Container escape protection method, device and equipment and storage medium

Abstract

The invention discloses a container escape protection method and device, equipment and a storage medium, and relates to the field of network security, and the method comprises the steps: collecting container behavior data of a target container through a preset probe; determining a behavior calling frequency and a behavior interaction frequency corresponding to the container behavior data, calculating a behavior entropy corresponding to the target container based on the behavior calling frequency, and calculating an escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency; inputting the container behavior data into a preset abnormal behavior analysis model so as to determine a behavior value corresponding to the container behavior data through the abnormal behavior analysis model; and determining whether an abnormal escape behavior exists in the target container based on the escape activity score and the behavior value, and if yes, executing a preset escape protection measure. Therefore, whether the escape behavior exists in the container or not can be determined by analyzing the container behavior data collected in real time, and the timeliness of container escape protection is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a container escape protection method, device, equipment and storage medium. Background Art

[0002] With the rapid development of cloud computing and containerization technology, Docker containers have become one of the core tools for application deployment and operation and maintenance. However, the security issues of Docker containers have become increasingly prominent, and the security issues of containers have become particularly important, especially the risk of container escape, which allows attackers to gain control of the host machine from inside the container, posing a serious threat to the entire system. In the existing technology, container escape is usually detected and protected through known vulnerabilities, but this method has obvious lags. That is, after the security vulnerability is discovered, the manufacturer will release a patch to fix it, and during this period of time, the system may still face the risk of being exploited.

[0003] It can be seen that how to monitor and intelligently analyze containers in real time, and then promptly detect and prevent potential container escape behaviors, is a problem that technical personnel in this field need to solve. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a container escape protection method, device, equipment and storage medium, which can determine whether the container has escape behavior by analyzing the container behavior data collected in real time, thereby effectively improving the timeliness of container escape protection. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a container escape protection method, comprising:

[0006] Collect container behavior data of the target container through a preset probe;

[0007] Determine the behavior call frequency and the behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency;

[0008] Inputting the container behavior data into a preset abnormal behavior analysis model to determine a behavior value corresponding to the container behavior data through the abnormal behavior analysis model;

[0009] Based on the escape activity score and the behavior value, it is determined whether the target container has abnormal escape behavior, and if abnormal escape behavior exists, a preset escape protection measure is executed.

[0010] Optionally, collecting container behavior data of the target container by using a preset probe includes:

[0011] inserting a first test code corresponding to the first preset probe at an execution position of the target container through the first preset probe, so as to record process execution information data of the target container through the first test code;

[0012] A second test code corresponding to the second preset probe is inserted into the file operation position, network connection position and system call position of the target container through the second preset probe, so as to record the file operation information data, network connection information data and system call information data corresponding to the target container through the second test code.

[0013] Optionally, determining a behavior call frequency and a behavior interaction frequency corresponding to the container behavior data, calculating a behavior entropy corresponding to the target container based on the behavior call frequency, and calculating an escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency, includes:

[0014] Determine the total number of calls of various container behavior data, and determine the number of single behavior calls corresponding to each type of container behavior data;

[0015] Taking the ratio of the single behavior call count to the total call count as the behavior call frequency corresponding to each type of the container behavior data, and determining the behavior entropy corresponding to the target container according to the behavior call frequency;

[0016] Determine the number of calls within a preset time range corresponding to each type of container behavior data by using a preset number of calls variable;

[0017] The ratio of the number of calls within the preset time range to the number of calls of the single behavior is used as the behavior interaction frequency corresponding to each type of the container behavior data;

[0018] Determine a target product between the behavior entropy and the behavior interaction frequency, and assign a first weight to the behavior entropy, a second weight to the behavior interaction frequency, and a third weight to the target product according to a preset weight;

[0019] Determine a first product between the first weight and the behavior entropy, a second product between the second weight and the behavior interaction frequency, and a third product between the third weight and the target product, and use the sum of the first product, the second product, and the third product as the escape activity score corresponding to the target container.

