Container mirror image supply chain multi-dimensional security detection system and method based on large model

Abstract

The invention provides a container mirror image supply chain multi-dimensional security detection system and method based on a large model. The system comprises an interaction node and a security analysis node, the interaction node is configured to create a software analysis task, configure the analysis task, dynamically execute the analysis task and depend on the analysis task; the security analysis node comprises a software analysis module configured to identify vulnerability risks existing in software based on a large model; the configuration analysis module is configured to identify vulnerability risks existing in the configuration file based on the large model; the dynamic execution analysis module is configured to identify a vulnerability risk existing in the dynamic execution command based on the large model; the dependency analysis module is configured to obtain a detection result of the security risk of the mirror image in the upstream and downstream of the supply chain; and the interaction node is further configured to combine the detection results of all the mirror images. According to the method, the whole container mirror image supply chain can be traced, so that vulnerability risk early warning and troubleshooting can be effectively and comprehensively carried out.

Description

Technical Field

[0001] The present invention relates to the field of container image supply chain security technology, and in particular to a large model-based container image supply chain multi-dimensional security detection system and method. Background Art

[0002] Container technology, represented by Docker, has been widely used in software and system development and production due to its convenience. In the Docker community, there are more than 10 million images of various types. Therefore, the security issues of Docker images have gradually become prominent. Palo Alto Network security researchers have discovered 30 Docker images with Trojans, which have been downloaded more than 20 million times in total.

[0003] This fully demonstrates that the images in the Docker community are not secure enough, and some malicious attackers may use the trust of developers in community images to carry out supply chain poisoning attacks. And some vulnerability risks introduced due to negligence may also pose a security threat to the developer's usage environment.

[0004] For containerization technology, after each image is built, all the contents it contains are fixed. It can be considered that once a security risk occurs in an image, it cannot be patched at the image level. From the perspective of container technology, a patched image will be considered a brand new image.

[0005] Existing container image detection technologies generally detect a single image, that is, detect based on the provided image. However, this method cannot trace the entire container image supply chain, and cannot effectively and comprehensively conduct vulnerability risk warning and troubleshooting.

[0006] It should be noted that the information disclosed in the background technology section of the invention is only intended to deepen the understanding of the general background technology of the invention, and should not be regarded as an admission or suggestion in any form that the information constitutes prior art already known to those skilled in the art. Summary of the invention

[0007] The purpose of the present invention is to provide a large-model-based multi-dimensional security detection system and method for container image supply chain, which can trace the entire container image supply chain, thereby effectively and comprehensively performing vulnerability risk warning and investigation.

[0008] To achieve the above-mentioned purpose, the present invention provides a container image supply chain multi-dimensional security detection system based on a large model, comprising an interactive node and at least one security analysis node, wherein the security analysis node is communicatively connected to the interactive node; the interactive node is configured to create a software analysis task, a configuration analysis task, a dynamic execution analysis task and a dependency analysis task for each image to be detected in the target container image supply chain; the security analysis node comprises a software analysis module, a configuration analysis module, a dynamic execution analysis module and a dependency analysis module; the software analysis module is configured to identify the software contained in the image to be detected and the vulnerability risk of the software based on the large model according to the software analysis task corresponding to the image to be detected, so as to obtain the software analysis result corresponding to the image to be detected; the configuration analysis module is configured to identify the software contained in the image to be detected and the vulnerability risk of the software based on the large model according to the configuration analysis task corresponding to the image to be detected, for each image to be detected The large model identifies the configuration file in the image to be detected and the vulnerability risk of the configuration file to obtain the configuration analysis result corresponding to the image to be detected; the dynamic execution analysis module is configured to identify the dynamic execution command in the image to be detected and the vulnerability risk of the dynamic execution command based on the large model for each image to be detected according to the dynamic execution analysis task corresponding to the image to be detected, so as to obtain the dynamic execution analysis result corresponding to the image to be detected; the dependency analysis module is configured to obtain the detection result of the security risk of the image to be detected in the upstream and downstream of the supply chain according to the dependency analysis task corresponding to the image to be detected, based on the software analysis result, configuration analysis result and dynamic execution analysis result corresponding to the image to be detected; the interactive node is also configured to merge the detection results of all the images to be detected to generate a security detection report for the target container image supply chain.

[0009] Optionally, the software analysis module is configured to obtain the software analysis result corresponding to the image to be detected through the following steps: reading the software information recorded in the software package manager of the image to be detected; globally traversing all files in the image to be detected to find the target file; using the directory where the target file is located and the target file as input to the large model; using the retrieval enhancement generation technology, based on a pre-built knowledge base and a pre-set first prompt word, to guide the large model to output the software information corresponding to the target file, the knowledge base including the target file name, target file content, and the software name and version number corresponding to the target file path; if the large model cannot successfully output the software information corresponding to the target file, extract the target file; The method comprises the following steps: obtaining feature information corresponding to the target file, and obtaining fingerprint information based on the feature information, wherein the feature information includes architecture, version, ELF header size, file type, number of program header table entries, number of section header table entries, type of each program segment, offset address of each program segment, name of each section, type of each section and offset address of each section; comparing the fingerprint information with a pre-built software information database to obtain software information corresponding to the target file, wherein the software information database includes software names and versions corresponding to different fingerprint information; and matching in a pre-built vulnerability database according to the software information to identify vulnerability risks existing in the corresponding software, wherein the vulnerability database includes software names and version numbers affected by the vulnerabilities.

