Container cluster threat detection method and system, storage medium and cloud platform

Abstract

The invention provides a threat detection method and system for a container cluster, a storage medium and a cloud platform, and the system comprises an agent end; the agent end is used for acquiring a flow acquisition strategy and a threat detection rule, acquiring network card flow of a service container according to the flow acquisition strategy, and performing threat detection according to the threat detection rule and the network card flow, so that a cloud native flow local acquisition and local detection mode is realized, the flow does not need to be sent out, and the flow detection efficiency is improved. A large amount of bandwidth resources of the host are saved, and the threat detection system can dynamically expand and shrink the capacity along with the change of the service, so that the threat detection performance is dynamically, elastically and flexibly adapted to the cloud native.

Description

Technical Field

[0001] The present application relates to the field of computer security, and more specifically, to a threat detection method, system, storage medium, and cloud platform for a container cluster. Background Art

[0002] In traditional environments, traffic is generally mirrored to NDS (network threat detection device) and other detection devices for threat detection by using physical switch port mirroring. In cloud-native environments, traffic collection clients are deployed to directly collect container network card traffic, and the collected traffic is sent to NDS for threat detection through GRE (generic routing protocol encapsulation) or VXLAN (virtual extended local area network) tunnels. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a threat detection method, system, storage medium and cloud platform for a container cluster, so as to realize local collection and detection of cloud native traffic and save bandwidth resources.

[0004] In a first aspect, an embodiment of the present application provides a threat detection system for a container cluster, wherein the system is deployed in a cloud platform where the container cluster is located, wherein the container cluster includes at least one business container, and wherein the system includes an agent; the agent is used to obtain a traffic collection strategy and a threat detection rule, and collect the network card traffic of the business container according to the traffic collection strategy, and perform threat detection according to the threat detection rule and the network card traffic.

[0005] The above-mentioned threat detection system is deployed in the cloud platform where the container cluster is located, realizing local collection and local detection of cloud native traffic. The traffic does not need to be sent externally, saving a lot of bandwidth resources of the host. At the same time, the threat detection system can dynamically expand and shrink as the business changes, realizing the flexible adaptation of threat detection performance to the dynamic elasticity of cloud native.

[0006] In an optional embodiment, the traffic collection strategy includes a container search sub-strategy, which is used to indicate the target business container whose network card traffic needs to be collected; the proxy end is also used to search for the target business container based on the container search sub-strategy in the traffic collection strategy, and collect the network card traffic of the target business container.

[0007] In the above embodiment, the target service container is acquired according to the traffic collection strategy, and traffic collection is performed on the service container, so that targeted traffic collection can be achieved and the targeted threat detection can be improved.

[0008] In an optional embodiment, the proxy end is also used to monitor changes in each business container in the container cluster in real time, and when the target business container in the container cluster changes, re-search the target business container according to the container search sub-strategy in the traffic collection strategy.

[0009] In the above embodiment, the proxy can monitor the changes of the container in real time, re-search the target container according to the container changes, update the target container, and obtain the traffic of the changed target container in time, thereby improving the threat detection capability of the system.

[0010] In an optional embodiment, the system also includes a control end, which is used to control the traffic collection strategy and update and maintain the threat detection rules; the control end is also used to send the traffic collection strategy and the threat detection rules to the agent end.

[0011] In the above embodiment, the agent end and the control end are respectively set up, and the control end manages the agent end, which can expand the detection capability of the threat detection system. Both the server end and the agent end can dynamically expand and shrink as the business changes, realizing the flexible adaptation of threat detection capabilities to cloud native dynamic elasticity.

[0012] In an optional embodiment, the control end is further used to obtain container information of all business containers in the container cluster through an interface of the container cluster, and group the business containers of the container cluster according to the container information of all business containers to obtain multiple container groups; and is also used to receive selection instructions for the multiple container groups, the selection instructions being used to indicate the container group selected by the user and / or the business container in the container group, and generate the traffic collection strategy according to the container information of the business container corresponding to the selection instruction.