[0020] Optionally, before inputting the container behavior data into a preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data through the abnormal behavior analysis model, the method further includes:

[0021] Building a training data set based on historical container behavior data, and training a preset initial machine learning model using the training data set to obtain a trained model;

[0022] The model performance of the trained model is verified, and if the model performance of the trained model meets the preset model performance conditions, the trained model is used as the preset abnormal behavior analysis model;

[0023] If the model performance of the trained model does not meet the preset model performance conditions, the trained model is subjected to the next round of model training using the training data set until the obtained trained model meets the preset model performance conditions.

[0024] Optionally, inputting the container behavior data into a preset abnormal behavior analysis model to determine a behavior value corresponding to the container behavior data through the abnormal behavior analysis model includes:

[0025] Inputting the container behavior data into a preset abnormal behavior analysis model, and determining a data feature vector corresponding to the container behavior data;

[0026] Inputting the data feature vector into a preset kernel function to determine the kernel function value corresponding to the data feature vector;

[0027] Behavior values ​​corresponding to the container behavior data are determined based on the kernel function value, the preset number of training samples and the preset behavior category, and abnormal behavior data with abnormal behavior is determined through the behavior values.

[0028] Optionally, determining whether the target container has abnormal escape behavior based on the escape activity score and the behavior value, and if abnormal escape behavior exists, executing preset escape protection measures, includes:

[0029] If the escape activity score is greater than a preset score threshold and / or the behavior value is less than a preset behavior value threshold, it is determined that the target container has abnormal escape behavior, and preset escape protection measures are executed.

[0030] Optionally, the container escape protection method further includes:

[0031] The abnormal escape behavior is saved in a local database, and the preset abnormal behavior analysis model is updated according to the abnormal escape behavior saved in the local database.

[0032] In a second aspect, the present application discloses a container escape protection device, comprising:

[0033] A behavior data collection module, used to collect container behavior data of a target container through a preset probe;

[0034] A score determination module, used to determine the behavior call frequency and the behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency;

[0035] A behavior value determination module, used for inputting the container behavior data into a preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data through the abnormal behavior analysis model;

[0036] The escape measure execution module is used to determine whether the target container has abnormal escape behavior based on the escape activity score and the behavior value, and if abnormal escape behavior exists, execute a preset escape protection measure.

[0037] In a third aspect, the present application discloses an electronic device, comprising:

[0038] Memory for storing computer programs;

[0039] A processor is used to execute the computer program to implement the steps of the aforementioned container escape protection method.

[0040] In a fourth aspect, the present application discloses a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the aforementioned container escape protection method are implemented.

[0041] In the present application, firstly, the method of the present application can collect container behavior data of the target container through a preset probe; determine the behavior call frequency and behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency; input the container behavior data into a preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data through the abnormal behavior analysis model; determine whether the target container has abnormal escape behavior based on the escape activity score and the behavior value, and if there is abnormal escape behavior, execute preset escape protection measures.

[0042] Beneficial effect: Through the method of the present application, the container behavior data of the target container can be collected in real time through a preset probe, and then the behavior call frequency and behavior interaction frequency corresponding to the container behavior data can be determined by analyzing the container behavior data, so as to calculate the behavior entropy of the target container according to the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency, and then determine the behavior value of the target container based on the collected container behavior data through the abnormal behavior analysis model, and finally determine whether the target container has abnormal escape behavior according to the escape activity score and the behavior value, and execute the preset protection measures in the case of abnormal escape behavior. In this way, the behavior data of the container can be collected in real time, and the escape activity score and behavior value of the container can be obtained by analyzing the behavior data, and then the escape activity score and behavior value obtained can be used to determine whether the container has escape behavior, which effectively improves the timeliness of container escape protection and avoids the occurrence of container escape behavior due to untimely update of vulnerability patches. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A flow chart of a container escape protection method provided by an embodiment of the present invention;

[0045] Figure 2 A flow chart of a specific container escape protection method provided by an embodiment of the present invention;

[0046] Figure 3 A schematic diagram of the structure of a container escape protection device provided by an embodiment of the present invention;

[0047] Figure 4 A diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] The terms "including" and "having" in the specification of the present invention and the above-mentioned drawings, as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may include steps or units that are not listed.