[0010] Optionally, the configuration analysis module is configured to obtain the configuration analysis result corresponding to the image to be detected through the following steps: globally traversing all files in the image to be detected to find potential configuration files; taking the path of the potential configuration file and the content of the potential configuration file as the input of the large model, and based on a pre-set second prompt word, guiding the large model to determine whether the potential configuration file is a true configuration file and the application to which it belongs; taking the content of the true configuration file and the application to which it belongs as the input of the large model; using retrieval enhancement generation technology, based on a pre-built configuration detection knowledge base and a pre-set third prompt word, guiding the large model to output the vulnerability risks of the true configuration file, wherein the configuration detection knowledge base includes the vulnerability risks of each type of application and the corresponding configuration content.

[0011] Optionally, the dynamic execution analysis module is configured to obtain the dynamic execution analysis result corresponding to the image to be detected through the following steps: reading the metadata of the image to be detected to obtain the image layer execution command; using the image layer execution command as the input of the big model, and based on a pre-set fourth prompt word, guiding the big model to determine whether the image layer execution command is a dynamic execution command and the vulnerability risk it has.

[0012] Optionally, the dependency analysis module is configured to obtain the detection results of the security risks existing in the image to be detected in the upstream and downstream of the supply chain through the following steps: obtaining the layered information of the image to be detected, and marking the image layer with vulnerability risks according to the software analysis results, configuration analysis results and dynamic execution analysis results of the image to be detected; according to the marked image layer with vulnerability risks, tracing back to the upstream of the image to be detected to obtain a complete vulnerability risk introduction chain, and tracing back to the downstream of the image to be detected to determine the impact scope of each vulnerability risk.

[0013] To achieve the above-mentioned purpose, the present invention also provides a multi-dimensional security detection method for a container image supply chain based on a large model, comprising: for each image to be detected in the target container image supply chain, creating a software analysis task, a configuration analysis task, a dynamic execution analysis task and a dependency analysis task for the image to be detected; for each of the images to be detected, according to the software analysis task corresponding to the image to be detected, based on the large model, identifying the software contained in the image to be detected and the vulnerability risks of the software, so as to obtain the software analysis result corresponding to the image to be detected; for each of the images to be detected, according to the configuration analysis task corresponding to the image to be detected, based on the large model, identifying the configuration file in the image to be detected and the vulnerability risks of the configuration file , to obtain the configuration analysis result corresponding to the image to be detected; for each of the images to be detected, according to the dynamic execution analysis task corresponding to the image to be detected, based on the large model, identify the dynamic execution commands in the image to be detected and the vulnerability risks existing in the dynamic execution commands, so as to obtain the dynamic execution analysis result corresponding to the image to be detected; for each of the images to be detected, according to the dependency analysis task corresponding to the image to be detected, based on the software analysis result, configuration analysis result and dynamic execution analysis result corresponding to the image to be detected, obtain the detection result of the security risk existing in the upstream and downstream of the supply chain of the image to be detected; the detection results of all the images to be detected are merged to generate a security detection report of the target container image supply chain.

[0014] Optionally, the identifying of the software contained in the image to be detected and the vulnerability risks of the software based on the large model includes: reading the software information recorded in the software package manager of the image to be detected; globally traversing all files in the image to be detected to find the target file; using the directory where the target file is located and the target file as inputs of the large model; using retrieval enhancement generation technology, based on a pre-built knowledge base and a pre-set first prompt word, to guide the large model to output the software information corresponding to the target file, the knowledge base including the target file name, target file content, and the software name and version number corresponding to the target file path; if the large model cannot successfully output the software information corresponding to the target file, extracting the Feature information corresponding to the target file, and fingerprint information is obtained based on the feature information, the feature information includes architecture, version, ELF header size, file type, number of program header table entries, number of section header table entries, each program segment type, each program segment offset address, each section name, each section type and each section offset address; the fingerprint information is compared with a pre-built software information database to obtain the software information corresponding to the target file, the software information database includes the software name and version corresponding to different fingerprint information; according to the software information, matching is performed in a pre-built vulnerability database to identify the vulnerability risk of the corresponding software, the vulnerability database includes the software name and version number affected by the vulnerability.

[0015] Optionally, the identifying of the configuration file in the image to be detected and the vulnerability risk of the configuration file based on the big model includes: globally traversing all files in the image to be detected to find potential configuration files; taking the path of the potential configuration file and the content of the potential configuration file as input of the big model, and based on a pre-set second prompt word, guiding the big model to determine whether the potential configuration file is a true configuration file and the application to which it belongs; taking the content of the true configuration file and the application to which it belongs as input of the big model; using retrieval enhancement generation technology, based on a pre-built configuration detection knowledge base and a pre-set third prompt word, guiding the big model to output the vulnerability risk of the true configuration file, wherein the configuration detection knowledge base includes the vulnerability risk of each type of application and the corresponding configuration content.

[0016] Optionally, the identifying the dynamic execution commands in the image to be detected and the vulnerability risks existing in the dynamic execution commands based on the big model includes: reading the metadata of the image to be detected to obtain the image layer execution commands; taking the image layer execution commands as input of the big model, and based on a pre-set fourth prompt word, guiding the big model to determine whether the image layer execution commands are dynamic execution commands and the vulnerability risks existing in them.

[0017] Optionally, according to the dependency analysis task corresponding to the image to be detected, based on the software analysis results, configuration analysis results and dynamic execution analysis results corresponding to the image to be detected, the detection results of the security risks of the image to be detected in the upstream and downstream of the supply chain are obtained, including: obtaining the layered information of the image to be detected, and marking the image layer with vulnerability risks according to the software analysis results, configuration analysis results and dynamic execution analysis results of the image to be detected; according to the marked image layer with vulnerability risks, tracing back to the upstream of the image to be detected to obtain a complete vulnerability risk introduction chain, and tracing back to the downstream of the image to be detected to determine the impact scope of each vulnerability risk.

