Container safety protection method and device, medium and electronic equipment

Abstract

The invention provides a container safety protection method and device, a medium and electronic equipment, and relates to the technical field of information safety. The method comprises the steps of obtaining a container name of a target container and a preset application program white list; the application program white list comprises function auxiliary application programs selected by the user and corresponding to the function type containers; determining a to-be-statically analyzed program of the target container according to the application program white list and a preset similarity calculation rule; performing static analysis on the program to be subjected to static analysis to obtain a system call set of the program to be subjected to static analysis; and controlling the system call of the target container based on the system call set. According to the method, the safety of the container can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology, and in particular to a container security protection method, device, medium and electronic device. Background Art

[0002] At present, with the widespread application of cloud-native architecture, container technology has become the core means of modern application deployment due to its advantages such as lightweight, fast deployment and efficient resource utilization. As the basic component of containerized deployment, container image determines the operating environment and software dependencies of the container. In the context of microservices and lightweight, containers, as a core capability, are usually implemented to achieve a specific single function, such as nginx providing traffic load balancing and proxy, and mysql providing data persistence storage.

[0003] However, many existing container images contain a large number of applications and tools, which not only increases the complexity of the system, but also greatly expands the potential attack surface. System calls are an interface provided by the operating system that allows applications to interact with the operating system core (kernel). Currently, the number of system calls supported by the Linux kernel exceeds 300. System calls have invisibly increased the attack surface of containers, allowing attackers to use system calls as an entry point to invade, endangering the security of the system and making the security of containers low during runtime. It is of great significance to provide a method to improve the security of containers. Summary of the invention

[0004] The present application provides a container security protection method, apparatus and device, which can control the system calls of the target container based on a system call set obtained according to an application whitelist and preset similarity calculation rules, thereby improving the security of the container.

[0005] In a first aspect, an embodiment of the present application provides a container security protection method, the method comprising:

[0006] Obtaining a container name of a target container and a preset application whitelist; the application whitelist includes function-assisted applications corresponding to containers of various function types selected by a user;

[0007] Determining the program to be statically analyzed of the target container according to the application whitelist and a preset similarity calculation rule;

[0008] Performing static analysis on the program to be statically analyzed to obtain a system call set of the program to be statically analyzed;

[0009] Based on the system call set, the system call of the target container is controlled.

[0010] A second aspect of the present application provides a container safety protection device, the device comprising:

[0011] A basic information capture module, used to obtain the container name of the target container and a preset application whitelist; the application whitelist includes function-assisted applications corresponding to each function type container selected by the user;

[0012] A target program determination module, used to determine the program to be statically analyzed of the target container according to the application whitelist and a preset similarity calculation rule;

[0013] A call set determination module, used for performing static analysis on the program to be statically analyzed to obtain a system call set of the program to be statically analyzed;

[0014] The system call control module is used to control the system call of the target container based on the system call set.

[0015] In an optional embodiment, the target program determination module is specifically used to:

[0016] The characters of the container name and the currently selected program name are intersected to obtain a first character set; and the characters of the container name and the currently selected program name are unioned to obtain a second character set;

[0017] Obtaining a first similarity between the container name and a currently selected program name according to the first character set and the second character set;

[0018] Determine a second similarity between the container name and the currently selected program name based on the Jaro-WinklerS algorithm;

[0019] The character similarity between the container name and the currently selected program name is obtained according to the first similarity and the second similarity.

[0020] In an optional embodiment, the target program determination module is specifically used to:

[0021] Obtaining the number of characters included in the first character set as a first number; and obtaining the number of characters included in the second character set as a second number;

[0022] The first number and the second number are divided to obtain a first similarity between the container name and the currently selected program name.

[0023] In an optional embodiment, the target program determination module is specifically used to:

[0024] The first similarity and the second similarity are summed to obtain the character similarity between the container name and the currently selected program name.