[0050] Existing technologies usually use known vulnerabilities to detect and protect against container escapes. However, this method has an obvious lag. Manufacturers will only release patches to repair security vulnerabilities after they are discovered. During this period of time, the system may still face the risk of being exploited.

[0051] In order to overcome the above-mentioned technical problems, the present application discloses a container escape protection method, device, equipment and storage medium, which can determine whether the container has escape behavior by analyzing the container behavior data collected in real time, thereby effectively improving the timeliness of container escape protection.

[0052] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0053] See also Figure 1 As shown, the embodiment of the present application discloses a container escape protection method, including:

[0054] Step S11: collecting container behavior data of the target container through a preset probe.

[0055] In this embodiment, it is necessary to collect the container behavior data of the target container through a preset probe. Specifically, in the container escape protection system, the running status and behavior data of the container are monitored in real time through tools such as cAdvisor and eBPF (Extended Berkeley Packet Filter), wherein the monitored data includes but is not limited to CPU (Central Processing Unit) usage, memory usage, disk read and write, etc. At the same time, the audit system (auditd) and system call tracking (strace) technology of the Linux kernel can be used to capture and record key operations in the container. Therefore, the first test code corresponding to the first preset probe can be inserted into the execution position of the target container through the first preset probe to record the process execution information data of the target container through the first test code. That is, the sched_process_exec, sched_process_fork, and sched_process_exit of the tracepoint probe can be used to insert the corresponding test code at the code positions such as process execution, process creation, and exit, so as to collect the process execution information data of the program.

[0056] Furthermore, a second test code corresponding to the second preset probe can be inserted into the file operation position, network connection position and system call position of the target container through the second preset probe, so as to record the file operation information data, network connection information data and system call information data corresponding to the target container through the second test code. That is, the file_open, file_unlinks and file_receive of the lsm probe can be inserted into the code positions of file reading, writing, deleting and receiving to insert the corresponding test code, and then the file operation information data of the program can be collected; the code position of the network connection operation can be inserted through the lsm probe lsm / socket_bind and lsm / socket_connect. When creating or accepting a network connection, the eBPF program logic will be entered, and then the network connection information data related to the network connection can be collected according to the probe. The code position of the system call operation mount directory can be inserted through the lsm probe lsm / sb_mount, and the proxy eBPF program logic can be mounted to the position. When the system function is executed, the eBPF program logic will be entered, and then the system call information data related to the system call can be collected according to the probe. In this way, the probe can collect corresponding operation data during various container operations to ensure the comprehensiveness of the collected operation data, thereby ensuring the accuracy of subsequent container escape judgment based on the collected operation data, and maintaining real-time monitoring of the container to ensure timely detection and response to potential escape behaviors.

[0057] Step S12: determine the behavior call frequency and the behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency.

[0058] In this embodiment, it is necessary to identify abnormal behaviors of containers based on collected container behavior data. Specifically, it is necessary to first calculate the behavior entropy of container escape behavior to measure the degree of disorder of system behavior through the calculated behavior entropy. It is necessary to determine the total number of calls of various container behavior data and the number of single behavior calls corresponding to each type of container behavior data, and then calculate the ratio of the number of single behavior calls to the total number of calls, and use the obtained ratio as the call frequency corresponding to each type of container behavior data, and then calculate the behavior entropy corresponding to the target container according to all the obtained call frequencies. It should be noted that the formula for calculating the behavior entropy is:

[0059] S=∑P(i)*log(P(i))+∑P(j)*log(P(j))+∑ P(k)*log(P(K))+…;

[0060] Among them, S is the behavior entropy corresponding to the target container, P(i) represents the frequency of the i-th behavior call, and i, j, and k represent different types of container behavior data collected.

[0061] Furthermore, it is necessary to calculate the behavior interaction frequency of the target container. Specifically, a global variable can be defined in the container kernel to store the total number of each behavior. Each time a behavior occurs, this global variable is updated, and a kernel timer can be defined to be triggered once every minute, and then the ratio of the number of calls within the preset time range to the number of calls of the single behavior is used as the behavior interaction frequency corresponding to each type of container behavior data. It should be noted that the preset time range can be set according to user needs, and in this embodiment it is set to ten minutes. Among them, the formula for calculating the behavior interaction frequency is:

[0062] DIF=ΔC(i) / C(i)+ΔC(j) / C(j)+ΔC(k) / C(k)+…;

[0063] Among them, ΔC is the number of calls of a single behavior data within a preset time range, C is the number of single behavior calls, that is, the total number of single behavior calls, and i, j, and k represent different types of container behavior data collected.