[0018] Compared with the prior art, the multi-dimensional security detection system and method for a container image supply chain based on a large model provided by the present invention has the following beneficial effects: the present invention creates a software analysis task, a configuration analysis task, a dynamic execution analysis task and a dependency analysis task for each image to be detected in the target container image supply chain, and identifies the software contained in the image to be detected and the vulnerability risks of the software based on the large model according to the software analysis task corresponding to the image to be detected; identifies the configuration file in the image to be detected and the vulnerability risks of the configuration file based on the large model according to the configuration analysis task corresponding to the image to be detected; identifies the dynamic execution command in the image to be detected and the vulnerability risks of the dynamic execution command based on the large model according to the dynamic execution analysis task corresponding to the image to be detected; and then obtains the detection result of the security risk of the image to be detected in the upstream and downstream of the supply chain based on the software analysis result, configuration analysis result and dynamic execution analysis result corresponding to the image to be detected according to the dependency analysis task corresponding to the image to be detected, and finally merges the detection results of all the images to be detected to obtain the security detection result of the target container image supply chain. It can be seen that the present invention can not only trace the entire container image supply chain, but also identify supply chain security issues in container images from multiple angles, and then conduct a relatively comprehensive detection of the supply chain of container images, so that vulnerability risk warnings and investigations can be carried out effectively and comprehensively, and while ensuring the effectiveness of the detection, the security detection of container images in the supply chain can be completed efficiently and comprehensively. In addition, the present invention can greatly reduce missed reports by using a large model to participate in the entire detection process. In addition, the present invention does not need to run a container instance, and has high detection efficiency and low resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a structural block diagram of a large model-based multi-dimensional security detection system for a container image supply chain provided in one embodiment of the present invention.

[0020] Figure 2 A flowchart of a multi-dimensional security detection method for a container image supply chain based on a large model provided in one embodiment of the present invention.

[0021] Among them, the figure marks are explained as follows: interaction node-100; user interaction module-110; communication scheduling module-120; security analysis node-200; software analysis module-210; configuration analysis module-220; dynamic execution analysis module-230; dependency analysis module-240. DETAILED DESCRIPTION

[0022] The following is a multi-dimensional security detection system and method for the container image supply chain based on a large model proposed by the present invention in combination with the accompanying drawings and specific implementation methods. According to the following description, the advantages and features of the present invention will be clearer. It should be noted that the structure, proportion, size, etc. illustrated in the drawings of this specification are only used to match the content disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the limiting conditions for the implementation of the present invention. Any modification of the structure, change in the proportional relationship or adjustment of the size, under the condition that the effect that the present invention can produce and the purpose that can be achieved are the same or similar, should still fall within the scope of the technical content disclosed by the present invention.

[0023] The core idea of ​​the present invention is to provide a large-model-based multi-dimensional security detection system and method for the container image supply chain, which can trace the entire container image supply chain, thereby effectively and comprehensively conducting vulnerability risk warning and investigation.

[0024] To realize the above idea, the present invention provides a multi-dimensional security detection system for container image supply chain based on a large model. Figure 1 , which is a structural block diagram of a multi-dimensional security detection system for a container image supply chain based on a large model provided by an embodiment of the present invention. Figure 1As shown, the multi-dimensional security detection system for container image supply chain based on large model provided by the present invention includes an interactive node 100 and at least one security analysis node 200, and the security analysis node 200 is communicatively connected with the interactive node 100; the interactive node 100 is configured to create a software analysis task, a configuration analysis task, a dynamic execution analysis task and a dependency analysis task for each image to be detected in the target container image supply chain; the security analysis node 200 includes a software analysis module 210, a configuration analysis module 220, a dynamic execution analysis module 230 and a dependency analysis module 240; the software analysis module 210 is configured to identify the software contained in the image to be detected and the vulnerability risk of the software based on the large model according to the software analysis task corresponding to the image to be detected, so as to obtain the software analysis result corresponding to the image to be detected; the configuration analysis module 220 is configured to identify the software contained in the image to be detected and the vulnerability risk of the software based on the large model according to the software analysis task corresponding to the image to be detected The configuration analysis task is to identify the configuration file in the image to be detected and the vulnerability risk of the configuration file based on the large model to obtain the configuration analysis result corresponding to the image to be detected; the dynamic execution analysis module 230 is configured to identify the dynamic execution command in the image to be detected and the vulnerability risk of the dynamic execution command based on the large model for each image to be detected according to the dynamic execution analysis task corresponding to the image to be detected, so as to obtain the dynamic execution analysis result corresponding to the image to be detected; the dependency analysis module 240 is configured to obtain the detection result of the security risk of the image to be detected in the upstream and downstream of the supply chain according to the software analysis result, configuration analysis result and dynamic execution analysis result corresponding to the image to be detected for each image to be detected according to the dependency analysis task corresponding to the image to be detected; the interactive node 100 is also configured to merge the detection results of all the images to be detected to generate a security detection report for the target container image supply chain.

[0025] It can be seen that the multi-dimensional security detection system for the container image supply chain based on a large model provided by the present invention can not only trace the entire container image supply chain, but also identify the supply chain security issues existing in the container image from multiple angles, and then can conduct a relatively comprehensive detection of the container image supply chain, so that vulnerability risk warning and investigation can be carried out effectively and comprehensively, and while ensuring the effectiveness of the detection, the security detection of the container image in the supply chain can be completed efficiently and comprehensively. In addition, the present invention can greatly reduce missed reports by using a large model to participate in the entire detection process. In addition, the present invention does not need to run a container instance, and has high detection efficiency and low resource consumption.