[0013] In the above embodiment, a flow collection strategy can be generated according to user selection, and the user can simply and conveniently implement control of flow collection, thereby achieving targeted flow collection.

[0014] In an optional embodiment, the proxy end includes a first container and a second container, wherein the first container is used to obtain the traffic collection strategy and the threat detection rule, mirror the network card traffic of the business container to the mirror network card of the second container according to the traffic collection strategy, and send the threat detection rule to the second container; the second container is used to receive the threat detection rule, and monitor the mirror network card to obtain the network card traffic, collect the network card traffic according to the traffic collection strategy, and perform threat detection based on the threat detection rule and the network card traffic.

[0015] In the above embodiment, the control end is divided into a first container and a second container to respectively perform different functions, thereby reducing the probability of failure and enhancing the robustness and management capability of the control end.

[0016] In an optional embodiment, the traffic collection strategy includes a container search sub-strategy, which is used to indicate a target business container whose network card traffic needs to be collected; the first container is also used to search for the target business container based on the container search sub-strategy in the traffic collection strategy, and mirror the network card traffic of the target business container to the mirror network card of the second container.

[0017] In the above embodiment, the target service container is acquired according to the traffic collection strategy, and traffic collection is performed on the service container, so that targeted traffic collection can be achieved and the targeted threat detection can be improved.

[0018] In an optional embodiment, the first container is further used to monitor changes in each business container in the container cluster in real time, and when the target business container in the container cluster changes, the target business container is searched again according to the container search sub-strategy in the traffic collection strategy.

[0019] In the above embodiment, the proxy can monitor the changes of the container in real time, re-search the target container according to the container changes, update the target container, and obtain the traffic of the changed target container in time, thereby improving the threat detection capability of the system.

[0020] In the second aspect, an embodiment of the present application provides a threat detection method for a container cluster, the method is applied to an agent end, the agent end is deployed on a cloud platform to which the container cluster belongs, the container cluster includes at least one container, the method includes: obtaining a traffic collection strategy and a threat detection rule; collecting the network card traffic of the business container according to the traffic collection strategy; and performing threat detection according to the threat detection rule and the network card traffic. In the third aspect, an embodiment of the present application provides a cloud platform, including: a system as described in any one of the first aspects.

[0021] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program instructions are deployed by a computer, a system as described in any one of the first aspects is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A schematic block diagram of a threat detection system for a container cluster provided in an embodiment of the present application;

[0024] Figure 2 A flowchart of a threat detection system for a container cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0026] In the existing technology, in a cloud-native environment, the traffic of the container network card is directly collected by deploying a traffic collection client, and the collected traffic is sent to the NDS (network threat detection device) for threat detection through a GRE (generic routing protocol encapsulation) or VXLAN (virtual extended local area network) tunnel.

[0027] However, in a cloud-native environment, business east-west traffic is much larger than north-south traffic. For example, the traffic collected by deploying a traffic collection client to collect container network card traffic and the traffic sent to NDS through GRE or VXLAN tunnels are all east-west traffic. If all of these east-west traffic is sent out, a large amount of host bandwidth will be occupied, affecting business stability. If not all of them are sent out, only part of the traffic can be selected for collection and outbound transmission based on the business. However, partial collection and outbound transmission of traffic will lead to incomplete threat detection. At the same time, external NDS devices cannot dynamically expand or shrink with the scale of business containers, resulting in the inability of NDS device detection performance to adapt to the elastic and flexible changes in cloud-native environment business.

[0028] Figure 1 A threat detection system 100 for a container cluster is provided in an embodiment of the present application. The system 100 is deployed in a cloud platform where a container cluster is located. The container cluster includes at least one business container. The system includes an agent 110;

[0029] A cloud platform is a computing resource and service provision platform built based on cloud computing technology. A cloud platform may include one or more computers and various services running on the computers.

