Mirror image monitoring method, device, equipment, medium and product

Abstract

The invention discloses a mirror image monitoring method, device and equipment, a medium and a product. The method comprises the following steps: acquiring mirror image associated data of at least one application mirror image; detecting the mirror image associated data according to a mirror image detection method corresponding to the at least one detection dimension to obtain a detection result corresponding to the application mirror image under the at least one detection dimension; when at least one detection result meets an early warning condition and the detection result meeting the early warning condition corresponds to a basic mirror image in the application mirror images, determining the service mirror images of at least two service applications constructed based on the basic mirror image; and based on the detection result that the early warning condition is reached, generating early warning prompt information, and sending the early warning prompt information to an application system corresponding to the service mirror image. According to the technical scheme provided by the invention, the effects of improving the mirror image monitoring efficiency and accuracy and reducing the monitoring cost can be achieved while the monitoring of the service mirror image of the whole link is realized.

Description

Technical Field

[0001] The present invention relates to the field of computer processing technology, and in particular to a mirror monitoring method, device, equipment, medium and product. Background Art

[0002] With the development of cloud computing technology, applications are gradually transformed into container images that run in cloud computing environments. In order to ensure the stability and security of image operation, it is usually necessary to monitor the image.

[0003] In the prior art, the method of monitoring images is usually to scan the risks of container images during their operation. This method requires independent monitoring of each container image, which has the problem of high monitoring costs. Furthermore, image monitoring takes a long time and has the problem of monitoring lag. Summary of the invention

[0004] The present invention provides a mirror monitoring method, device, equipment, medium and product to realize full-link business mirror monitoring while achieving the technical effect of improving mirror monitoring efficiency and reducing monitoring costs.

[0005] According to one aspect of the present invention, a mirror monitoring method is provided, the method comprising:

[0006] Obtaining image-related data of at least one application image; wherein different application images correspond to different business applications; the application image is an operating environment of the business application constructed based on the application program and dependencies of the corresponding business application and a base image;

[0007] For each of the application images, the image-related data is detected according to the image detection method corresponding to at least one detection dimension to obtain a detection result corresponding to the application image under at least one detection dimension;

[0008] When at least one of the detection results reaches a warning condition, and the detection result that reaches the warning condition corresponds to a base image in the application image, determining business images of at least two business applications built based on the base image;

[0009] Based on the detection result that meets the warning condition, early warning prompt information is generated, and the early warning prompt information is sent to the application system corresponding to the business image.

[0010] According to another aspect of the present invention, there is provided a mirror monitoring device, the device comprising:

[0011] A data acquisition module, used to acquire image-related data of at least one application image; wherein different application images correspond to different business applications; and the application image is a running environment of the business application constructed based on the application program and dependencies of the corresponding business application and the base image;

[0012] A detection result determination module, configured to detect the image-related data for each of the application images according to an image detection method corresponding to at least one detection dimension, and obtain a detection result corresponding to the application image under at least one detection dimension;

[0013] A business image determination module, configured to determine business images of at least two business applications constructed based on the base image when at least one of the detection results reaches a warning condition and the detection result that reaches the warning condition corresponds to a base image in the application image;

[0014] The early warning prompt module is used to generate early warning prompt information based on the detection result that meets the early warning condition, and send the early warning prompt information to the application system corresponding to the business image.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and a memory in communication with the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the mirror monitoring method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the mirror monitoring method described in any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the mirror monitoring method as described in any embodiment of the present invention.

[0020] The technical solution of the embodiment of the present invention obtains image-related data of at least one application image; different application images correspond to different business applications; the application image is an operating environment of the business application constructed based on the application program and dependencies of the corresponding business application and the basic image; the image-related data is detected according to the image detection method corresponding to at least one detection dimension, and the detection result corresponding to the application image under at least one detection dimension is obtained; when at least one detection result reaches the warning condition and the detection result that reaches the warning condition corresponds to the basic image in the application image, the business image of at least two business applications constructed based on the basic image is determined; based on the detection result that reaches the warning condition, early warning prompt information is generated, and the early warning prompt information is sent to the application system corresponding to the business image, which solves the problem of high monitoring cost and monitoring lag in the prior art by monitoring each container image separately, and realizes that the image-related data of the application image is detected according to the image detection method corresponding to at least one detection dimension, and the detection result corresponding to the application image under at least one detection dimension is obtained, thereby ensuring the accuracy of image monitoring and guaranteeing the security of the image. Furthermore, when the detection result reaches the warning condition and the detection result corresponds to the basic image in the application image, the business image of all business applications built based on the basic image is determined, and the full-link business image monitoring is realized, while the image monitoring efficiency is improved and the monitoring cost is reduced. Furthermore, based on the detection result that reaches the warning condition, the warning prompt information is generated, and the warning prompt information is sent to the application system corresponding to the business image, so that the user corresponding to the application system can collect processing measures in time, so as to achieve the technical effect of ensuring the integrity, consistency and security of the full-link business image.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flowchart of a mirror monitoring method provided according to Embodiment 1 of the present invention;

