Security monitoring method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a security monitoring method and system, electronic equipment and a storage medium, and the method comprises the steps: loading a security interception program in a kernel mode, the security interception program is used for monitoring a security event when a container runs in an operation system, and the container is used for creating the container in the operation system when the container runs; updating the preset security policy through the security interception program to obtain a target security policy; monitoring and managing the safety behavior of the container according to the target safety strategy in the user mode; various events during container running can be intercepted and processed by running the safety interception program in the kernel mode, frequent switching between the user mode and the kernel mode or a large amount of data copying operation are not needed, consumption of system resources is low, and the resource utilization rate and the response speed of the container are improved; by dynamically updating and adjusting the preset security policy, the security requirement during container operation can be better met.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security monitoring method, system, electronic equipment and storage medium. Background Art

[0002] Container is a lightweight virtualization technology that can create multiple isolated user spaces within an operating system. Each user space can run one or more applications. It has the advantages of fast startup, low resource usage, and strong portability. It is widely used in cloud computing, microservices, edge computing and other fields. Container runtime refers to the software responsible for creating and managing containers. Therefore, ensuring the security of container runtime on the cloud is the key to ensuring the stable, reliable and secure operation of cloud-native applications.

[0003] Related container runtime security technologies ensure the security of containers during runtime by restricting and monitoring the system in the container through the security module of the Linux (Linux Is Not UniX, a UNIX-like operating system) kernel, intercepting and analyzing system events in the container based on user-mode security agents, or isolating the container from the host machine based on virtual machines. However, these solutions have the problem of affecting the operating performance of the container, reducing the resource utilization and response speed of the container, and failing to meet the security requirements of the container runtime. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a security monitoring method, system, electronic device and storage medium that overcome the above problems or at least partially solve the above problems.

[0005] According to a first aspect of the present invention, a security monitoring method is provided, which is applied to an operating system, wherein the operating system includes: a kernel state and a user state, and the method includes: Loading a security interception program in the kernel state, the security interception program being used to monitor security events of a container runtime in the operating system, the container runtime being used to create a container in the operating system; The preset security policy is updated through the security interception program to obtain the target security policy; The security behavior of the container is monitored and managed in the user state according to the target security policy.

[0006] Optionally, the security event includes: at least one of a system call event, a network communication event, and a file access event; The security interception program is used to monitor security events during container runtime in the operating system, including: The security interception program monitors at least one security event among the system call event, the network communication event and the file access event occurring in the container; When the security event does not conform to the security event business logic, the security event is intercepted and monitoring information corresponding to the security event is recorded.

[0007] Optionally, the preset security policy is set by the following method: After the container runtime is started, obtaining data information of the container; A corresponding preset security policy is generated according to the data information, and the preset security policy is used to restrict the security behavior of the container.

[0008] Optionally, the updating of the preset security policy by the security interception program to obtain the target security policy includes: The security interception program transmits the monitoring information of the security event to the user state; When the monitoring information meets the policy update condition, the preset security policy is updated in the user state according to the monitoring information, and the updated preset security policy is set as the target security policy.

[0009] Optionally, monitoring and managing the security behavior of the container according to the target security policy in the user state includes: monitoring the security behavior of the container; Matching a target security sub-policy corresponding to the security behavior in the target security policy; The container is managed in the user state based on the target security sub-policy.

[0010] Optionally, the security behavior includes at least one of a system call behavior, a file access behavior, and a network communication behavior: The matching of the target security sub-policy corresponding to the security behavior in the target security policy includes: When the security behavior includes the system call behavior, the target security sub-policy corresponding to the system call behavior includes: limiting the processes that can be run in the container; When the security behavior includes the file access behavior, the target security sub-policy corresponding to the file access behavior includes: restricting the user's read and write access rights; When the security behavior includes the network communication behavior, the target security sub-policy corresponding to the network communication behavior includes: restricting the Hypertext Transfer Protocol port and network address in the inbound connection request and the outbound connection request of the container.

[0011] Optionally, the method further comprises: After the container stops running, uninstalling the security interception program; Clean up monitoring information obtained by the security interception program in the kernel state monitoring security events during the container runtime in the operating system.

[0012] According to a second aspect of the present invention, there is provided a security monitoring system, which is applied to an operating system, wherein the operating system includes: a kernel state and a user state, and the system includes: A security interception program loading module: used to load a security interception program in the kernel state, wherein the security interception program is used to monitor security events during the container runtime in the operating system, and the container runtime is used to create a container in the operating system; Target security policy generation module: used to update the preset security policy through the security interception program to obtain the target security policy; Container management module: used to monitor and manage the security behavior of the container according to the target security policy in the user state.