[0026] It should be noted that the present invention does not limit the specific type of the large model, and the large model can be, but is not limited to, Llama, Gemma, qwen, phi, qwq, deepseek, etc. It should also be noted that the present invention does not limit the specific number of the security analysis nodes 200, and the number of the security analysis nodes 200 can be one, two, three, four or more. Among them, preferably, the number of the security analysis nodes 200 can be multiple, thereby enabling parallel detection, thereby effectively improving the detection efficiency. It should also be noted that the interactive node 100 and the security analysis node 200 can exchange data through a message channel to complete collaborative work. In addition, it should be noted that each of the interactive nodes 100 and the security analysis node 200 can either run independently on a host or share a host with other nodes. At the same time, it should be noted that the task scheduling and data communication between nodes in the multi-dimensional security detection system for the container image supply chain based on the large model provided by the present invention can be implemented using a distributed task scheduling framework, preferably, the Gearman distributed task scheduling framework is used.

[0027] Furthermore, the security detection report of the target container image supply chain may be displayed in the form of a visual diagram.

[0028] Please continue to refer to Figure 1 ,like Figure 1 As shown, the interactive node 100 includes a user interaction module 110 and a communication scheduling module 120, and the user interaction module 110 is configured to receive user input and return a security detection report of the target container image supply chain. The communication scheduling module 120 is configured to create a container image supply chain security detection task according to the user input, and split the container image supply chain security detection task into a software analysis task, a configuration analysis task, a dynamic execution analysis task, and a dependency analysis task, and receive the detection results of the security risks of each image to be detected in the upstream and downstream of the supply chain, and merge the detection results of all images to be detected and send them to the user interaction module 110.

[0029] Further, after receiving the name or ID of the image to be detected input by the user, the user interaction module 110 first determines whether the image to be detected exists locally, and if not, downloads the image to be detected from the remote image library. The image information of the downloaded image to be detected includes image metadata, layered image data, image name, image size, etc. After obtaining the image information, the image information is transmitted to the communication scheduling module 120.

[0030] The communication scheduling module 120 sends software analysis tasks, configuration analysis tasks, dynamic execution analysis tasks, and dependency analysis tasks to the security analysis node 200 according to the image information of the image to be detected.

[0031] In some exemplary embodiments, the software analysis module 210 is configured to obtain the software analysis result corresponding to the image to be detected through the following steps: reading the software information recorded in the software package manager of the image to be detected; globally traversing all files in the image to be detected to find the target file; using the directory where the target file is located and the target file as input to the large model; using the retrieval-augmented generation (RAG) technology, based on a pre-built knowledge base and a pre-set first prompt word, to guide the large model to output the software information corresponding to the target file, the knowledge base including the target file name, target file content, and the software name and version number corresponding to the target file path; if the large model cannot be formed If the software information corresponding to the target file is successfully output, the feature information corresponding to the target file is extracted, and fingerprint information is obtained based on the feature information, wherein the feature information includes architecture, version, ELF header size, file type, number of program header table entries, number of section header table entries, type of each program segment, offset address of each program segment, name of each section, type of each section and offset address of each section; the fingerprint information is compared with a pre-constructed software information database to obtain the software information corresponding to the target file, wherein the software information database includes software names and versions corresponding to different fingerprint information; and according to the software information, a match is performed in a pre-constructed vulnerability database to identify vulnerability risks existing in the corresponding software, wherein the vulnerability database includes software names and version numbers affected by the vulnerability.

[0032] Therefore, through the above process, not only can the software information contained in the image to be detected be obtained more comprehensively, but also, by using the large model, the manpower for identifying the software information can be saved, and the recognition efficiency and the utilization rate of the software information data can be effectively improved.

[0033] Specifically, after receiving the software analysis task of the image to be detected, the software analysis module 210 reads the software information (installed software information) recorded in the software package manager of the image to be detected, and extracts the directory structure and target file in the image to be detected, and provides the directory where the target file is located and the target file itself as input to the large model, and the large model matches the closest software from the knowledge base to obtain the software information; if the large model cannot successfully return the software information, the feature information of the target file is extracted to obtain the fingerprint information, and the fingerprint information is compared with the software information database to obtain the software information (including software name, version and other information); the software information obtained in multiple ways is merged, and the vulnerabilities existing in the software are matched in the vulnerability database to obtain the relevant vulnerability risks.

[0034] It should be noted that target file is a term in Linux system, which mainly refers to three types of files: relocatable files, executable files, and shared target files. Furthermore, it is possible to determine whether a file is a target file by reading the first four bytes of the file. According to the file format specification, the first four bytes of the target file must be 0x7f.

[0035] The knowledge base refers to a knowledge base constructed based on large-scale data and machine learning algorithms, which provides additional information as a pre-input.

[0036] Furthermore, the software information database can be constructed by the following steps: various versions of software are collected and released from official software suppliers on the Internet, and corresponding software feature values ​​are extracted; for each software, a hash value is calculated based on the feature value of the software as the fingerprint information of the software, and the fingerprint information of the software and the version information of the software are stored in the database as a data pair, thereby constructing a software information database.