[0024] Figure 2 is a structural diagram of a mirror monitoring system provided according to Embodiment 2 of the present invention;

[0025] Figure 3 is a structural schematic diagram of a mirror monitoring device provided according to Embodiment 3 of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device for implementing the mirror monitoring method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 1 is a flowchart of an image monitoring method provided according to the first embodiment of the present invention. This embodiment is applicable to the risk monitoring and management of images in an isolated environment. The method can be executed by an image monitoring device. The image monitoring device can be implemented in the form of hardware and / or software. The image monitoring device can be configured in a computing device. Figure 1 As shown, the method includes:

[0031] S110: Obtain image-related data of at least one application image.

[0032] Among them, different application images correspond to different business applications. It can be understood that the application image contains all the content required to run the entire business application, such as code, operating system, runtime, library, environment variables, dependencies and configuration files, etc., which enables the business application to run in the same way in any environment. The application image is the operating environment of the business application built based on the application and dependencies of the corresponding business application and the basic image. The basic image can contain the basic operating system and various middleware, software packages or software running dependency libraries, that is, the basic image can be understood as the underlying dependency environment, such as Ubuntu, Java, Tomcat, etc. The basic image does not contain specific business. It should be noted that the basic images used by different application images can be the same or different. Each application image can be an image in different stages (such as development, testing, production, etc.). Image-related data can be data related to the application image, for example, the image-related data includes but is not limited to various data such as application, component, middleware, library, image name, image version, image unique identifier, image upload account, upload address, creation date, pipeline ID, etc. In this embodiment, image association data of each application image in various isolated environments such as development, testing, and production may be obtained to perform risk detection on the corresponding application image based on the image association data.

[0033] It should be noted that a business image can also be built based on the basic image, and the method can be: determine at least one application to be configured; for each application to be configured, based on the application program and dependencies corresponding to the application to be configured and the basic environment corresponding to the application to be configured, obtain the business image corresponding to the application to be configured, and the business image is the application image; each business image corresponds to a business module in the system.

[0034] Specifically, the application to be configured can pull the basic image to the local computer and run the basic image as a container, which only has the operating system and the basic operating environment. Then, the application of the application to be configured is deployed to the basic environment. After deployment, the application's dependencies and the deployed image are packaged to generate a business image of the application to be configured, so as to run the business image in the cloud environment, generate a business container, and implement specific business applications.

[0035] S120: For each application image, detect the image-related data according to the image detection method corresponding to at least one detection dimension to obtain a detection result corresponding to the application image under the at least one detection dimension.

[0036] The detection dimension may refer to different dimensions considered when performing image security risk detection. The detection result may refer to the result obtained after processing the image-related data under each detection dimension, and the detection result may be used to indicate whether the image-related data passes the corresponding detection dimension.

[0037] In this embodiment, the image-related data can be detected using the image detection method corresponding to each detection dimension, and the application image can be detected whether it meets the security expectations under each detection dimension, and the detection results under each detection dimension can be obtained, so as to quickly locate which services are at risk based on the detection results. Optionally, at least one detection dimension includes at least one of a vulnerability detection dimension, a signature verification dimension, and an image source detection dimension. The vulnerability detection dimension may refer to a dimension for detecting risk vulnerabilities of the application image itself. The signature verification dimension may refer to a dimension for detecting the signature information of the application image. The image source detection dimension may refer to a dimension for detecting the acquisition source of the application image.

[0038] For example, the source of the business image and the source of the basic image in the business image and its metadata, build history information, image signature, dependency library, security scan and compliance check results, vulnerability repair and update information, etc. can be determined by connecting to the image development pipeline, test and production product library, test and production cloud platform and container, security scanning tools, compliance inspection tools, etc. Analyze whether the image source is credible, verify the integrity of the image based on the image signature, analyze the vulnerability risk of the image, confirm whether the image vulnerability has been completely repaired, etc., and obtain a variety of detection results of the application image. Combine these detection results to ensure that the image has not been tampered with during transmission and storage, ensure that the image vulnerability has been completely repaired, and improve the security and reliability of the image.