[0013] According to the third aspect of the present invention, there is provided an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; the memory is used to store computer programs; and the processor is used to implement the steps of the above-mentioned security monitoring method when executing the program stored in the memory.

[0014] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned security monitoring method are implemented.

[0015] The embodiments of the present invention include the following advantages: In an embodiment of the present invention, a security interception program is loaded in kernel state, the security interception program is used to monitor security events during container runtime in the operating system, and the container runtime is used to create containers in the operating system; the preset security policy is updated by the security interception program to obtain a target security policy; the security behavior of the container is monitored and managed in user state according to the target security policy; by running the security interception program in kernel state, various events during container runtime can be intercepted and processed, without frequent switching between user state and kernel state or a large number of data copy operations, and the consumption of system resources is relatively low; by dynamically updating and adjusting the security policy to better adapt to the security requirements of the container.

[0016] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 is a flow chart of steps of an embodiment of a security monitoring method of the present invention; Figure 2 is a structural block diagram of an embodiment of a security monitoring system of the present invention; Figure 3 is a schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention; Figure 4 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0020] The terms "first", "second", etc. in the specification and claims of the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0021] In conjunction with the accompanying drawings, a security monitoring method, system, electronic device and storage medium provided by an embodiment of the present invention are described in detail through specific embodiments and their application scenarios.

[0022] Container is a lightweight virtualization technology that can create multiple isolated user spaces within an operating system. Each user space can run one or more applications. It has the advantages of fast startup, low resource usage, and strong portability. It is widely used in cloud computing, microservices, edge computing and other fields. Container runtime refers to the software responsible for creating and managing containers, such as Docker (a container runtime developed by Docker, which later evolved into a more general container platform), containerd (an open source container runtime), CRI-O (a lightweight container runtime designed specifically for Kubernetes), etc. The container runtime needs to ensure the security of the container, that is, to prevent malicious programs in the container from damaging the system or other containers outside the container. Therefore, ensuring the security of the container runtime on the cloud is the key to ensuring the stable, reliable and secure operation of cloud-native applications.

[0023] At present, common container runtime security technologies include the following: Linux kernel-based security modules, such as SELinux (Security-Enhanced Linux), AppArmor (a Linux security module), and Seccomp (Secure Computing), restrict and monitor system calls, file access, and network communications within the container.

[0024] User-state-based security agents, such as Falco (an open source, cloud-native runtime security tool) and Sysdig (an open source system monitoring and troubleshooting tool), detect abnormal behavior of containers by intercepting and analyzing system events within containers.

[0025] Security isolation based on virtual machines, such as Kata Containers, which uses a lightweight virtual machine (VM) to run each container to achieve strong isolation. gVisor implements a sandbox kernel (Sentry) in user space to intercept and process system calls in the container to provide isolation. It creates a lightweight virtual machine outside the container and runs the container in the virtual machine, thereby isolating the container from the host machine.

[0026] However, whether it is a kernel-based security module, a user-state security agent, or a virtual machine-based security isolation, it will have a certain impact on the operating performance of the container, reduce the resource utilization and response speed of the container, and have a large performance overhead. In addition, the kernel-based security module requires detailed security policy configuration for each container, which is a tedious and error-prone task for the dynamic and diverse nature of containers. The user-state-based security agent and the virtual machine-based security isolation also need to adapt and adjust the container's operating environment, which increases the difficulty of container deployment and management and has a complex configuration problem. Secondly, the kernel-based security module is usually static and is not easy to dynamically update and adjust according to the changes in the container. The user-state-based security agent and the virtual machine-based security isolation also have their inherent limitations and cannot cover all security requirements when the container is running, and there is a problem of difficulty in expansion.

[0027] Reference Figure 1 , shows a flow chart of steps of an embodiment of a security monitoring method of the present invention, which may specifically include the following steps: Step 101, loading a security interception program in the kernel state, wherein the security interception program is used to monitor security events during a container runtime in the operating system, and the container runtime is used to create a container in the operating system; In practical applications, the security monitoring method is applied to the operating system, which includes at least user state and kernel state. The user state cannot directly use system resources, cannot change the working state of the CPU, and can only access the user program's own storage space; while the kernel state can use all the computer's hardware resources.