[0030] A container cluster is running on the cloud platform of the embodiment of the present application. The container cluster is also called a container orchestration cluster, which is a collection for managing and deploying containerized applications. For example, a K8s cluster is a container cluster. Each container cluster should include at least one container. Container is a lightweight virtualization technology that can encapsulate applications and their dependencies in an independent environment, thereby achieving more efficient deployment and portability. In this application, the container belonging to the container cluster on the cloud platform is called a business container to distinguish it from other containers on the cloud platform.

[0031] In this application, the threat detection system 100 is also deployed on the cloud platform to detect full-flow threats of the container cluster.

[0032] The threat detection system includes an agent 110, which obtains a traffic collection strategy and a threat detection rule. The traffic collection strategy is used to indicate which traffic needs to be collected, for example, the traffic collection strategy can indicate which containers are to be collected, and / or which traffic of the container needs to be collected. The threat detection rule is used to indicate under what circumstances it is necessary to output threat alarm information.

[0033] In one embodiment of the present application, the system further includes a control terminal 120, which is used to control the traffic collection strategy and also to update and maintain the threat detection rule;

[0034] The control end is also used to send the traffic collection strategy and the threat detection rule to the proxy end.

[0035] The control terminal 120 is a control plane responsible for controlling the traffic collection strategy and updating and maintaining the threat detection rules. The control terminal 120 is also used to send the traffic collection strategy and the threat detection rules to the proxy terminal 110.

[0036] The agent end can be managed through the control end. For example, the control end can manage multiple agent ends, each agent end is responsible for multiple containers, so that the detection of the entire container cluster can be realized. However, using only a single agent end cannot manage a large number of nodes. Alternatively, different traffic collection strategies and threat detection rules can be sent to different agent ends to realize targeted detection.

[0037] In the above embodiment, the agent end and the control end are respectively set up, and the control end manages the agent end, which can expand the detection capability of the threat detection system. Both the server end and the agent end can dynamically expand and shrink as the business changes, realizing the flexible adaptation of threat detection capabilities to cloud native dynamic elasticity.

[0038] In one embodiment of the present application, the control end is further used to obtain container information of all business containers in the container cluster through the interface of the container cluster, and group the business containers of the container cluster according to the container information of all business containers to obtain multiple container groups; and, further used to receive a selection instruction for the multiple container groups, the selection instruction is used to indicate the container group selected by the user and / or the business container in the container group, and generate the traffic collection strategy according to the container information of the business container corresponding to the selection instruction.

[0039] The control end can be deployed in a cloud-native manner through Deployment. The replica containers deployed by Deployment will be distributed on each node. Each node may run one or more replicas. A node refers to a virtual machine or physical machine responsible for executing request tasks assigned by the control plane of the cluster. In this way, the performance of the control end can be dynamically expanded or reduced as the business changes.

[0040] The control end obtains the container information of all business containers in the cluster through the cluster interface such as API (application programming interface). The container information is used to describe the relevant information of the container. For example, the container information can be which container set the container belongs to. The container set refers to a container group deployed on a single node and containing one or more containers. The business containers of the container cluster cloud platform are grouped according to the container information to obtain multiple container groups. For example, all containers are grouped according to container groups according to the container information, and containers belonging to the same container group are grouped together to obtain multiple container groups.

[0041] The user can set the flow collection strategy by container grouping. For example, the user makes a selection and generates a selection instruction. The selection instruction can be a selection of container grouping. The user can select all container groups or select some groups for flow collection.

[0042] The selection instruction may also be a selection of a service container within the container group. The selection instruction may also simultaneously indicate the container group selected by the user and the containers within the container group. For example, the user may select container groups A and B and select a portion of containers in container group C.

[0043] The control end receives a selection instruction for the plurality of container groups, and generates the traffic collection strategy according to the container information of the service container corresponding to the selection instruction. For example, when the user selects container groups A and B, a traffic collection strategy is generated according to the container information of the container in container group A: the container belongs to container set A, and the container information of the container in container group B: the container belongs to container set B, to collect the traffic of the containers in container sets A and B.