[0039] In this embodiment, image-associated data is detected according to an image detection method corresponding to at least one detection dimension to obtain a detection result corresponding to the application image under at least one detection dimension, including: when the detection dimension includes a vulnerability detection dimension, vulnerability detection is performed on the image-associated data according to an image detection method corresponding to at least one vulnerability indicator in the vulnerability detection dimension to obtain a detection result corresponding to the application image under each vulnerability indicator.

[0040] Among them, vulnerability indicators include at least operating system vulnerabilities, third-party software vulnerabilities, application configuration vulnerabilities and weak password vulnerabilities.

[0041] Specifically, when the detection dimension includes the vulnerability detection dimension, a security scanning tool can be used to perform vulnerability detection on the operating system in the image-related data, detect whether there are operating system vulnerabilities in the application image, and obtain the corresponding detection results of the application image under the operating system vulnerability. The scanning tool can be used to scan the external dependency library in the image-related data, identify the dependencies and check whether there are known and public vulnerabilities, and obtain the corresponding detection results of the application image under the third-party software vulnerability. The security of the application configuration information in the image-related data can be detected to obtain the corresponding detection results of the application image under the application configuration vulnerability. The plaintext password in the image-related data can be detected to obtain the corresponding detection results of the application image under the weak password vulnerability. Of course, it is not limited to these vulnerability indicators. Through the above method, the application image can be comprehensively detected for vulnerabilities, and the corresponding detection results under each vulnerability indicator can be obtained. It is possible to judge whether the image has a vulnerability risk based on these detection results.

[0042] In this embodiment, the image-associated data is detected according to the image detection method corresponding to at least one detection dimension to obtain the detection result corresponding to the application image under the at least one detection dimension, including: when the detection dimension includes a signature verification dimension, based on the detection result corresponding to the application image under each vulnerability indicator, an intermediate value is determined; based on the image unique identifier and the intermediate value in the image-associated data, a signature to be verified is determined; based on the signature to be verified and the image security signature in the image-associated data, a detection result corresponding to the application image under the signature verification dimension is obtained.

[0043] The intermediate value may be the result of processing the detection result corresponding to each vulnerability indicator of the application image into a numerical value or numerical sequence. The image unique identifier may be a hash value or md5 value of the application image. The image security signature is determined based on the detection result corresponding to each vulnerability indicator detected by the application image in the development environment and the image unique identifier.

[0044] Specifically, when the detection dimension includes a signature verification dimension, the detection result corresponding to the application image under each vulnerability indicator can be numerically converted to obtain an intermediate value. For example, a safe detection result is marked as a first numerical value; an unsafe detection result is marked as a second numerical value; if the detection results corresponding to the application image under each vulnerability indicator are all safe, the intermediate value is determined as the first numerical value; if there is an unsafe detection result in the detection results corresponding to the application image under each vulnerability indicator, the intermediate value is determined as the second numerical value. Further, the image unique identifier and the intermediate value can be logically calculated to obtain a signature to be verified. The signature to be verified and the image security signature are compared. If the two are consistent, the detection result corresponding to the application image under the signature verification dimension is safe. If the two are inconsistent, the detection result corresponding to the application image under the signature verification dimension is unsafe. The security and compliance of the application image are judged in combination with the detection results under the signature verification dimension.

[0045] For example, in a development environment, the image unique identifier and the detection result corresponding to each vulnerability indicator detected by the business image (i.e., application image) in the development environment are used to create an image security signature. The image security signature is circulated to each environment together with the business image as the image-related data of the business image. In an environment isolated from the development environment (such as a production environment), the image security signature can be used to verify the integrity of the business image, ensure the security of the image, and ensure that the image has not been tampered with.

[0046] In this embodiment, the image-associated data is detected according to the image detection method corresponding to at least one detection dimension to obtain the detection result corresponding to the application image under the at least one detection dimension, including: when the detection dimension includes the image source detection dimension, determining the first image source of the application image in the image-associated data and the second image source of the base image corresponding to the application image; based on the first image source and the second image source, determining the detection result corresponding to the application image under the image source detection dimension.

[0047] Among them, the first image source can be used to characterize the location from which the application image is uploaded or pulled, who uploaded it, and the upload time. The second image source can be used to characterize the location from which the base image is uploaded or pulled, who uploaded it, and the upload time. For example, the base image is uploaded from the image warehouse, the uploading user is user A, and the upload time is January 1, 2023, that is, the second image source is Image Warehouse_User A_20230101. The business image is uploaded from the pipeline, the uploading user is user B, and the upload time is December 30, 2023, that is, the first image source is Pipeline_User B_20231230.