[0028] In this embodiment, the security interception program includes at least an eBPF (extended Berkeley Packet Filter) program. eBPF originates from the Linux kernel and can run sandbox programs in a privileged context (such as an operating system kernel). It is used to safely and effectively extend the functionality of the kernel without changing the kernel source code or loading kernel modules.

[0029] Specifically, before the container runtime is started, a set of eBPF programs are loaded into the kernel to intercept and process various events during the container runtime. Since the eBPF program runs in kernel state and is mounted to the corresponding kernel detection point (such as kprobe, tracepoint, etc.) in a lightweight manner, it can obtain various types of events occurring in the container in real time and in depth, without the need for frequent switching between user state and kernel state or large amounts of data copying operations, and the consumption of system resources is relatively low. Step 102, updating the preset security policy through the security interception program to obtain a target security policy; During the container runtime, the changes in the container can be monitored through the eBPF program, and the preset security policies and eBPF programs can be dynamically updated and adjusted according to the changes in the container to adapt to the security requirements of the container.

[0030] In actual applications, when the application in the container is processing a large amount of data, the eBPF program will monitor the file read and write performance and memory usage, and then optimize the preset security policy according to custom rules (such as recording when the memory usage exceeds a certain threshold, etc.) to reduce performance overhead.

[0031] Step 103: monitor and manage the security behavior of the container according to the target security policy in the user state.

[0032] In this embodiment, the preset security policy and eBPF program are dynamically updated and adjusted according to the changes in the container to obtain the target security policy, and the container is monitored and managed based on the security behavior of the container by matching the corresponding policy in the target security policy, wherein the security behavior of the container includes at least: system call behavior, file access behavior, and network communication behavior.

[0033] Specifically, different security behaviors are matched to different specific policies in the target security policy. For system call behavior, specific policies related to executable processes in the container can be matched; for file access behavior, specific policies related to read and write access permissions can be matched; for network communication behavior, specific policies related to inbound connection requests and outbound connection requests can be matched.

[0034] Through the security monitoring method provided by the embodiment of the present invention, a security interception program is loaded in the kernel state, the security interception program is used to monitor security events during the container runtime in the operating system, and the container runtime is used to create a container in the operating system; the preset security policy is updated by the security interception program to obtain a target security policy; the security behavior of the container is monitored and managed in the user state according to the target security policy; by running the security interception program in the kernel state, various events during the container runtime can be intercepted and processed, without frequent switching between the user state and the kernel state or a large number of data copy operations, the consumption of system resources is low, and the resource utilization and response speed of the container are improved; by dynamically updating and adjusting the preset security policy, the security requirements of the container runtime can be better met.

[0035] In one embodiment of the present invention, the security event includes: at least one of a system call event, a network communication event, and a file access event; The security interception program is used to monitor security events during container runtime in the operating system, including: The security interception program monitors at least one security event among the system call event, the network communication event and the file access event occurring in the container; When the security event does not conform to the security event business logic, the security event is intercepted and monitoring information corresponding to the security event is recorded.

[0036] Since the eBPF program runs in kernel state, it is mounted to the corresponding kernel detection point in a lightweight manner, and can obtain various types of security events occurring in the container in real time and in depth, such as system call events, network communication events, file access events, etc.

[0037] Suppose the container is attacked from the outside and the hacker attempts to exploit a vulnerability in the container to escalate privileges or steal data. The eBPF program monitors the process and detects system call events that do not conform to normal business logic. This abnormal behavior can be discovered in a timely manner, allowing the security team to respond quickly and prevent serious consequences such as data leakage.

[0038] In actual applications, system call events that do not conform to normal business logic include at least: the process attempts to access or modify sensitive files, the process establishes unexpected network connections, the process maps or modifies memory protection attributes, or creates a large number of child processes, etc. Specifically, a database that does not conform to normal business logic can be pre-set. When the eBPF program monitors security events that do not conform to normal business logic in the database, the security event is intercepted and the monitoring information corresponding to the security event is recorded.

[0039] In one embodiment of the present invention, the preset security policy is set by the following method: After the container runtime is started, obtaining data information of the container; A corresponding preset security policy is generated according to the data information, and the preset security policy is used to restrict the security behavior of the container.

[0040] After the container runtime is started, the data information of the container can be obtained, which includes at least the container type, label, metadata and other information. Then, based on the container type, label, metadata and other information, a set of corresponding security policies is generated for each container, that is, the preset security policy, which is used to specify the allowed and prohibited scope of security behaviors occurring in the container.