[0064] Finally, the behavior interaction frequency DIF and the behavior entropy S can be integrated together to calculate the container escape activity score TRP. Specifically, the target product between the behavior entropy and the behavior interaction frequency can be calculated, and then the first weight α is assigned to the behavior interaction frequency, the second weight β is assigned to the behavior entropy, and the third weight γ is assigned to the target product according to the preset weight. The expression of the container escape activity score TRP is as follows:

[0065] TRP=α*DIF+β*S+γ*DIF*S.

[0066] Step S13: inputting the container behavior data into a preset abnormal behavior analysis model to determine a behavior value corresponding to the container behavior data through the abnormal behavior analysis model.

[0067] In this embodiment, the container behavior data can be analyzed by a preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data. Specifically, before the container behavior data is input into the preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data by the abnormal behavior analysis model, it is also necessary to construct a training data set based on the historical container behavior data stored in the container escape protection local database, and then train the preset initial machine learning model by the training data set to obtain a trained model; it should be noted that the preset initial machine learning model includes but is not limited to machine learning models such as vector machines and random forest models. Then, it is necessary to verify the model performance of the trained model to determine whether the model performance of the trained model can meet the preset performance requirements. If it does not meet the performance requirements set by the user, it is necessary to perform the next round of model training on the trained model by the training data set until the obtained trained model meets the preset model performance conditions. If the model performance of the trained model obtained after training meets the preset model performance conditions, the trained model can be used as the preset abnormal behavior analysis model.

[0068] Furthermore, the container behavior data can be input into a preset abnormal behavior analysis model to convert the container behavior data into a corresponding data feature vector, and then the obtained data feature vector is used as the input value of a preset kernel function. The kernel function value corresponding to the data feature vector is obtained after calculation through the preset kernel function. Finally, the number of data types with normal behavior in the container behavior data is determined according to the kernel function value, the preset number of training samples, the preset behavior category, the preset vector weight and the preset bias item, and finally the number of data types with normal behavior is used as the behavior value corresponding to the container behavior data.

[0069] Step S14: determining whether the target container has abnormal escape behavior based on the escape activity score and the behavior value; if abnormal escape behavior exists, executing preset escape protection measures.

[0070] In this embodiment, it can be determined whether the target container has abnormal escape behavior based on the escape activity score and the behavior value. Specifically, a preset score threshold corresponding to the escape activity score and a behavior value threshold corresponding to the behavior value can be set. When any one of the situations occurs that the escape activity score is greater than the preset score threshold or the behavior value is less than the preset behavior value threshold, it can be determined that the target container has abnormal escape behavior.

[0071] Furthermore, when it is determined that the target container has abnormal escape behavior, the preset escape protection measures can be executed, such as isolating suspicious containers, restricting the network access rights of suspicious containers, recording and reporting abnormal behaviors of suspicious containers, etc. The container escape protection system also supports custom security policies. In this way, the system can automatically execute corresponding response measures according to the preset security policies, effectively ensuring the real-time nature of container escape protection and effectively improving the user experience.

[0072] Furthermore, through the method of the present application, the system's performance indicators (such as CPU usage, memory usage, network bandwidth, etc.) can be monitored to ensure that the system can still run stably under high load, and the resource allocation and scheduling strategies can be optimized according to the actual operation of the system to improve resource utilization and system performance. The capacity and scale of the system can also be dynamically adjusted according to changes in business needs, such as increasing resource input during peak demand periods and reducing resource consumption during low demand periods, thereby achieving flexible resource management.

[0073] It should be noted that after determining that a container has escaped, the abnormal escape behavior needs to be saved to the local database, and then the preset abnormal behavior analysis model is updated through the abnormal escape behavior saved in the local database. Furthermore, it is also possible to continuously obtain various container escape protection patches and various container escape vulnerabilities in real time based on user feedback and network crawlers, and continuously update the container escape protection system based on the above content, regularly iterate and upgrade the system version, ensure that the system is always in the best state, introduce new algorithms and technologies, and improve the intelligence level and security protection capabilities of the system. In this way, the timeliness of container escape protection can be improved, and the occurrence of container escape behavior caused by untimely vulnerability patch updates can be avoided.