[0048] Specifically, when the detection dimension includes the image source detection dimension, the first image source of the application image and the second image source of the base image corresponding to the application image can be determined from the image association data. It can be determined whether the first image source and the second image source are in the preset image source library. If they are, it means that the application image and the base image are uploaded by internal personnel and have not been exposed to the external environment. At this time, it is determined that the detection result corresponding to the application image under the image source detection dimension is a reliable source.

[0049] For example, user A generates an application image in the CI (code submission) stage on January 1, 2023 and uploads it to the artifact library. On January 2, 2023, the application image is pulled from the artifact library for local deployment. The first image source is the three locations (pipeline, artifact library, local). It can be determined whether user A is an internal staff member and whether the three locations exist in the preset image source library. If so, the corresponding detection result is that the source is credible.

[0050] It should be noted that in the process of determining the detection result corresponding to the application image under at least one detection dimension, each detection dimension and the detection result corresponding to the detection dimension can be dynamically displayed in the target page, so that the user can intuitively view the detection status of the application image under each detection dimension in real time. For the risky, i.e., unsafe detection results, repair commands and impact description information can be provided so that the user can promptly repair the security risks in the application image or deactivate the application image in time. It should also be noted that in order to enable the user to more intuitively see the detection status of the application image or the basic image under each detection dimension, different colors or icons can be used to highlight the different detection results corresponding to different detection objects under different detection dimensions according to different detection dimensions, different detection results, or different detection objects.

[0051] S130: When at least one detection result reaches a warning condition and the detection result corresponds to a base image in the application image, determine business images of at least two business applications built based on the base image.

[0052] Among them, the warning condition can refer to whether the detection results corresponding to different detection dimensions meet the conditions for warning prompts. Business images and application images are relative. For example, in the process of image monitoring, image a among many business application images is an application image, and image b is a business image; in another image monitoring process, image b may be an application image, and image a may be a business image.

[0053] In this embodiment, it can be determined whether each detection result meets the warning condition. For example, if the detection result is unsafe, it is confirmed that the detection result meets the warning condition; if the risk probability of the detection result reaches the preset risk threshold, it is confirmed that the detection result meets the warning condition; the risk level in the detection result of the application image is evaluated to determine whether it reaches the preset risk level. If so, it is confirmed that the detection result meets the warning condition; or, if the number of risk vulnerabilities in the detection result reaches a preset number, it is confirmed that the detection result meets the warning condition. When the detection result meets the warning condition and the detection result corresponds to the detection of the base image in the application image, it can be considered that the base image in the application image has a security risk. Furthermore, it can be determined that the business image of each business application built based on the risky base image may all have corresponding risks.

[0054] For example, based on the immutable nature of the base image in the application image, if it is determined that there is a risk in the base image in the application image, the base image and all application images in the development, test and production environments in the system are analyzed for association, and all application images built based on the base image are obtained as business images. These business images are the impact radius of the base image (that is, the affected application range), so as to quickly identify the risks and impact range of the base image to ensure the security of all container image services in the system.

[0055] S140: Generate warning prompt information based on the detection result that meets the warning condition, and send the warning prompt information to the application system corresponding to the business image.

[0056] The application system may be composed of multiple business applications, and the business image of the business application corresponds to a business module in the application system.

[0057] It can be understood that when the detection results reach or exceed the warning conditions, a warning prompt information can be generated. For example, the warning prompt information may include but is not limited to risk details, scope of impact, possible scope of impact, recommended repair measures, etc. Then, the warning prompt information can be sent to the application system corresponding to the business image in a preset manner. For example, the preset method includes but is not limited to email, SMS, notification center of the application system, or instant messaging tools, etc. This allows the maintenance personnel of the application system to assess the risks and take corresponding treatment measures after receiving the warning prompt information, such as repairing vulnerabilities, updating application images, etc.

[0058] In this embodiment, based on the detection results of reaching the warning conditions, warning prompt information is generated, and the warning prompt information is sent to the application system corresponding to the business image, including: determining the application system corresponding to each business image; based on the detection results of the warning conditions reached by the business image corresponding to the same application system, generating warning prompt information, and sending the warning prompt information to the application system.

[0059] The warning information includes the detection results, vulnerability information corresponding to the detection results, and disposal suggestion information.

[0060] Specifically, the application system to which each business image belongs can be determined. Then, the detection results of the business images corresponding to the same application system that meet the warning conditions can be summarized, and warning prompt information can be generated, and the warning prompt information can be sent to the application system, so that the risks in these risky business images can be viewed through the application system, and all images in the isolated environment can be effectively tested for security, ensuring the security and compliance of the business images.