[0041] In the embodiment of the present invention, by generating a set of corresponding security policies for each container based on the container type, label, metadata and other information, the security, management efficiency and compliance of the container environment can be significantly improved. Customized security policies can better adapt to the specific needs of the container, reduce false positives and false negatives, and enhance the observability and portability of the container.

[0042] In an embodiment of the present invention, the updating of the preset security policy by the security interception program to obtain the target security policy includes: The security interception program transmits the monitoring information of the security event to the user state; When the monitoring information meets the policy update condition, the preset security policy is updated in the user state according to the monitoring information, and the updated preset security policy is set as the target security policy.

[0043] Specifically, when the eBPF program monitors that the process has executed a security event that does not conform to normal business logic, the monitoring information of the security event is transmitted to the security monitoring module in the user state. The preset security policy can be updated in the user state according to the monitoring information, and the updated preset security policy can be set as the target security policy, thereby ensuring the security of the container runtime according to the target security policy.

[0044] When switching between user state and kernel state, it is necessary to retain the user state scene (context, registers, user stack, etc.), copy user state parameters, switch the user stack to the kernel stack, enter the kernel state, perform additional checks (because the kernel code does not trust the user), execute the kernel state code, copy the kernel state code execution results, return to the user state, restore the user state scene (context, registers, user stack, etc.), and other operations. The consumption of system resources is very high. By transmitting the monitoring information of security events to the security monitoring module in user state, there is no need for frequent switching between user state and kernel state or large-scale data copying operations, which greatly reduces the performance overhead of the system. In addition, during the operation of the container runtime, the preset security policy and eBPF program can be dynamically updated and adjusted according to the changes in the container to adapt to the security requirements of the container.

[0045] In an embodiment of the present invention, monitoring and managing the security behavior of the container according to the target security policy in the user state includes: monitoring the security behavior of the container; Matching a target security sub-policy corresponding to the security behavior in the target security policy; The container is managed in the user state based on the target security sub-policy.

[0046] In an embodiment of the present invention, the eBPF program can monitor the security behavior of the container. Since the monitored information is transmitted to the user state of the operating system through the eBPF program, the target security sub-policy corresponding to the security behavior can be matched in the target security policy in the user state based on the security behavior. Finally, the container is managed according to the target security sub-policy package to ensure the security requirements of the container during runtime.

[0047] In one embodiment of the present invention, the security behavior includes at least one of a system call behavior, a file access behavior, and a network communication behavior: The matching of the target security sub-policy corresponding to the security behavior in the target security policy includes: When the security behavior includes the system call behavior, the target security sub-policy corresponding to the system call behavior includes: limiting the processes that can be run in the container; When the security behavior includes the file access behavior, the target security sub-policy corresponding to the file access behavior includes: restricting the user's read and write access rights; When the security behavior includes the network communication behavior, the target security sub-policy corresponding to the network communication behavior includes: restricting the Hypertext Transfer Protocol port and network address in the inbound connection request and the outbound connection request of the container.

[0048] In this embodiment, the security behaviors in the container after the container runtime is started include at least: system call behaviors, file access behaviors, and network communication behaviors; When system calls occur, the processes that can be run in the container are restricted; when file access occurs, the user's read and write access rights are restricted; when network communication occurs, the HTTP (Hypertext Transfer Protocol) ports and network addresses in the container's inbound and outbound connection requests are restricted.

[0049] In actual applications, for Web service containers, the corresponding target security policies include at least: 1. When a system call occurs, limit the processes that can be run in the container. Only processes related to Web services (such as Apache, Nginx and other server processes and their dependent auxiliary processes) are allowed to be started. It is forbidden to start irrelevant processes such as mining programs and malicious scripts. The seccomp (secure computing mode) mechanism can be used to define a whitelist of allowed system calls to achieve this. 2. When file access occurs, configure the permissions of the configuration files and log files related to the Web server in the container to ensure that only the user running the Web service (such as the www-data user) has read, write and execute permissions, and other users have only read permissions. For the code files of the Web application, set them to read-only mode to prevent malicious tampering. You can specify the corresponding permissions in the container startup configuration; 3. When network communication occurs, only ports 80 (HTTP) and 443 (HTTPS) are allowed to be exposed to the outside world, and only inbound connection requests from specific trusted network segments (such as the company's internal office network segment) are accepted. For outbound connection requests, access to non-business-related external network addresses is restricted, and only connections to legitimate back-end database server addresses and necessary third-party API addresses are allowed. This can be achieved through firewall rules or network policies.