[0025] In an optional embodiment, the target program determination module is specifically used to:

[0026] According to the container name and the currently selected program name, the number of matching characters, the number of transpositions, the first string length, and the second string length of the container name and the currently selected program name are obtained; the first string length is the string length of the container name; the second string length is the string length of the currently selected program name;

[0027] Obtaining a third similarity according to the number of matching characters, the number of transpositions, the length of the first character string, and the length of the second character string;

[0028] A second similarity between the container name and the currently selected program name is obtained according to the third similarity, the common prefix length and a preset common prefix weight; the common prefix length is a length characteristic value of a common prefix at the beginning of a character string of the container name and a character string of the currently selected program name.

[0029] According to a third aspect provided by an embodiment of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0030] According to a fourth aspect provided by an embodiment of the present application, an electronic device is provided, comprising a processor and a memory, wherein the memory stores a computer program executable on the processor, and when the computer program is executed by the processor, the method described in the first aspect is implemented.

[0031] In the above-mentioned embodiment of the present application, the container name of the target container and the preset application whitelist are obtained; the application whitelist includes the function-assisted applications corresponding to each function type container selected by the user; the program to be statically analyzed of the target container is determined according to the application whitelist and the preset similarity calculation rules; the program to be statically analyzed is statically analyzed to obtain the system call set of the program to be statically analyzed; based on the system call set, the system call of the target container is controlled. Therefore, in this embodiment, the system call of the target container can be controlled based on the system call set obtained according to the application whitelist and the preset similarity calculation rules, and a restriction mechanism for system calls during container operation is provided. By combining the container name and the application whitelist to accurately determine the program to be statically analyzed, the system calls that are not used by the container during actual operation can be reduced, the attack surface of the container can be reduced, and the security of the container can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0033] Figure 1 A schematic diagram of a process flow of a container safety protection method provided in an embodiment of the present application;

[0034] Figure 2 A schematic diagram of a process for determining a target container to be statically analyzed program in a container security protection method provided in an embodiment of the present application;

[0035] Figure 3 A schematic diagram of a flow chart of determining the character similarity between a container name and a currently selected program name in a container security protection method provided in an embodiment of the present application;

[0036] Figure 4 A schematic diagram of a flow chart of obtaining a first similarity between a container name and a currently selected program name in a container security protection method provided in an embodiment of the present application;

[0037] Figure 5 A schematic diagram of a flow chart of obtaining a second similarity between a container name and a currently selected program name in a container security protection method provided in an embodiment of the present application;

[0038] Figure 6 A schematic diagram of the structure of a container safety protection device provided in an embodiment of the present application;

[0039] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0041] It should be noted that the terms "including" and "having" and their variations involved in the documents of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0042] The following are explanations of some of the terms that appear in the text:

[0043] (1) Seccomp (Secure Computing Mode): Seccomp is a kernel security mechanism that limits the set of system calls that a Linux process can execute. Seccomp defines a set of rules that allow a process to call only specific system calls. Calls outside this set will be rejected or trigger an exception.

[0044] (2) Container: A container is a lightweight, operating system-level virtualization technology that allows applications and their dependencies to run in a resource-isolated process. All necessary components required to run an application are packaged into a single image, which can be reused. When the image runs, it runs in an independent environment and does not share the host operating system's memory, CPU, or disk with other applications. This ensures that the processes within the container will not affect any processes outside the container.

[0045] (3) BPF (Berkeley Packet Filter): BPF is an efficient mechanism for filtering and processing packets. It is used for filtering network packets. BPF runs user-defined bytecodes through a virtual machine (BPF VM) and can perform filtering operations in kernel space, improving the efficiency of network packet capture.

[0046] At present, with the widespread application of cloud-native architecture, container technology has become the core means of modern application deployment due to its advantages such as lightweight, fast deployment and efficient resource utilization. As the basic component of containerized deployment, container image determines the operating environment and software dependencies of the container. In the context of microservices and lightweight, containers, as a core capability, are usually implemented to achieve a specific single function, such as nginx providing traffic load balancing and proxy, and mysql providing data persistence storage.