[0061] For example, application system attributes (such as which department or project number the application system attributes include) can be added to the application system in advance, and the application system attributes can be used as the image association data of all business images in the application system. When there is a risk in the business image, the application system attributes in the image association data of the business image are associated with the corresponding application system, and specific early warning information is distributed to the user corresponding to the application system, so as to realize the automation of the vulnerability management process and improve the efficiency of image vulnerability repair.

[0062] In this embodiment, an image monitoring page can also be displayed; wherein the image monitoring page includes a search term input control; in response to a trigger operation on the search term input control, the search object information in the search term input control is obtained; when the object type of the search object information is an application image, the base image used by the application image corresponding to the search object information and the detection result corresponding to the application image under at least one detection dimension are displayed; when the object type of the search object information is a base image, the application image constructed based on the base image corresponding to the search object information and the detection result corresponding to the application image under at least one detection dimension are displayed; when the object type of the search object information is an application system, the application image associated with the application system corresponding to the search object information and the detection result corresponding to the application image under at least one detection dimension are displayed.

[0063] The search term input control may refer to a visual control for inputting search object information. The search object information may refer to an object whose own information and / or information associated with it needs to be queried. Object types include but are not limited to at least one of application images, basic images, and application systems, components, and vulnerabilities.

[0064] In this embodiment, an image monitoring page can be developed in advance, and the image monitoring page includes a search term input control. The user can enter a search term in the search term input control, and when the confirmation control is triggered, the information entered in the search term input control is obtained as the search object information. If the object type of the search object information is an application image, the base image used by the application image in the search object information and the detection result corresponding to the application image under at least one detection dimension are displayed in the image monitoring page. If the object type of the search object information is a base image, the application image built based on the base image in the search object information and the detection results corresponding to all the built application images under at least one detection dimension are displayed in the image monitoring page. If the object type of the search object information is an application system, all application images associated with the application system in the search object information and the detection results corresponding to these application images under at least one detection dimension are displayed in the image monitoring page. If the object type of the search object information is a component, all application images associated with the component in the search object information and the detection results corresponding to the component in these application images under at least one detection dimension are displayed in the image monitoring page. If the object type of the search object information is vulnerability, all application images associated with the vulnerability in the search object information and the corresponding detection results of these application images under the vulnerability dimension are displayed in the image monitoring page. It should be noted that when a base image in the image monitoring page is triggered, you can jump to the image view corresponding to the base image selected by the trigger, and the image view can include the vulnerabilities contained in the displayed base image and the vulnerability repair status. When an application image in the image monitoring page is triggered, you can jump to the image view corresponding to the application image selected by the trigger, and the image view can include the vulnerabilities contained in the displayed application image and the vulnerability repair status.

[0065] Exemplarily, you can enter the search terms such as application system name, image name, image tag, image version, open source component, etc. (i.e., search object information) in the search term input control for retrieval, and support viewing the application image, risk details, and risk impact scope associated with a certain base image. Support viewing all images under different versions of a certain application image, distinguish and identify the images in use, display the image operating environment and the base image it depends on, etc. Support filtering all application images used by the application system. At the same time, it supports users to modify the identification information in the display. Support viewing the scope of assets affected by a vulnerability, including application images, base images and runtime containers, application systems and vulnerability managers, and provide vulnerability details and disposal suggestions. The advantage of this setting is that it can manage image risks and data in different image dimensions, application system dimensions, vulnerability detection dimensions, and component dimensions, and improve the comprehensiveness and effectiveness of image risk management.

[0066] In this embodiment, after obtaining the image-related data of at least one application image, the image name and image version of the application image can be determined from the image-related data; when there are at least two application images with the same image name, the highest image version of the at least two application images is determined, and the application images with image versions lower than the highest version are governed.

[0067] The image name can be used to identify the application image as the same application, and the image version can be used to characterize the update status or historical modification record of the application image throughout its life cycle. For example, the version of an application image is "v2.0.0", which means that this is the second update of the application image.

[0068] Specifically, the image name and image version of each application image can be determined from the image-related data of each application image. If there are two application images with the same image name, the highest version is determined from the image versions of these two application images. Then, the application images with image versions lower than the highest version among these application images are managed, such as marking the application images lower than the highest version as not recommended; or, deleting the application images lower than the highest version. For example, if the image versions of the application images with the same image name are identified as v1.0.0, v1.1.0, and v2.0.0, v2.0.0 is considered to be the highest version, and the application images v1.0.0 and v1.1.0 are managed.

[0069] The advantage of this setting is that you can group application images according to image-related data, analyze cached application images in the entire environment, manage expired images, and manage new images. This can effectively manage and maintain image versions, ensure the security and compliance of images, and improve the stability and reliability of images.