[0050] Developers can customize monitoring rules, preset security policies, and updated target security policies that meet actual needs based on the specific type of container, business scenario, and security requirements to adapt to the security needs of the container.

[0051] In one embodiment of the present invention, the method further comprises: After the container stops running, uninstalling the security interception program; Clean up monitoring information obtained by the security interception program in the kernel state monitoring security events during the container runtime in the operating system.

[0052] In this embodiment, after the container stops running, the eBPF program in the kernel is uninstalled and the monitoring information transmitted to the user state through the eBPF program is cleaned up to reduce unnecessary resource waste.

[0053] Through the security monitoring method provided by the embodiment of the present invention, a security interception program is loaded in the kernel state, the security interception program is used to monitor security events during the container runtime in the operating system, and the container runtime is used to create a container in the operating system; the preset security policy is updated by the security interception program to obtain a target security policy; the security behavior of the container is monitored and managed in the user state according to the target security policy; by running the security interception program in the kernel state, various events during the container runtime can be intercepted and processed, without frequent switching between the user state and the kernel state or a large number of data copy operations, the consumption of system resources is low, and the resource utilization and response speed of the container are improved; by dynamically updating and adjusting the preset security policy, the security requirements of the container runtime can be better met.

[0054] Reference Figure 2 , shows a structural block diagram of an embodiment of a security monitoring system of the present application, which may specifically include the following modules: A security interception program loading module 201, used to load a security interception program in the kernel state, the security interception program is used to monitor security events during the container runtime in the operating system, and the container runtime is used to create a container in the operating system; A target security policy generating module 202 is used to update the preset security policy through the security interception program to obtain a target security policy; The container management module 203 is used to monitor and manage the security behavior of the container according to the target security policy in the user state.

[0055] In an embodiment of the present application, the security monitoring system provided by the embodiment of the present application loads a security interception program in the kernel state, the security interception program is used to monitor security events during the container runtime in the operating system, and the container runtime is used to create a container in the operating system; the preset security policy is updated by the security interception program to obtain a target security policy; the security behavior of the container is monitored and managed in the user state according to the target security policy; by running the security interception program in the kernel state, various events during the container runtime can be intercepted and processed, without frequent switching between user state and kernel state or large amounts of data copying operations, with low consumption of system resources, thereby improving resource utilization and response speed of the container; by dynamically updating and adjusting the preset security policy, the security requirements of the container runtime can be better met.

[0056] As for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0057] In addition, refer to Figure 3 An embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned security monitoring method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0058] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned security monitoring method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0059] An embodiment of the present invention also provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned security monitoring method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0060] Figure 3 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0061] The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, a processor 810, and a power supply 811. Those skilled in the art will appreciate that Figure 3 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0062] It should be understood that in the embodiment of the present invention, the radio frequency unit 601 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 610 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 601 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 601 can also communicate with the network and other devices through a wireless communication system.

[0063] The electronic device provides users with wireless broadband Internet access through the network module 602, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0064] The audio output unit 603 can convert the audio data received by the RF unit 601 or the network module 602 or stored in the memory 609 into an audio signal and output it as sound. Moreover, the audio output unit 603 can also provide audio output related to a specific function performed by the electronic device 600 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 603 includes a speaker, a buzzer, a receiver, etc.

[0065] The input unit 604 is used to receive audio or video signals. The input unit 604 may include a graphics processor (GPU) 6041 and a microphone 6042. The graphics processor 6041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 606. The image frame processed by the graphics processor 6041 can be stored in the memory 609 (or other storage medium) or sent via the radio frequency unit 601 or the network module 602. The microphone 6042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 601 in the case of a telephone call mode.

[0066] The electronic device 600 also includes at least one sensor 605, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 6061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 6061 and / or the backlight when the electronic device 600 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 605 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0067] The display unit 606 is used to display information input by the user or information provided to the user. The display unit 606 may include a display panel 6061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0068] The user input unit 607 can be used to receive input digital or character information, and generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 607 includes a touch panel 6071 and other input devices 6072. The touch panel 6071, also known as a touch screen, can collect user touch operations on or near it (such as operations performed by users using fingers, styluses, or any other suitable objects or accessories on or near the touch panel 6071). The touch panel 6071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact point coordinates, and then sends it to the processor 810, receives the command sent by the processor 610 and executes it. In addition, the touch panel 6071 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch panel 6071, the user input unit 607 may also include other input devices 6072. Specifically, other input devices 6072 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be described in detail here.