[0037] It should be noted that the present invention does not limit the specific content of the first prompt word. For example, the first prompt word may include the following content: You are a professional software identification expert. According to the provided knowledge base data, identify and extract the name and version number of the software. If the information contains multiple software or version numbers, list the name and corresponding version of each software as accurately as possible. Please note the following key points: If the software name and version cannot be identified based on the knowledge base, it can be identified based on other information; the software name is usually a combination of letters and numbers, and may have some symbols, such as version numbers or additional identifiers (for example: v1.2.3, -beta); the version number usually appears in a format separated by numbers and dots (.), and may also have letters or other identifiers (for example: 2.0.1-alpha); ensure to avoid misidentification as much as possible, such as mistaking similar software names for the same software, or mistaking irrelevant information for version numbers; only output the software name and version number, do not output irrelevant information, the specific format is `Software Name (Version Number)`.

[0038] Furthermore, the ELF file format information of the target file can be read by the readelf command, including three parts: ELF header, program header table, and section header table. From it, 11 items of information, including architecture, version, ELF header size, file type, number of program header table entries, number of section header table entries, each program segment type, each program segment offset address, each section name, each section type, and each section offset address, are extracted as the characteristic information of the target file. Among them, the information contained in the ELF header, program header table, and section header table belongs to the file format specification.

[0039] Furthermore, the fingerprint value can be calculated according to the following formula: fp = sha256(Σsha256(fpi)).

[0040] Among them, fp is the fingerprint value, and fpi represents the feature value extracted from the target file.

[0041] Specifically, the extracted 11 feature values, namely, architecture, version, ELF header size, file type, number of program header table entries, number of section header table entries, each program segment type, each program segment offset address, each section name, each section type and each section offset address, can be substituted into the above formula to calculate the fingerprint value of the target file. The software information corresponding to the target file can be obtained by querying the software name, version and other information corresponding to the fingerprint fp recorded in the software information database.

[0042] In some exemplary embodiments, the configuration analysis module 220 is configured to obtain the configuration analysis result corresponding to the image to be detected through the following steps: globally traversing all files in the image to be detected to find potential configuration files; taking the path of the potential configuration file and the content of the potential configuration file as the input of the large model, and based on a pre-set second prompt word, guiding the large model to determine whether the potential configuration file is a true configuration file and the application to which it belongs (the application to which it belongs will only be output when the potential configuration file is determined to be a true configuration file); taking the content of the true configuration file (i.e., the potential configuration file determined to be a true configuration file) and the application to which it belongs as the input of the large model; using retrieval enhancement generation technology, based on a pre-built configuration detection knowledge base and a pre-set third prompt word, guiding the large model to output the vulnerability risk of the true configuration file, the configuration detection knowledge base includes the vulnerability risk of each type of application and the corresponding configuration content (i.e., what configuration content will generate what vulnerability risk).

[0043] Therefore, the present invention can effectively narrow the detection scope of the subsequent large model by first globally traversing all files in the image to be detected to find potential configuration files; by using the large model to further identify the potential configuration files, the fault tolerance rate and detection efficiency can be effectively improved. In addition, by using the large model to identify the configuration file, the present invention does not need to write a large number of regular matching rules, thereby further improving the detection efficiency.

[0044] Specifically, it is possible to determine whether the file may be a configuration file (ie, a potential configuration file) by reading the file suffix. For example, files with suffixes such as .conf, .xml, .yaml, .ini, and .yml are determined to be potential configuration files.

[0045] The path and content of the potential configuration file are used as the input of the large model. By setting a reasonable second prompt word, the large model is guided to determine whether the potential configuration file is indeed a configuration file (i.e., a true configuration file) and the application to which it belongs. If the large model determines that the potential configuration file is not a true configuration file, no subsequent detection will be performed.

[0046] It should be noted that the present invention does not limit the specific content of the third prompt word. For example, the third prompt word may include the following content: You are a security expert. According to the content of the provided configuration file, combined with the configuration of the relevant application and the known configuration detection knowledge base, identify the potential vulnerability risks of the configuration file. Please pay attention to the following requirements during analysis: Check the configuration items in the configuration file that may cause security risks, such as open ports, insecure protocols, unencrypted sensitive data, weak password settings, etc. Check the configuration items in combination with the characteristics and version of the application. Check whether there is improper permission allocation in the configuration file, especially overly wide access control settings or configurations that abuse administrator permissions. List the existing vulnerability risks as comprehensively as possible. Only output vulnerability risks and corresponding configuration items, and do not output irrelevant information. The specific format is `Vulnerability Risk (Configuration Item Information)`.

[0047] In some exemplary embodiments, the dynamic execution analysis module 230 is configured to obtain the dynamic execution analysis result corresponding to the image to be detected through the following steps: reading the metadata of the image to be detected to obtain the image layer execution command; using the image layer execution command as the input of the big model, and based on a pre-set fourth prompt word, guiding the big model to determine whether the image layer execution command is a dynamic execution command and its existing vulnerability risks (only when the image layer execution command is determined to be a dynamic execution command, will its existing vulnerability risks be output).

[0048] Since the execution commands are very complex, it is difficult to completely identify all commands by code matching. However, with the help of a large model, the identifiable dynamic execution content can be greatly improved, and even the results of dynamic execution can be simulated with the help of a large model. Therefore, the present invention can effectively improve the effectiveness and accuracy of detection by guiding the large model to determine whether the image layer execution command is a dynamic execution command and the vulnerability risks it has based on the pre-set fourth prompt word.