[0070] The technical solution provided in this embodiment obtains image-related data of at least one application image; different application images correspond to different business applications; the application image is a running environment of a business application constructed based on the application program and dependencies of the corresponding business application and the basic image; the image-related data is detected according to the image detection method corresponding to at least one detection dimension, and the detection result corresponding to the application image under at least one detection dimension is obtained; when at least one detection result reaches the warning condition and the detection result that reaches the warning condition corresponds to the basic image in the application image, the business image of at least two business applications constructed based on the basic image is determined; based on the detection result that reaches the warning condition, a warning prompt information is generated, and the warning prompt information is sent to the application system corresponding to the business image, which solves the problem of high monitoring cost and monitoring lag in the prior art by monitoring each container image separately, and realizes that the image-related data of the application image is detected according to the image detection method corresponding to at least one detection dimension, and the detection result corresponding to the application image under at least one detection dimension is obtained, thereby ensuring the accuracy of image monitoring and guaranteeing the security of the image. Furthermore, when the detection result reaches the warning condition and the detection result corresponds to the basic image in the application image, the business image of all business applications built based on the basic image is determined, and the full-link business image monitoring is realized, while the image monitoring efficiency is improved and the monitoring cost is reduced. Furthermore, based on the detection result that reaches the warning condition, the warning prompt information is generated, and the warning prompt information is sent to the application system corresponding to the business image, so that the user corresponding to the application system can collect processing measures in time, so as to achieve the technical effect of ensuring the integrity, consistency and security of the full-link business image.

[0071] Embodiment 2

[0072] As an optional embodiment of the above embodiment, in order to make those skilled in the art further understand the technical solution of the embodiment of the present invention, a specific application scenario example is given. For details, please refer to the following specific content.

[0073] See also Figure 2, the technical solution provided in this embodiment can be implemented by an image monitoring system, which includes a data access layer, an application layer, a management layer and a data output layer. The implementation method can be: the application layer obtains the image-related data of each application image provided by the development pipeline, the image warehouse, the cloud platform and the security scanning tool in the data access layer through the interface, and stores the image-related data in the message queue. The image-related data in the message queue is detected, and when there is a risk in the basic image in the application image, the basic image with risk and the business image are analyzed to obtain the business images of at least two business applications built based on the basic image with risk. At the same time, the application system can be analyzed based on these business images to obtain the application system corresponding to these business images. Further, the detection results obtained by scanning the application image based on the security scanning tool can be managed in the management layer. The detection results that meet the warning conditions are sent to the application system through the vulnerability warning module, so that the vulnerability maintenance party corresponding to the application system manages the detected image vulnerabilities. At the same time, the application images can also be analyzed based on the image name and image version in the image-related data of each application image, so as to manage the low-version application image. In the management layer, it supports user authentication and permission management of vulnerability maintainers, application system management, image management, vulnerability management, and maintenance of asset portraits (including image-related data).

[0074] The technical solution provided in this embodiment realizes unified operation and management of image risks by managing all application images under the application system with images as the center, reduces security operation costs, and improves security management efficiency. At the same time, the image-related data and application system information in the development and test environment can be brought into the production environment, solving the problems of complex image management, backlog of vulnerabilities, and inability to locate vulnerabilities to the maintenance party in an isolated environment. It provides management of image risks and data from the dimensions of images and vulnerability detection, and improves the convenience and efficiency of image monitoring and management.

[0075] Embodiment 3

[0076] Figure 3 Schematic diagram of the structure of a mirror monitoring device provided according to Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a data acquisition module 210, a detection result determination module 220, a business mirror determination module 230 and an early warning prompt module 240.

[0077] Among them, the data acquisition module 210 is used to obtain the image-related data of at least one application image; wherein different application images correspond to different business applications; the application image is an operating environment of the business application constructed based on the application program and dependencies of the corresponding business application and the basic image; the detection result determination module 220 is used to detect the image-related data for each application image according to the image detection method corresponding to at least one detection dimension, and obtain the detection result corresponding to the application image under at least one detection dimension; the business image determination module 230 is used to determine the business images of at least two business applications constructed based on the basic image when at least one of the detection results reaches the warning condition and the detection result that reaches the warning condition corresponds to the basic image in the application image; the warning prompt module 240 is used to generate warning prompt information based on the detection result that reaches the warning condition, and send the warning prompt information to the application system corresponding to the business image.