[0069] Furthermore, the touch panel 6071 may be overlaid on the display panel 6061. When the touch panel 6071 detects a touch operation on or near it, it is transmitted to the processor 610 to determine the type of touch event. Subsequently, the processor 810 provides corresponding visual output on the display panel 6061 according to the type of touch event. Figure 3 In the figure, the touch panel 6071 and the display panel 6061 are used as two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 6071 and the display panel 6061 can be integrated to realize the input and output functions of the electronic device, which is not limited here.

[0070] The interface unit 608 is an interface for connecting an external device to the electronic device 600. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 608 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 600 or may be used to transmit data between the electronic device 600 and an external device.

[0071] The memory 609 can be used to store software programs and various data. The memory 609 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 609 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0072] The processor 810 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 609 and calling data stored in the memory 609, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 810 may include one or more processing units; preferably, the processor 610 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 610.

[0073] The electronic device 600 may also include a power supply 611 (such as a battery) for supplying power to various components. Preferably, the power supply 611 may be logically connected to the processor 610 via a power management system, thereby managing functions such as charging, discharging, and power consumption through the power management system.

[0074] In addition, the electronic device 600 includes some functional modules not shown, which will not be described in detail here.

[0075] like Figure 4 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 701 is also provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the security monitoring method described in the above embodiment.

[0076] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0077] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0078] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0079] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0080] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0081] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0082] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0083] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0084] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, ROM, RAM, disk or optical disk, etc., various media that can store program codes.

[0085] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A security monitoring method, characterized in that: Applied to an operating system, the operating system includes: a kernel state and a user state, the method includes: Loading a security interception program in the kernel state, the security interception program being used to monitor security events of a container runtime in the operating system, the container runtime being used to create a container in the operating system; The preset security policy is updated through the security interception program to obtain the target security policy; The security behavior of the container is monitored and managed in the user state according to the target security policy.

2. The method according to claim 1, characterized in that The security events include: at least one of system call events, network communication events, and file access events; The security interception program is used to monitor security events during container runtime in the operating system, including: The security interception program monitors at least one security event among the system call event, the network communication event and the file access event occurring in the container; When the security event does not conform to the security event business logic, the security event is intercepted and monitoring information corresponding to the security event is recorded.

3. The method according to claim 1, characterized in that The preset security policy is set by the following method: After the container runtime is started, obtaining data information of the container; A corresponding preset security policy is generated according to the data information, and the preset security policy is used to restrict the security behavior of the container.

4. The method according to claim 1, characterized in that: The updating of the preset security policy by the security interception program to obtain the target security policy includes: The security interception program transmits the monitoring information of the security event to the user state; When the monitoring information meets the policy update condition, the preset security policy is updated in the user state according to the monitoring information, and the updated preset security policy is set as the target security policy.

5. The method according to claim 1, characterized in that The monitoring and managing the security behavior of the container according to the target security policy in the user state includes: monitoring the security behavior of the container; Matching a target security sub-policy corresponding to the security behavior in the target security policy; The container is managed in the user state based on the target security sub-policy.

6. The method according to claim 3, characterized in that: The security behavior includes at least one of a system call behavior, a file access behavior, and a network communication behavior: The matching of the target security sub-policy corresponding to the security behavior in the target security policy includes: When the security behavior includes the system call behavior, the target security sub-policy corresponding to the system call behavior includes: limiting the processes that can be run in the container; When the security behavior includes the file access behavior, the target security sub-policy corresponding to the file access behavior includes: restricting the user's read and write access rights; When the security behavior includes the network communication behavior, the target security sub-policy corresponding to the network communication behavior includes: restricting the Hypertext Transfer Protocol port and network address in the inbound connection request and the outbound connection request of the container.

7. The method according to claim 1, characterized in that The method further comprises: After the container stops running, uninstalling the security interception program; Clean up monitoring information obtained by the security interception program in the kernel state monitoring security events during the container runtime in the operating system.

8. A security monitoring system, characterized in that: Applied to an operating system, the operating system includes: a kernel state and a user state, the system includes: A security interception program loading module: used to load a security interception program in the kernel state, wherein the security interception program is used to monitor security events during the container runtime in the operating system, and the container runtime is used to create a container in the operating system; Target security policy generation module: used to update the preset security policy through the security interception program to obtain the target security policy; Container management module: used to monitor and manage the security behavior of the container according to the target security policy in the user state.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images