[0047] However, many existing container images contain a large number of applications and tools, which not only increases the complexity of the system, but also greatly expands the potential attack surface. System calls are an interface provided by the operating system that allows applications to interact with the operating system core (kernel). Currently, the number of system calls supported by the Linux kernel exceeds 300. System calls have invisibly increased the attack surface of containers, allowing attackers to use system calls as an entry point to invade, endangering the security of the system and making the security of containers low during runtime. It is of great significance to provide a method to improve the security of containers.

[0048] In order to solve the existing technical problems, the embodiment of the present application provides a container security protection method, which obtains the container name of the target container and the preset application whitelist; the application whitelist includes the function auxiliary applications corresponding to each function type container selected by the user; according to the application whitelist and the preset similarity calculation rules, the program to be statically analyzed of the target container is determined; the program to be statically analyzed is statically analyzed to obtain the system call set of the program to be statically analyzed; based on the system call set, the system call of the target container is controlled. Therefore, in this embodiment, the system call of the target container can be controlled based on the system call set obtained according to the application whitelist and the preset similarity calculation rules, thereby improving the security of the container.

[0049] The technical solution provided in the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0050] The present application embodiment provides a container security protection method, such as Figure 1 As shown, the following steps are included:

[0051] Step S101, obtaining the container name of the target container and a preset application whitelist; the application whitelist includes function-assisted applications corresponding to each function type container selected by the user.

[0052] In specific implementation, considering the actual container usage and functional requirements of the container, the embodiment of the present application maintains a whitelist of functional auxiliary applications for different functional type containers. The list specifies a part of the applications that are essential in the container as part of the static analysis.

[0053] Among them, operating system containers, such as Ubuntu, provide a common and clean operating system environment, which is often used by users as a basis to customize their own containers. For this type of container, more applications are selected to be retained. Programming language containers are also often used as basic containers, and users usually use more related applications such as document editing and code debugging. Web service containers often need to process operations such as request response, port management, and configuration management. Database service containers often perform operations such as document deletion or backup, status query, and encryption and decryption.

[0054] In some embodiments of the present application, an application whitelist is preset; the application whitelist includes function-assisted applications corresponding to each function type container selected by the user. Exemplarily, the preset application whitelist is shown in Table 1:

[0055] Table 1: Application whitelist

[0056]

[0057] In an embodiment of the present application, the container name of the target container and the preset application whitelist are first obtained to implement a container security protection process based on the container name of the target container and the preset application whitelist; the application whitelist includes function-assisted applications corresponding to each function type container selected by the user.

[0058] Step S102: determining the program to be statically analyzed in the target container according to the application whitelist and the preset similarity calculation rule.

[0059] In some embodiments of the present application, the application in the container image is matched with the container name of the target container by pattern matching, and for an application that meets a specific threshold, it is identified as a container function-related program; based on the container function-related program, a program to be statically analyzed is obtained.

[0060] In some embodiments of the present application, the application in the container image is matched with the container name of the target container by pattern matching, and for an application that meets a specific threshold, it is identified as a container function-related program; the application in the container image is matched with an application whitelist by pattern matching, and for an application that meets the requirements of falling into the application whitelist, it is identified as a container function-assisted program; based on the container function-related program and the container function-assisted program, a program to be statically analyzed is obtained.

[0061] The method of this embodiment, through pattern matching, efficiently combines the container name and the application whitelist to accurately determine the program to be statically analyzed, which can reduce system calls that are not used in the actual operation of the container, reduce the attack surface of the container, and improve the security of the container.

[0062] In some embodiments of the present application, container function-related programs refer to core programs that are natively associated with the container to meet the needs of container operation. For example, nginx and nginx-debug programs in the nginx container; mysqld and mysqlsh in the mysql container. These programs play an important role in resource configuration and function debugging and are the core applications of the container.

[0063] Exemplarily, the container function-related programs are shown in Table 2:

[0064] Table 2

[0065]

[0066]

[0067] In an optional embodiment, in step S102, the process of determining the target container's program to be statically analyzed according to the application whitelist and the preset similarity calculation rule is as follows: Figure 2 As shown, this is achieved through the following steps:

[0068] Step S201, determining the program name of the application program in the target container according to the container name of the target container.