[0074] In this embodiment, the container behavior data of the target container is first collected in real time through a preset probe, and then the behavior call frequency and behavior interaction frequency corresponding to the container behavior data are determined by analyzing the container behavior data, so as to calculate the behavior entropy of the target container according to the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency, and then determine the behavior value of the target container based on the collected container behavior data through the abnormal behavior analysis model, and finally determine whether the target container has abnormal escape behavior according to the escape activity score and the behavior value, and execute the preset protection measures in the case of abnormal escape behavior. In this way, the behavior data of the container can be collected in real time, and the escape activity score and behavior value of the container can be obtained by analyzing the behavior data, and then the escape activity score and behavior value obtained can be used to determine whether the container has escape behavior. On the one hand, the timeliness of container escape protection is effectively improved, and the occurrence of container escape behavior caused by untimely update of vulnerability patches is avoided; on the other hand, according to the preset security policy, the system can automatically execute the corresponding response measures, reduce the need for manual intervention, and reduce the burden on operation and maintenance personnel; on the other hand, according to user feedback and technology development trends, the system can be continuously updated and improved to improve the intelligence level and security protection capabilities of the system.

[0075] Based on the above embodiments, it can be known that through the method of the present application, the container behavior data can be input into the preset abnormal behavior analysis model to automatically determine whether the container has escape activities through the preset abnormal behavior analysis model. To this end, the present application describes in detail how to automatically determine whether the container has escape activities through the preset abnormal behavior analysis model. Figure 2 As shown, the embodiment of the present application discloses a container escape protection method, including:

[0076] Step S21: collecting container behavior data of the target container through a preset probe.

[0077] Step S22: determine the behavior call frequency and the behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency.

[0078] Step S23: input the container behavior data into a preset abnormal behavior analysis model, and determine a data feature vector corresponding to the container behavior data.

[0079] In this embodiment, after collecting the container behavior data, the container behavior data can be input into a preset abnormal behavior analysis model. After receiving the container behavior data, the preset behavior analysis model first needs to convert the container behavior data into a corresponding data feature vector, for example, converting the process, file, network, system call and other data information in the container behavior data into their respective corresponding feature vectors x i It should be noted that since the preset abnormal behavior analysis model is an analysis model built based on a machine learning model, by converting data into a vector form, the preset abnormal behavior analysis model can learn and identify more reliably and better. In this way, the accuracy of escape behavior identification is effectively improved.

[0080] Step S24: input the data feature vector into a preset kernel function to determine the kernel function value corresponding to the data feature vector.

[0081] In this embodiment, the data feature vector needs to be processed by a preset kernel function within the preset abnormal behavior analysis model to determine the kernel function value corresponding to the feature vectors. It should be noted that the feature vector x can be measured by the kernel function. i and x j The familiarity between them can be calculated by the kernel function, and the feature vector can be mapped to the high-dimensional feature space, and the inner product in the high-dimensional space can be directly calculated by the kernel function, thereby simplifying the calculation process. i ,x j ) is as follows:

[0082] ;

[0083] K(x i ,x j )=exp(−2σ 2 ∥x i −x j ∥ 2 );

[0084] Among them, K(x i ,x j ) is the kernel function, x i 、x j represents the eigenvector, ||x i -x j || is the difference between eigenvectors, and σ is the width parameter of the kernel function.

[0085] Step S25: determining the behavior values ​​corresponding to the container behavior data respectively based on the kernel function value, the preset number of training samples and the preset behavior category, and determining the abnormal behavior data of the abnormal behavior through the behavior values.