[0049] In some exemplary embodiments, the dependency analysis module 240 is configured to obtain the detection results of the security risks of the image to be detected in the upstream and downstream of the supply chain through the following steps: obtaining the layered information of the image to be detected, and marking the image layer with vulnerability risks according to the software analysis results, configuration analysis results and dynamic execution analysis results of the image to be detected; according to the marked image layer with vulnerability risks, tracing back to the upstream of the image to be detected to obtain a complete vulnerability risk introduction chain, and tracing back to the downstream of the image to be detected to determine the impact scope of each vulnerability risk.

[0050] Therefore, through the image layer relationship, after identifying the image layer where the vulnerability risk is located, the spread range of the vulnerability risk and the image that introduces the risk can be quickly found, thereby further improving the effectiveness and accuracy of detection.

[0051] Specifically, the UnionFS structure of the image layer that is unique to the image can be used. That is, different combinations of image layers result in different images. The upstream and downstream images of the image to be detected can be traced back to determine the upstream and downstream images of the image to be detected.

[0052] Based on the same inventive concept, the present invention also provides a multi-dimensional security detection method for container image supply chain based on a large model, please refer to Figure 2 , which is a flow chart of a multi-dimensional security detection method for a container image supply chain based on a large model provided by an embodiment of the present invention. Figure 2 As shown, the multi-dimensional security detection method for container image supply chain based on big model provided by the present invention includes: step S100, for each image to be detected in the target container image supply chain, creating a software analysis task, a configuration analysis task, a dynamic execution analysis task and a dependency analysis task for the image to be detected; step S200, for each of the images to be detected, according to the software analysis task corresponding to the image to be detected, based on the big model, identifying the software contained in the image to be detected and the vulnerability risk of the software, so as to obtain the software analysis result corresponding to the image to be detected; step S300, for each of the images to be detected, according to the configuration analysis task corresponding to the image to be detected, based on the big model, identifying the configuration file in the image to be detected and the vulnerability risk of the configuration file, so as to obtain The configuration analysis result corresponding to the image to be detected; step S400, for each of the images to be detected, according to the dynamic execution analysis task corresponding to the image to be detected, identify the dynamic execution commands in the image to be detected and the vulnerability risks of the dynamic execution commands based on the large model to obtain the dynamic execution analysis result corresponding to the image to be detected; step S500, for each of the images to be detected, according to the dependency analysis task corresponding to the image to be detected, based on the software analysis result, configuration analysis result and dynamic execution analysis result corresponding to the image to be detected, obtain the detection result of the security risk of the image to be detected in the upstream and downstream of the supply chain; step S600, merge the detection results of all the images to be detected to generate a security detection report for the target container image supply chain.

[0053] It can be seen that the multi-dimensional security detection method for the container image supply chain based on a large model provided by the present invention can not only trace the entire container image supply chain, but also identify the supply chain security issues existing in the container image from multiple angles, and then conduct a relatively comprehensive detection of the container image supply chain, so that vulnerability risk warning and investigation can be carried out effectively and comprehensively, and while ensuring the effectiveness of the detection, the security detection of the container image in the supply chain can be completed efficiently and comprehensively. In addition, the present invention can greatly reduce missed reports by using a large model to participate in the entire detection process. In addition, the present invention does not need to run a container instance, and has high detection efficiency and low resource consumption.

[0054] It should be noted that although Figure 2 The description is made by taking the sequential execution of step S200, step S300 and step S400 as an example, but as those skilled in the art can understand, the present invention does not limit the specific execution order of step S200, step S300 and step S400, and in some other implementations, step S200, step S300 and step S400 may also be executed in parallel.

[0055] In some exemplary embodiments, the step S200 of identifying the software contained in the image to be detected and the vulnerability risks of the software based on the big model includes: reading the software information recorded in the software package manager of the image to be detected; globally traversing all files in the image to be detected to find the target file; using the directory where the target file is located and the target file as input to the big model; using the retrieval enhancement generation technology, based on a pre-built knowledge base and a pre-set first prompt word, to guide the big model to output the software information corresponding to the target file, the knowledge base including the target file name, target file content, and the software name and version number corresponding to the target file path; if the big model cannot successfully output the software information corresponding to the target file, extracting the feature information corresponding to the target file, and based on Fingerprint information is obtained from the feature information, wherein the feature information includes architecture, version, ELF header size, file type, number of program header table entries, number of section header table entries, each program segment type, each program segment offset address, each section name, each section type and each section offset address; the fingerprint information is compared with a pre-built software information database to obtain software information corresponding to the target file, wherein the software information database includes software names and versions corresponding to different fingerprint information; and according to the software information (including software information recorded in the software package manager, software information output by the large model and software information matched in the software information database), matching is performed in a pre-built vulnerability database to identify vulnerability risks existing in the corresponding software, wherein the vulnerability database includes software names and version numbers affected by the vulnerabilities.

[0056] In some exemplary embodiments, the step S300 of identifying the configuration file in the image to be detected and the vulnerability risk of the configuration file based on the big model includes: globally traversing all files in the image to be detected to find potential configuration files; taking the path of the potential configuration file and the content of the potential configuration file as input to the big model, and based on a pre-set second prompt word, guiding the big model to determine whether the potential configuration file is a true configuration file and the application to which it belongs; taking the content of the true configuration file and the application to which it belongs as input to the big model; using retrieval enhancement generation technology, based on a pre-built configuration detection knowledge base and a pre-set third prompt word, guiding the big model to output the vulnerability risk of the true configuration file, wherein the configuration detection knowledge base includes the vulnerability risk of each type of application and the corresponding configuration content.