[0044] Furthermore, the selection instruction includes filter selection information, and the filter information is used to indicate what conditions are used to filter the traffic, such as filtering based on conditions such as IP quintuples.

[0045] In another example of the present application, the control end obtains cloud native assets through the cluster interface, and the cloud native assets include clusters, applications, containers, nodes, images, etc. The control end automatically groups the cloud native assets, and the user sets the traffic collection strategy through the asset grouping. You can choose to collect the traffic of all assets, or select some assets for traffic collection, and filter according to conditions such as IP quintuples.

[0046] In the above embodiment, a flow collection strategy can be generated according to user selection, and the user can simply and conveniently implement control of flow collection, thereby achieving targeted flow collection.

[0047] The agent 110 collects the network card traffic of the business container in the container cluster according to the traffic collection strategy, and performs threat detection according to the threat detection rules and the network card traffic. Compared with the control end, the agent 110 is responsible for receiving the traffic collection strategy and updating the threat detection rules, and outputting the threat detection alarm. The threat detection alarm supports external transmission in the form of kafka or syslog.

[0048] In one embodiment of the present application, the method includes: the traffic collection strategy includes a container search sub-strategy, and the container search sub-strategy is used to indicate the target business container whose network card traffic needs to be collected; the proxy end is also used to search for the target business container according to the container search sub-strategy in the traffic collection strategy, and collect the network card traffic of the target business container.

[0049] The proxy terminal 110 receives a traffic collection strategy, which includes a container search sub-strategy. The container search sub-strategy is used to indicate the target business container whose network card traffic needs to be collected, such as the above-mentioned traffic collection strategy: collecting the traffic of the container concentrated by A and B containers, wherein collecting the traffic of the container concentrated by A and B containers is a container search sub-strategy, which indicates that the business container concentrated by A and B containers is the target business container.

[0050] The proxy terminal 110 searches for the target service container in the container cluster according to the container search sub-strategy in the traffic collection strategy, and collects the traffic of the target service container.

[0051] In the above embodiment, the target service container is acquired according to the traffic collection strategy, and traffic collection is performed on the service container, so that targeted traffic collection can be achieved and the targeted threat detection can be improved.

[0052] In one embodiment of the present application, the proxy end is also used to monitor changes in each business container in the container cluster in real time, and when the target business container in the container cluster changes, the target business container is searched again according to the container search sub-strategy in the traffic collection strategy.

[0053] The proxy 110 will also monitor the changes of each business container in the container cluster in real time. The changes of business containers can be various, such as the increase or decrease of business containers in the cluster, and the addition or withdrawal of a business container in a container set.

[0054] When the target service container in the cloud platform changes, such as adding a service container to the B container set, the agent discovers this change through the cluster interface and re-collects the traffic of containers in the A and B container sets according to the container search sub-strategy in the traffic collection strategy to find the target service container. For example, the agent can use the container search sub-strategy to find the newly added service container in the B container set and directly use the added service container in the B container set as the target service container.

[0055] In the above embodiment, the proxy can monitor the changes of the container in real time, re-search the target container according to the container changes, update the target container, and obtain the traffic of the changed target container in time, thereby improving the threat detection capability of the system.

[0056] In one implementation of the present application, the proxy end includes a first container and a second container, wherein the first container is used to obtain the traffic collection strategy and the threat detection rule, mirror the network card traffic of the business container to the mirror network card of the second container according to the traffic collection strategy, and send the threat detection rule to the second container; the second container is used to receive the threat detection rule, and monitor the mirror network card to obtain the network card traffic, collect the network card traffic according to the traffic collection strategy, and perform threat detection based on the threat detection rule and the network card traffic.