[0086] In this embodiment, the number of data types with normal behavior in the container behavior data can be determined according to the obtained kernel function value, the preset number of training samples, and the preset behavior category. It should be noted that the number of data types with normal behavior in the container behavior data can be determined by the behavior analysis algorithm of the preset abnormal behavior analysis model, and the expression of the behavior analysis algorithm is as follows:

[0087] ;

[0088] Among them, y represents the behavior category (normal or abnormal), y i is the category label of the i-th sample in the training data set, n is the preset number of training samples, α i is the support vector coefficient (the weight set by the user in the actual scenario), K(x i ,x j ) is the kernel function, x i 、x j represents the feature vector, σ is the width parameter of the kernel function, and b is the preset bias term (such as a baseline value or threshold).

[0089] Therefore, when f(x)>0, it indicates normal behavior, and when f(x)<0, it indicates abnormal behavior. It should be noted that the container escape protection system defines a series of escape behavior characteristics, such as attempting to mount sensitive file systems, modifying key system files, and executing unauthorized network connections. When the behavior value of the behavior data corresponding to these behaviors is less than 0, it can be determined that abnormal escape behavior exists. In this way, the normal and abnormal behavior data in the container behavior data can be automatically determined through the preset abnormal behavior analysis model, and then the container can be measured to determine whether there is escape behavior, which effectively improves the judgment efficiency.

[0090] Step S26: determining whether the target container has abnormal escape behavior based on the escape activity score and the behavior value; if abnormal escape behavior exists, executing preset escape protection measures.

[0091] It can be seen that through the method of the present application, the collected container behavior data can be input into the preset abnormal behavior analysis model, and the data feature vector corresponding to the container behavior data can be determined, and then the data feature vector can be input into the preset kernel function to determine the kernel function value corresponding to the data feature vector, and finally the behavior values ​​corresponding to the container behavior data can be determined based on the kernel function value, the preset number of training samples and the preset behavior category, and the abnormal behavior data with abnormal behavior can be determined by the behavior value. In this way, through real-time monitoring and intelligent analysis, potential container escape behaviors can be discovered and prevented in a timely manner, effectively reducing the risk of attackers controlling the host machine through container vulnerabilities, and significantly improving the security protection level of the container through this active defense mechanism.

[0092] See also Figure 3 As shown, the embodiment of the present application discloses a container escape protection device, comprising:

[0093] A behavior data collection module 11 is used to collect container behavior data of a target container through a preset probe;

[0094] A score determination module 12, used to determine the behavior call frequency and the behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency;

[0095] A behavior value determination module 13, used for inputting the container behavior data into a preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data through the abnormal behavior analysis model;

[0096] The escape measure execution module 14 is used to determine whether the target container has abnormal escape behavior based on the escape activity score and the behavior value, and if abnormal escape behavior exists, execute a preset escape protection measure.

[0097] In the present application, firstly, the method of the present application can collect container behavior data of the target container through a preset probe; determine the behavior call frequency and behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency; input the container behavior data into a preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data through the abnormal behavior analysis model; determine whether the target container has abnormal escape behavior based on the escape activity score and the behavior value, and if there is abnormal escape behavior, execute preset escape protection measures. It can be seen that, through the method of the present application, the container behavior data of the target container can be collected in real time through a preset probe, and then the behavior call frequency and behavior interaction frequency corresponding to the container behavior data can be determined by analyzing the container behavior data, so as to calculate the behavior entropy of the target container according to the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency, and then determine the behavior value of the target container based on the collected container behavior data through the abnormal behavior analysis model, and finally determine whether the target container has abnormal escape behavior according to the escape activity score and the behavior value, and execute the preset protection measures in the case of abnormal escape behavior. In this way, the behavior data of the container can be collected in real time, and the escape activity score and behavior value of the container can be obtained by analyzing the behavior data, and then the escape activity score and behavior value obtained can be used to determine whether the container has escape behavior, which effectively improves the timeliness of container escape protection and avoids the occurrence of container escape behavior due to untimely update of vulnerability patches.

[0098] In some embodiments, the behavior data collection module 11 may specifically include:

[0099] A first data acquisition unit, configured to insert a first test code corresponding to the first preset probe at an execution position of the target container through a first preset probe, so as to record process execution information data of the target container through the first test code;

[0100] The second data acquisition unit is used to insert a second test code corresponding to the second preset probe at the file operation position, network connection position and system call position of the target container through the second preset probe, so as to record the file operation information data, network connection information data and system call information data corresponding to the target container through the second test code.