[0057] In some exemplary embodiments, the step S400 of identifying the dynamic execution commands in the image to be detected and the vulnerability risks of the dynamic execution commands based on the big model includes: reading the metadata of the image to be detected to obtain the image layer execution commands; taking the image layer execution commands as input of the big model, and guiding the big model to determine whether the image layer execution commands are dynamic execution commands and the vulnerability risks they exist based on a pre-set fourth prompt word.

[0058] In some exemplary embodiments, the step S500 obtains detection results of security risks existing in the image to be detected in the upstream and downstream of the supply chain based on the software analysis results, configuration analysis results and dynamic execution analysis results corresponding to the image to be detected, including: obtaining the layered information of the image to be detected, and marking the image layer with vulnerability risks according to the software analysis results, configuration analysis results and dynamic execution analysis results of the image to be detected; according to the marked image layer with vulnerability risks, tracing back to the upstream of the image to be detected to obtain a complete vulnerability risk introduction chain, and tracing back to the downstream of the image to be detected to determine the impact scope of each vulnerability risk.

[0059] In summary, compared with the prior art, the multi-dimensional security detection system and method for the container image supply chain based on a large model provided by the present invention has the following beneficial effects: the present invention can not only trace the entire container image supply chain, but also identify the supply chain security issues existing in the container image from multiple angles, and then can conduct a relatively comprehensive detection of the supply chain of the container image, so that vulnerability risk warning and investigation can be carried out effectively and comprehensively, and while ensuring the effectiveness of the detection, the security detection of the container image in the supply chain can be completed efficiently and comprehensively. In addition, the present invention can greatly reduce missed reports by using a large model to participate in the entire detection process. In addition, the present invention does not need to run a container instance, and has high detection efficiency and low resource consumption.

[0060] It should be noted that the above description is only a description of the preferred embodiment of the present invention, and is not any limitation to the scope of the present invention. Any changes and modifications made by ordinary technicians in the field of the present invention based on the above disclosure are within the scope of protection of the present invention.

Claims

1. A multi-dimensional security detection system for container image supply chain based on a large model, characterized in that: comprising an interactive node and at least one security analysis node, wherein the security analysis node is communicatively connected with the interactive node; The interactive node is configured to create a software analysis task, a configuration analysis task, a dynamic execution analysis task and a dependency analysis task for each image to be detected in the target container image supply chain; The security analysis node includes a software analysis module, a configuration analysis module, a dynamic execution analysis module and a dependency analysis module; The software analysis module is configured to identify, for each of the images to be detected, the software contained in the image to be detected and the vulnerability risks of the software based on the big model according to the software analysis task corresponding to the image to be detected, so as to obtain the software analysis result corresponding to the image to be detected; The configuration analysis module is configured to identify, for each of the images to be detected, a configuration file in the image to be detected and a vulnerability risk existing in the configuration file based on the large model according to the configuration analysis task corresponding to the image to be detected, so as to obtain a configuration analysis result corresponding to the image to be detected; The dynamic execution analysis module is configured to identify, for each of the images to be detected, the dynamic execution analysis tasks corresponding to the image to be detected, the dynamic execution commands in the image to be detected and the vulnerability risks existing in the dynamic execution commands based on the large model, so as to obtain the dynamic execution analysis results corresponding to the image to be detected; The dependency analysis module is configured to obtain, for each of the images to be detected, a detection result of the security risks existing in the upstream and downstream of the supply chain of the image to be detected according to the dependency analysis task corresponding to the image to be detected and based on the software analysis result, configuration analysis result and dynamic execution analysis result corresponding to the image to be detected; The interactive node is further configured to merge the detection results of all the images to be detected to generate a security detection report for the target container image supply chain.

2. According to the large model-based container image supply chain multi-dimensional security detection system of claim 1, it is characterized in that: The software analysis module is configured to obtain the software analysis result corresponding to the image to be detected through the following steps: Read the software information recorded in the software package manager of the image to be detected; Globally traverse all files in the image to be detected to find the target file; Using the directory where the target file is located and the target file as input of the large model; Using retrieval enhancement generation technology, based on a pre-built knowledge base and a pre-set first prompt word, guiding the large model to output software information corresponding to the target file, the knowledge base including the target file name, target file content, and the software name and version number corresponding to the target file path; If the large model cannot successfully output the software information corresponding to the target file, extract the feature information corresponding to the target file, and obtain fingerprint information based on the feature information, wherein the feature information includes architecture, version, ELF header size, file type, number of program header table entries, number of section header table entries, each program segment type, each program segment offset address, each section name, each section type, and each section offset address; Comparing the fingerprint information with a pre-built software information database to obtain software information corresponding to the target file, wherein the software information database includes software names and versions corresponding to different fingerprint information; According to the software information, a match is performed in a pre-built vulnerability database to identify vulnerability risks existing in the corresponding software, wherein the vulnerability database includes the software name and version number affected by the vulnerability.

3. According to the large model-based container image supply chain multi-dimensional security detection system of claim 1, it is characterized in that: The configuration analysis module is configured to obtain the configuration analysis result corresponding to the image to be detected through the following steps: Globally traverse all files in the image to be detected to find potential configuration files; The path of the potential configuration file and the content of the potential configuration file are used as inputs of the large model, and based on a preset second prompt word, the large model is guided to determine whether the potential configuration file is a true configuration file and the application to which it belongs; Using the content of the true configuration file and the application to which it belongs as input of the large model; Using retrieval enhancement generation technology, based on a pre-built configuration detection knowledge base and a pre-set third prompt word, the large model is guided to output the vulnerability risks existing in the true configuration file. The configuration detection knowledge base includes the vulnerability risks existing in each type of application and the corresponding configuration content.

