to the issued image content acquisition task, and returns the result to the communication scheduling module.

4. According to claim 1, a threat assessment and multi-dimensional detection system for malicious container images is characterized in that: The information parsing node includes an image information parsing module and an image content parsing module; The image information parsing module: according to the issued image information parsing task, parses the image description file and establishes the corresponding relationship between the layer command and the image layer file; Parse the image configuration file, extract the command executed when the corresponding container is started, and determine the layer where the container execution file is located in combination with the image description file parsing result, return the result to the communication scheduling module, and then notify the data acquisition node to download the image layer file on demand; The image content parsing module: extracts the files executed by the container according to the issued image content parsing task, recursively parses the executed script files to extract all the files executed by the nested scripts, and returns the results to the communication scheduling module.

5. The threat assessment and multi-dimensional detection system for malicious container images according to claim 1 is characterized in that: The threat detection node includes a file analysis module and a command analysis module; The file analysis module uses an anti-virus tool to analyze the executable files of the container; The command analysis module: for the image executing the cryptocurrency mining software, analyzes whether the mining pool address or wallet address is configured in the command parameters; checks whether the main application declared in the image description corresponds to the actually executed application, so as to evaluate whether the Typo poisoning technique is adopted when uploading the image, and returns the result to the communication scheduling module.

6. A threat assessment and multi-dimensional detection method for malicious container images, characterized in that: A threat assessment and multi-dimensional detection system for malicious container images applied to any one of claims 1 to 5 comprises the following steps: Step S1: used for interaction with the user, sending various tasks, receiving corresponding results and outputting detection reports, the various tasks include data acquisition tasks, information analysis tasks and threat detection tasks, the corresponding results include data acquisition results, information analysis results and threat detection results, the data acquisition tasks include image information acquisition tasks and image content acquisition tasks; the information analysis tasks include image information analysis tasks and image content analysis tasks; Step S2: according to the issued data acquisition task, download the image description file and image configuration file from the container image repository, and download the image layer file as needed; Step S3: used to parse the multi-dimensional information of the container image and extract the commands and files executed by default when the container is started, wherein the multi-dimensional information includes description information, configuration information and content information; Step S4: According to the analysis result of the image information by the information analysis node, the commands and files extracted by the detection are analyzed to evaluate the threat level faced by the container image.

7. The threat assessment and multi-dimensional detection method for malicious container images according to claim 6 is characterized in that: The step S1 includes the following sub-steps: Step S1.1: receiving user input information and confirming the image list to be detected; Step S1.2: Sending a mirror information acquisition task to a data acquisition node; Step S1.3: receiving the image information acquisition result returned by the data acquisition node, and sending the image information parsing task to the information parsing node; Step S1.4: receiving the image information parsing result returned by the information parsing node, and sending the image content acquisition task to the data acquisition node; Step S1.5: receiving the image content acquisition result returned by the data acquisition node, and sending the image content parsing task to the information parsing node; Step S1.6: receiving the image content parsing result returned by the information parsing node, and sending the threat detection task to the threat detection node; Step S1.7: Receive the threat detection results returned by the threat detection node, summarize the data acquisition results, information analysis results and threat detection results, and form a detection report.

8. The threat assessment and multi-dimensional detection method for malicious container images according to claim 6 is characterized in that: The step S2 includes the following sub-steps: Step S2.1: receiving a task for acquiring image information; Step S2.2: If the required image information already exists, the result is returned directly; Step S2.3: If there is no ready-made image information, request the container image repository interface to download the image description file and image configuration file, and return the obtained results; Step S2.4: receiving a mirror content acquisition task; Step S2.5: If the image layer file already exists, the result is returned directly; Step S2.6: If there is no image layer file, request the container image repository interface, download the corresponding image layer file, and return the result.

9. The threat assessment and multi-dimensional detection method for malicious container images according to claim 6 is characterized in that: The multi-dimensional information includes description information, configuration information, and content information. Step S3 includes the following sub-steps: Step S3.1: receiving the image information parsing task; Step S3.2: If the system already has the parsed image information, the result is returned directly; Step S3.3: Parse the image description file and establish the correspondence between the layer command and the image layer file; Step S3.4: Parse the image configuration file, extract the command executed by the container corresponding to the image when it is started, and return the result to the communication scheduling module; Step S3.5: receiving the image content parsing task; Step S3.6: If the parsed image content already exists, the result is returned directly; Step S3.7: Parse the image layer file, extract the file executed by the container according to the execution command started by the container, and for the executed script file, use recursive parsing to extract the software actually called by the script, and return the result to the communication scheduling module.

10. The threat assessment and multi-dimensional detection method for malicious container images according to claim 6 is characterized in that: The step S4 includes the following sub-steps: Step S4.1: receiving a threat detection task; Step S4.2: If there is already a detection task, return the result directly; Step S4.3: Analyze the executable file of the container using an anti-virus tool; Step S4.4: For the image that executes the cryptocurrency mining software, analyze whether the mining pool address or wallet address is configured in the command parameters; Step S4.5: Check whether the main application declared in the image description corresponds to the actually executed application, and evaluate the threat level of the container image; Step S4.6: Return the result to the communication scheduling module.

Images