[0057] The proxy is deployed in a cloud-native manner using DaemonSet. DaemonSet deploys a container on each node that meets the matching conditions to ensure that a copy of the container runs on all (or some) nodes. The proxy can be horizontally expanded along with the k8snode node, and the second container in the proxy can dynamically sense the node traffic size to achieve vertical expansion of resources such as CPU and memory.

[0058] For example, the agent container can be set as the first container, the dp container can be set as the second container, and the agent and dp containers can form the proxy end.

[0059] The agent container is responsible for receiving commands from the control end 120 and obtaining a traffic collection strategy. According to the traffic collection strategy, the network card traffic of the business container is mirrored to the mirror network card of the second container. The agent container obtains threat detection rules through the control end 120 and sends the threat detection rules to the second container.

[0060] The dp container obtains the image traffic of the business container by listening to its own image network card, performs threat detection, and outputs threat alarm information. The alarm information can be sent out through kafka or syslog.

[0061] The dp container also communicates with the agent container regularly to dynamically update the alarm rules.

[0062] Implementing the proxy end through the first container and the second container can separate traffic acquisition and detection, thereby increasing the robustness of traffic detection. At the same time, based on this architecture, the first container can manage the second container. For example, when the second container fails, the first container can restart the second container, increasing the management capability of the system.

[0063] In the above embodiment, the control end is divided into a first container and a second container to respectively perform different functions, thereby reducing the probability of failure and enhancing the robustness and management capability of the control end.

[0064] In one embodiment of the present application, the traffic collection strategy includes a container search sub-strategy, and the container search sub-strategy is used to indicate the target business container for which the network card traffic needs to be collected; the first container is also used to search for the target business container according to the container search sub-strategy in the traffic collection strategy, and mirror the network card traffic of the target business container to the mirror network card of the second container.

[0065] The traffic collection strategy includes a container search sub-strategy, which is used to indicate the target business container for which the network card traffic needs to be collected. After the agent container receives the traffic collection strategy, it searches for the target business container according to the container search sub-strategy in the traffic collection strategy to bind the collection strategy to the business container. Mirror the network card traffic of the target business container to the mirror network card of the dp container

[0066] In another example of the present application, the agent container obtains the traffic collection policy, binds the collection policy and the container assets, collects traffic, and filters according to conditions such as the IP quintuple.

[0067] In the above embodiment, the target service container is acquired according to the traffic collection strategy, and traffic collection is performed on the service container, so that targeted traffic collection can be achieved and the targeted threat detection can be improved.

[0068] In one embodiment of the present application, the first container is also used to monitor changes in each business container in the container cluster in real time, and when the target business container in the container cluster changes, the target business container is searched again according to the container search sub-strategy in the traffic collection strategy.

[0069] The agent container obtains the container information of the container cluster through the interface of the container cluster, and monitors the changes of the business containers in the container cluster in real time through the container information. When the target business container in the container cluster changes, it searches for the target business container again according to the container search sub-strategy.

[0070] In an example of the present application, the agent container monitors changes in container assets in real time, and dynamically adjusts the binding relationship between the collection strategy and the container assets according to the changes in the container assets.

[0071] In the above embodiment, the proxy can monitor the changes of the container in real time, re-search the target container according to the container changes, update the target container, and obtain the traffic of the changed target container in time, thereby improving the threat detection capability of the system.

[0072] The above-mentioned threat detection system is deployed in the cloud platform where the container cluster is located, realizing local collection and local detection of cloud native traffic. The traffic does not need to be sent externally, saving a lot of bandwidth resources of the host. At the same time, the threat detection system can dynamically expand and shrink as the business changes, realizing the flexible adaptation of threat detection performance to the dynamic elasticity of cloud native.

[0073] Figure 2 A threat detection method for a container cluster is provided in an embodiment of the present application. The method is applied to an agent end, and the agent end is deployed on a cloud platform to which a container cluster belongs. The container cluster includes at least one container, such as Figure 2 As shown, the method includes:

[0074] Step 210, obtaining traffic collection strategies and threat detection rules.