[0101] In some embodiments, the score determination module 12 may specifically include:

[0102] A first call count determination unit, configured to determine a total call count of various container behavior data, and determine a single behavior call count corresponding to each type of container behavior data;

[0103] a call frequency calculation unit, configured to use the ratio of the number of calls of the single behavior to the total number of calls as the behavior call frequency corresponding to each type of the container behavior data, and determine the behavior entropy corresponding to the target container according to the behavior call frequency;

[0104] A second call count determination unit, configured to determine the call count within a preset time range corresponding to each type of container behavior data by using a preset call count variable;

[0105] An interaction frequency calculation unit, used to take the ratio of the number of calls within the preset time range to the number of calls of the single behavior as the behavior interaction frequency corresponding to each type of the container behavior data;

[0106] a weight allocation unit, configured to determine a target product between the behavior entropy and the behavior interaction frequency, and to allocate a first weight to the behavior entropy, a second weight to the behavior interaction frequency, and a third weight to the target product according to a preset weight;

[0107] an escape activity score calculation unit, configured to determine a first product between the first weight and the behavior entropy, a second product between the second weight and the behavior interaction frequency, and a third product between the third weight and the target product, and use the sum of the first product, the second product, and the third product as the escape activity score corresponding to the target container.

[0108] In some embodiments, the container escape protection device may further include:

[0109] A first model training unit, configured to construct a training data set based on historical container behavior data, and train a preset initial machine learning model using the training data set to obtain a trained model;

[0110] A performance verification unit, used to verify the model performance of the trained model, and if the model performance of the trained model meets the preset model performance conditions, the trained model is used as a preset abnormal behavior analysis model;

[0111] The second model training unit is used to perform the next round of model training on the trained model through the training data set if the model performance of the trained model does not meet the preset model performance conditions, until the obtained trained model meets the preset model performance conditions.

[0112] In some embodiments, the behavior value determination module 13 may specifically include:

[0113] A data conversion unit, used to input the container behavior data into a preset abnormal behavior analysis model, and determine a data feature vector corresponding to the container behavior data;

[0114] A function value output unit, used for inputting the data feature vector into a preset kernel function to determine a kernel function value corresponding to the data feature vector;

[0115] The abnormal behavior data determining unit is used to determine the behavior values ​​corresponding to the container behavior data respectively based on the kernel function value, the preset number of training samples and the preset behavior category, and determine the abnormal behavior data of the abnormal behavior through the behavior value.

[0116] In some embodiments, the escape measure execution module 14 may specifically include:

[0117] The escape measure execution unit is used to determine that the target container has abnormal escape behavior and execute preset escape protection measures if the escape activity score is greater than a preset score threshold and / or the behavior value is less than a preset behavior value threshold.

[0118] In some embodiments, the container escape protection device may further include:

[0119] The model updating unit is used to save the abnormal escape behavior to a local database, and update the preset abnormal behavior analysis model according to the abnormal escape behavior saved in the local database.

[0120] Furthermore, the present application also discloses an electronic device. Figure 4 This is a structural diagram of an electronic device according to an exemplary embodiment. The content in the diagram cannot be considered as any limitation on the scope of use of this application. The electronic device may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the container escape protection method disclosed in any of the aforementioned embodiments. In addition, the electronic device in this embodiment may specifically be an electronic computer.

[0121] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0122] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0123] The operating system 221 is used to manage and control various hardware devices on the electronic device and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the container escape protection method performed by the electronic device disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0124] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the container escape protection method disclosed above is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0125] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0126] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0127] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0128] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0129] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A container escape protection method, characterized in that: include: Collect container behavior data of the target container through a preset probe; Determine the behavior call frequency and the behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency; Inputting the container behavior data into a preset abnormal behavior analysis model to determine a behavior value corresponding to the container behavior data through the abnormal behavior analysis model; Based on the escape activity score and the behavior value, it is determined whether the target container has abnormal escape behavior, and if abnormal escape behavior exists, a preset escape protection measure is executed.