[0078] The technical solution of this embodiment is to obtain image-related data of at least one application image; different application images correspond to different business applications; the application image is an operating environment of a business application constructed based on the application program and dependencies of the corresponding business application and the basic image; the image-related data is detected according to the image detection method corresponding to at least one detection dimension, and the detection result corresponding to the application image under at least one detection dimension is obtained; when at least one detection result reaches the warning condition and the detection result that meets the warning condition corresponds to the basic image in the application image, the business image of at least two business applications constructed based on the basic image is determined; based on the detection result that meets the warning condition, a warning prompt information is generated, and the warning prompt information is sent to the application system corresponding to the business image, which solves the problem of high monitoring cost and monitoring lag in the prior art by monitoring each container image separately, and realizes that the image-related data of the application image is detected according to the image detection method corresponding to at least one detection dimension, and the detection result corresponding to the application image under at least one detection dimension is obtained, thereby ensuring the accuracy of image monitoring and guaranteeing the security of the image. Furthermore, when the detection result reaches the warning condition and the detection result corresponds to the basic image in the application image, the business image of all business applications built based on the basic image is determined, and the full-link business image monitoring is realized, while the image monitoring efficiency is improved and the monitoring cost is reduced. Furthermore, based on the detection result that reaches the warning condition, the warning prompt information is generated, and the warning prompt information is sent to the application system corresponding to the business image, so that the user corresponding to the application system can collect processing measures in time, so as to achieve the technical effect of ensuring the integrity, consistency and security of the full-link business image.

[0079] On the basis of the above device, optionally, the detection result determination module 220 includes:

[0080] A vulnerability detection unit is used to perform vulnerability detection on the image-related data according to an image detection method corresponding to at least one vulnerability indicator in the vulnerability detection dimension when the detection dimension includes a vulnerability detection dimension, so as to obtain a detection result corresponding to the application image under each of the vulnerability indicators; wherein the vulnerability indicators include at least operating system vulnerabilities, third-party software vulnerabilities, application configuration vulnerabilities, and weak password vulnerabilities.

[0081] On the basis of the above device, optionally, the detection result determination module 220 includes:

[0082] an intermediate value determining unit, configured to determine an intermediate value based on a detection result corresponding to each vulnerability indicator of the application image when the detection dimension includes a signature verification dimension;

[0083] A signature-to-be-verified determining unit, configured to determine the signature to be verified based on the image unique identifier in the image association data and the intermediate value;

[0084] The signature verification unit is used to obtain the detection result corresponding to the application image under the signature verification dimension based on the signature to be verified and the image security signature in the image association data.

[0085] On the basis of the above device, optionally, the detection result determination module 220 includes:

[0086] an image source determination unit, configured to determine, when the detection dimension includes an image source detection dimension, a first image source of the application image in the image association data and a second image source of a base image corresponding to the application image;

[0087] The image source detection unit is used to determine the detection result corresponding to the application image under the image source detection dimension based on the first image source and the second image source.

[0088] On the basis of the above device, optionally, the early warning prompt module 240 includes:

[0089] A determination unit, used to determine the application system corresponding to each of the business images;

[0090] A determination unit is used to generate early warning prompt information based on the detection results of the early warning conditions reached by the business image corresponding to the same application system, and send the early warning prompt information to the application system; wherein the early warning prompt information includes the detection results and the vulnerability information and disposal suggestion information corresponding to the detection results.

[0091] On the basis of the above device, optionally, the device includes:

[0092] A page display unit, used to display a mirror monitoring page; wherein the mirror monitoring page includes a search term input control;

[0093] A search object information determining unit, configured to obtain the search object information in the search word input control in response to a triggering operation on the search word input control;

[0094] A first search unit, configured to display, when the object type of the search object information is an application image, a base image used by the application image corresponding to the search object information and a detection result corresponding to the application image under at least one detection dimension;

[0095] A second search unit, configured to display, when the object type of the search object information is a basic image, an application image constructed based on the basic image corresponding to the search object information and a detection result corresponding to the application image under at least one detection dimension;

[0096] The third search unit is used to display the application image associated with the application system corresponding to the search object information and the detection result corresponding to the application image under at least one detection dimension when the object type of the search object information is the application system.

[0097] On the basis of the above device, optionally, the device includes:

[0098] An image version determining unit, used to determine the image name and image version of the application image from the image association data;

[0099] The management unit is used to determine the highest image version of the at least two application images when there are at least two application images with the same image name, and to manage the application images whose image versions are lower than the highest version.

[0100] The mirror monitoring device provided in the embodiment of the present invention can execute the mirror monitoring method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0101] Embodiment 4

[0102] Figure 4: is a schematic diagram of the structure of an electronic device that implements the mirror monitoring method of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0103] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0104] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0105] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the mirror monitoring method.

[0106] In some embodiments, the image monitoring method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the image monitoring method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the image monitoring method in any other appropriate manner (e.g., by means of firmware).