4. According to the large model-based container image supply chain multi-dimensional security detection system of claim 1, it is characterized in that: The dynamic execution analysis module is configured to obtain the dynamic execution analysis result corresponding to the image to be detected through the following steps: Read the metadata of the image to be detected to obtain the image layer execution command; The image layer execution command is used as the input of the large model, and based on a preset fourth prompt word, the large model is guided to determine whether the image layer execution command is a dynamic execution command and the vulnerability risk it has.

5. According to the large model-based container image supply chain multi-dimensional security detection system of claim 1, it is characterized in that: The dependency analysis module is configured to obtain the detection results of the security risks of the image to be detected in the upstream and downstream of the supply chain through the following steps: Obtaining layer information of the image to be detected, and marking the image layer with vulnerability risks according to the software analysis result, configuration analysis result, and dynamic execution analysis result of the image to be detected; According to the marked image layer with vulnerability risks, trace back to the upstream of the image to be tested to obtain a complete vulnerability risk introduction chain, and trace back to the downstream of the image to be tested to determine the impact scope of each vulnerability risk.

6. A multi-dimensional security detection method for container image supply chain based on a large model, characterized in that: include: For each image to be tested in the target container image supply chain, create a software analysis task, a configuration analysis task, a dynamic execution analysis task, and a dependency analysis task for the image to be tested; For each of the images to be detected, according to the software analysis task corresponding to the image to be detected, the software contained in the image to be detected and the vulnerability risk of the software are identified based on the big model to obtain the software analysis result corresponding to the image to be detected; For each of the images to be detected, according to the configuration analysis task corresponding to the image to be detected, the configuration files in the image to be detected and the vulnerability risks existing in the configuration files are identified based on the large model to obtain the configuration analysis result corresponding to the image to be detected; For each of the images to be detected, according to the dynamic execution analysis task corresponding to the image to be detected, based on the large model, the dynamic execution commands in the image to be detected and the vulnerability risks existing in the dynamic execution commands are identified to obtain the dynamic execution analysis result corresponding to the image to be detected; For each of the images to be detected, according to the dependency analysis task corresponding to the image to be detected, based on the software analysis result, configuration analysis result and dynamic execution analysis result corresponding to the image to be detected, the detection result of the security risk of the image to be detected in the upstream and downstream of the supply chain is obtained; The detection results of all the images to be detected are combined to generate a security detection report for the target container image supply chain.

7. The multi-dimensional security detection method for container image supply chain based on a large model according to claim 6 is characterized in that: The identifying, based on the big model, the software contained in the image to be detected and the vulnerability risks existing in the software includes: Read the software information recorded in the software package manager of the image to be detected; Globally traverse all files in the image to be detected to find the target file; Using the directory where the target file is located and the target file as input of the large model; Using retrieval enhancement generation technology, based on a pre-built knowledge base and a pre-set first prompt word, guiding the large model to output software information corresponding to the target file, the knowledge base including the target file name, target file content, and the software name and version number corresponding to the target file path; If the large model cannot successfully output the software information corresponding to the target file, extract the feature information corresponding to the target file, and obtain fingerprint information based on the feature information, wherein the feature information includes architecture, version, ELF header size, file type, number of program header table entries, number of section header table entries, each program segment type, each program segment offset address, each section name, each section type, and each section offset address; Comparing the fingerprint information with a pre-built software information database to obtain software information corresponding to the target file, wherein the software information database includes software names and versions corresponding to different fingerprint information; According to the software information, a match is performed in a pre-built vulnerability database to identify vulnerability risks existing in the corresponding software, wherein the vulnerability database includes the software name and version number affected by the vulnerability.

8. The multi-dimensional security detection method for container image supply chain based on a large model according to claim 6 is characterized in that: The identifying the configuration file in the image to be detected and the vulnerability risk existing in the configuration file based on the large model includes: Globally traverse all files in the image to be detected to find potential configuration files; The path of the potential configuration file and the content of the potential configuration file are used as inputs of the large model, and based on a preset second prompt word, the large model is guided to determine whether the potential configuration file is a true configuration file and the application to which it belongs; Using the content of the true configuration file and the application to which it belongs as input of the large model; Using retrieval enhancement generation technology, based on a pre-built configuration detection knowledge base and a pre-set third prompt word, the large model is guided to output the vulnerability risks existing in the true configuration file. The configuration detection knowledge base includes the vulnerability risks existing in each type of application and the corresponding configuration content.

9. The multi-dimensional security detection method for container image supply chain based on a large model according to claim 6 is characterized in that: The identifying the dynamic execution command in the image to be detected and the vulnerability risk of the dynamic execution command based on the large model includes: Read the metadata of the image to be detected to obtain the image layer execution command; The image layer execution command is used as the input of the large model, and based on a preset fourth prompt word, the large model is guided to determine whether the image layer execution command is a dynamic execution command and the vulnerability risk it has.

10. The multi-dimensional security detection method for container image supply chain based on a large model according to claim 6 is characterized in that: The step of obtaining the detection result of the security risk of the image to be detected in the upstream and downstream of the supply chain based on the dependency analysis task corresponding to the image to be detected, the software analysis result, the configuration analysis result and the dynamic execution analysis result corresponding to the image to be detected includes: Obtaining layer information of the image to be detected, and marking the image layer with vulnerability risks according to the software analysis result, configuration analysis result, and dynamic execution analysis result of the image to be detected; According to the marked image layer with vulnerability risks, trace back to the upstream of the image to be tested to obtain a complete vulnerability risk introduction chain, and trace back to the downstream of the image to be tested to determine the impact scope of each vulnerability risk.

Images