[0075] Step 220: Collect the network card traffic of the service container according to the traffic collection strategy.

[0076] Step 230: Perform threat detection according to the threat detection rule and the network card traffic.

[0077] A cloud platform provided in an embodiment of the present application includes: a threat detection system for a container cluster as in any of the above embodiments.

[0078] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program instructions are deployed by a computer, a threat detection system for a container cluster as in any of the above embodiments is implemented.

[0079] In the embodiments provided in this application, the embodiments can be combined with each other to form new embodiments without conflict.

[0080] In the embodiments provided in this application, a plurality refers to two or more.

[0081] In the embodiments provided in the present application, it should be understood that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0082] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0083] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A threat detection system for a container cluster, characterized in that: The system is deployed in a cloud platform where a container cluster is located, the container cluster includes at least one business container, and the system includes an agent; The proxy end is used to obtain a traffic collection strategy and a threat detection rule, collect the network card traffic of the business container according to the traffic collection strategy, and perform threat detection according to the threat detection rule and the network card traffic.

2. The system according to claim 1, characterized in that The traffic collection strategy includes a container search sub-strategy, and the container search sub-strategy is used to indicate a target service container for which network card traffic needs to be collected; The proxy end is further used to search for a target business container according to the container search sub-strategy in the traffic collection strategy, and collect the network card traffic of the target business container.

3. The system according to claim 2, characterized in that The proxy end is also used to monitor the changes of each business container in the container cluster in real time, and when the target business container in the container cluster changes, the target business container is searched again according to the container search sub-strategy in the traffic collection strategy.

4. The system according to claim 1, characterized in that The system further includes a control terminal, which is used to control the traffic collection strategy and update and maintain the threat detection rules; The control end is also used to send the traffic collection strategy and the threat detection rule to the proxy end.

5. The system according to claim 4, characterized in that The control terminal is also used for: Acquire container information of all service containers in the container cluster through an interface of the container cluster, and group the service containers of the container cluster according to the container information of all service containers to obtain multiple container groups; And, it is also used to receive a selection instruction for the multiple container groups, the selection instruction is used to indicate the container group selected by the user and / or the business container in the container group, and generate the traffic collection strategy according to the container information of the business container corresponding to the selection instruction.

6. The system according to any one of claims 1 to 5, characterized in that: The proxy terminal includes a first container and a second container, wherein: The first container is used to obtain the traffic collection strategy and the threat detection rule, mirror the network card traffic of the business container to the mirror network card of the second container according to the traffic collection strategy, and also to send the threat detection rule to the second container; The second container is used to receive the threat detection rule, and is also used to monitor the mirror network card to obtain the network card traffic, collect the network card traffic according to the traffic collection strategy, and perform threat detection according to the threat detection rule and the network card traffic.

7. The system according to claim 6, characterized in that The traffic collection strategy includes a container search sub-strategy, and the container search sub-strategy is used to indicate a target service container for collecting network card traffic; The first container is further used to search for a target business container according to the container search sub-strategy in the traffic collection strategy, and mirror the network card traffic of the target business container to the mirror network card of the second container.

8. The system according to claim 6, characterized in that The first container is also used to monitor changes in each business container in the container cluster in real time, and when the target business container in the container cluster changes, the target business container is searched again according to the container search sub-strategy in the traffic collection strategy.

9. A threat detection method for a container cluster, characterized in that: The method is applied to an agent end, the agent end is deployed on a cloud platform to which a container cluster belongs, the container cluster includes at least one business container, and the method includes: Obtain traffic collection strategies and threat detection rules; Collecting the network card traffic of the service container according to the traffic collection strategy; Threat detection is performed according to the threat detection rule and the network card traffic.

10. A cloud platform, characterized in that: include: A system as claimed in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program instructions are deployed by a computer, the system according to any one of claims 1 to 8 is implemented.

Images