2. The container escape protection method according to claim 1, characterized in that: The collecting of container behavior data of the target container by using a preset probe includes: inserting a first test code corresponding to the first preset probe at an execution position of the target container through the first preset probe, so as to record process execution information data of the target container through the first test code; A second test code corresponding to the second preset probe is inserted into the file operation position, network connection position and system call position of the target container through the second preset probe, so as to record the file operation information data, network connection information data and system call information data corresponding to the target container through the second test code.

3. The container escape protection method according to claim 1, characterized in that: The determining the behavior call frequency and the behavior interaction frequency corresponding to the container behavior data, calculating the behavior entropy corresponding to the target container based on the behavior call frequency, and calculating the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency, includes: Determine the total number of calls of various container behavior data, and determine the number of single behavior calls corresponding to each type of container behavior data; Taking the ratio of the single behavior call count to the total call count as the behavior call frequency corresponding to each type of the container behavior data, and determining the behavior entropy corresponding to the target container according to the behavior call frequency; Determine the number of calls within a preset time range corresponding to each type of container behavior data by using a preset number of calls variable; The ratio of the number of calls within the preset time range to the number of calls of the single behavior is used as the behavior interaction frequency corresponding to each type of the container behavior data; Determine a target product between the behavior entropy and the behavior interaction frequency, and assign a first weight to the behavior entropy, a second weight to the behavior interaction frequency, and a third weight to the target product according to a preset weight; Determine a first product between the first weight and the behavior entropy, a second product between the second weight and the behavior interaction frequency, and a third product between the third weight and the target product, and use the sum of the first product, the second product, and the third product as the escape activity score corresponding to the target container.

4. The container escape protection method according to claim 1, characterized in that: Before inputting the container behavior data into a preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data through the abnormal behavior analysis model, the method further includes: Building a training data set based on historical container behavior data, and training a preset initial machine learning model using the training data set to obtain a trained model; The model performance of the trained model is verified, and if the model performance of the trained model meets the preset model performance conditions, the trained model is used as the preset abnormal behavior analysis model; If the model performance of the trained model does not meet the preset model performance conditions, the trained model is subjected to the next round of model training using the training data set until the obtained trained model meets the preset model performance conditions.

5. The container escape protection method according to claim 1, characterized in that: The step of inputting the container behavior data into a preset abnormal behavior analysis model to determine a behavior value corresponding to the container behavior data through the abnormal behavior analysis model includes: Inputting the container behavior data into a preset abnormal behavior analysis model, and determining a data feature vector corresponding to the container behavior data; Inputting the data feature vector into a preset kernel function to determine the kernel function value corresponding to the data feature vector; Behavior values ​​corresponding to the container behavior data are determined based on the kernel function value, the preset number of training samples, and the preset behavior category, and abnormal behavior data with abnormal behavior is determined through the behavior values.

6. The container escape protection method according to claim 1, characterized in that: The determining whether the target container has abnormal escape behavior based on the escape activity score and the behavior value, and if abnormal escape behavior exists, executing preset escape protection measures, includes: If the escape activity score is greater than a preset score threshold and / or the behavior value is less than a preset behavior value threshold, it is determined that the target container has abnormal escape behavior, and preset escape protection measures are executed.

7. The container escape protection method according to any one of claims 1 to 6, characterized in that: Also includes: The abnormal escape behavior is saved in a local database, and the preset abnormal behavior analysis model is updated according to the abnormal escape behavior saved in the local database.

8. A container escape protection device, characterized in that: include: A behavior data collection module, used to collect container behavior data of a target container through a preset probe; A score determination module, used to determine the behavior call frequency and the behavior interaction frequency corresponding to the container behavior data, calculate the behavior entropy corresponding to the target container based on the behavior call frequency, and calculate the escape activity score corresponding to the target container according to the behavior entropy and the behavior interaction frequency; A behavior value determination module, used for inputting the container behavior data into a preset abnormal behavior analysis model to determine the behavior value corresponding to the container behavior data through the abnormal behavior analysis model; The escape measure execution module is used to determine whether the target container has abnormal escape behavior based on the escape activity score and the behavior value, and if abnormal escape behavior exists, execute a preset escape protection measure.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the container escape protection method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the container escape protection method according to any one of claims 1 to 7 are implemented.

Images