[0107] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0108] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0109] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0110] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0111] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0112] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0113] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the mirror monitoring method provided by any embodiment of the present invention.

[0114] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0115] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0116] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A mirror monitoring method, characterized in that: include: Obtaining image-related data of at least one application image; wherein different application images correspond to different business applications; the application image is an operating environment of the business application constructed based on the application program and dependencies of the corresponding business application and a base image; For each of the application images, the image-related data is detected according to the image detection method corresponding to at least one detection dimension to obtain a detection result corresponding to the application image under at least one detection dimension; When at least one of the detection results reaches a warning condition, and the detection result that reaches the warning condition corresponds to a base image in the application image, determining business images of at least two business applications built based on the base image; Based on the detection result that meets the warning condition, early warning prompt information is generated, and the early warning prompt information is sent to the application system corresponding to the business image.

2. The method according to claim 1, characterized in that The detecting the image-related data according to the image detection method corresponding to at least one detection dimension to obtain the detection result corresponding to the application image under at least one detection dimension includes: In the case where the detection dimension includes a vulnerability detection dimension, vulnerability detection is performed on the image-related data according to an image detection method corresponding to at least one vulnerability indicator in the vulnerability detection dimension to obtain a detection result corresponding to the application image under each vulnerability indicator; Among them, the vulnerability indicators include at least operating system vulnerabilities, third-party software vulnerabilities, application configuration vulnerabilities and weak password vulnerabilities.

3. The method according to claim 2, characterized in that The detecting the image-related data according to the image detection method corresponding to at least one detection dimension to obtain the detection result corresponding to the application image under at least one detection dimension includes: In a case where the detection dimension includes a signature verification dimension, determining an intermediate value based on a detection result corresponding to the application image under each of the vulnerability indicators; Determine the signature to be verified based on the image unique identifier in the image association data and the intermediate value; Based on the signature to be verified and the image security signature in the image-related data, a detection result corresponding to the application image under the signature verification dimension is obtained.

4. The method according to claim 1, characterized in that The detecting the image-related data according to the image detection method corresponding to at least one detection dimension to obtain the detection result corresponding to the application image under at least one detection dimension includes: In a case where the detection dimension includes an image source detection dimension, determining a first image source of the application image in the image association data and a second image source of a base image corresponding to the application image; Based on the first image source and the second image source, a detection result corresponding to the application image under the image source detection dimension is determined.

5. The method according to claim 1, characterized in that The generating of early warning prompt information based on the detection result that reaches the early warning condition, and sending the early warning prompt information to the application system corresponding to the business image, comprises: Determine the application system corresponding to each of the business images; Generate warning prompt information based on the detection result of the warning condition reached by the business mirror corresponding to the same application system, and send the warning prompt information to the application system; The warning prompt information includes the detection result and the vulnerability information and disposal suggestion information corresponding to the detection result.

6. The method according to claim 1, characterized in that The method further comprises: Displaying a mirror monitoring page; wherein the mirror monitoring page includes a search term input control; In response to a triggering operation on the search word input control, obtaining search object information in the search word input control; When the object type of the search object information is an application image, display the base image used by the application image corresponding to the search object information and the detection result corresponding to the application image under at least one detection dimension; When the object type of the search object information is a basic image, displaying an application image constructed based on the basic image corresponding to the search object information and a detection result corresponding to the application image under at least one detection dimension; When the object type of the search object information is an application system, an application image associated with the application system corresponding to the search object information and a detection result corresponding to the application image under at least one detection dimension are displayed.

7. The method according to claim 1, characterized in that After acquiring the image-related data of at least one application image, the method further includes: Determine the image name and image version of the application image from the image association data; When there are at least two application images with the same image name, the highest image version among the at least two application images is determined, and management processing is performed on the application images with image versions lower than the highest image version.

8. A mirror monitoring device, characterized in that: include: A data acquisition module, used to acquire image-related data of at least one application image; wherein different application images correspond to different business applications; and the application image is a running environment of the business application constructed based on the application program and dependencies of the corresponding business application and the base image; A detection result determination module, configured to detect the image-related data for each of the application images according to an image detection method corresponding to at least one detection dimension, and obtain a detection result corresponding to the application image under at least one detection dimension; A business image determination module, configured to determine business images of at least two business applications constructed based on the base image when at least one of the detection results reaches a warning condition and the detection result that reaches the warning condition corresponds to a base image in the application image; The early warning prompt module is used to generate early warning prompt information based on the detection result that meets the early warning condition, and send the early warning prompt information to the application system corresponding to the business image.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory in communication with the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the mirror monitoring method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the mirror monitoring method according to any one of claims 1 to 7 when executed.

Images