[0069] In specific implementation, according to the container name of the target container, all the applications in the target container are traversed to obtain the program names of the applications in the target container.

[0070] Step S202, selecting program names one by one, and each time a program name is selected, determining whether the application whitelist includes the currently selected program name.

[0071] In specific implementation, program names are selected one by one, and each time a program name is selected, it is first determined whether the currently selected program name is a program in the whitelist, so as to obtain the function auxiliary application in the application in the target container.

[0072] Step S203: If the result of the determination is "include", the currently selected program name is added to the program to be statically analyzed in the target container.

[0073] In some embodiments of the present application, if it is determined that the currently selected program name is a program in the whitelist, a function-assistant application in an application within a target container is obtained; the function-assistant application in the application within the obtained target container is used as a container function-assistant program; and the container function-assistant program is added to the program to be statically analyzed in the target container.

[0074] Step S204: if the result of the judgment is that the container name is not included, then the character similarity between the container name and the currently selected program name is determined according to a preset similarity calculation rule.

[0075] In an optional embodiment, in step S204, the process of determining the character similarity between the container name and the currently selected program name according to a preset similarity calculation rule is as follows: Figure 3 As shown, this is achieved through the following steps:

[0076] Step S301, finding the intersection of characters of the container name and the currently selected program name to obtain a first character set; and finding the union of characters of the container name and the currently selected program name to obtain a second character set.

[0077] Step S302: Obtain a first similarity between the container name and the currently selected program name according to the first character set and the second character set.

[0078] In an optional embodiment, in step S302, the process of obtaining the first similarity between the container name and the currently selected program name according to the first character set and the second character set is as follows: Figure 4 As shown, this is achieved through the following steps:

[0079] Step S401, obtaining the number of characters included in the first character set as a first number; and obtaining the number of characters included in the second character set as a second number.

[0080] Step S402: Calculate the quotient of the first quantity and the second quantity to obtain a first similarity between the container name and the currently selected program name.

[0081] Step S303: Determine the second similarity between the container name and the currently selected program name based on the Jaro-WinklerS algorithm.

[0082] In an optional embodiment, in step S303, the process of determining the second similarity between the container name and the currently selected program name based on the Jaro-WinklerS algorithm is as follows: Figure 5 As shown, this is achieved through the following steps:

[0083] Step S501, according to the container name and the currently selected program name, obtain the number of matching characters, the number of transpositions, the first string length, and the second string length of the container name and the currently selected program name; the first string length is the string length of the container name; the second string length is the string length of the currently selected program name.

[0084] Step S502: Obtain a third similarity according to the number of matching characters, the number of transpositions, the length of the first character string, and the length of the second character string.

[0085] Step S503, obtaining a second similarity between the container name and the currently selected program name according to the third similarity, the common prefix length and the preset common prefix weight; the common prefix length is the length characteristic value of the common prefix at the beginning of the character string of the container name and the character string of the currently selected program name.

[0086] In the embodiment of the present application, the length feature value represents the length of the common prefix at the beginning of the string; the maximum value of the length feature value is 4; when the length of the common prefix at the beginning of the string is less than or equal to 4, the length feature value is the same as the length of the common prefix at the beginning of the string; when the length of the common prefix at the beginning of the string is greater than 4, the length feature value is 4.

[0087] Step S304: Obtain character similarity between the container name and the currently selected program name according to the first similarity and the second similarity.

[0088] In an optional embodiment, the character similarity between the container name and the currently selected program name is obtained according to the first similarity and the second similarity, specifically: the first similarity and the second similarity are summed as the character similarity between the container name and the currently selected program name.

[0089] In other embodiments, the character similarity between the container name and the currently selected program name is obtained based on the first similarity and the second similarity, specifically: the first similarity and the second similarity are weightedly summed, and the result of the weighted sum is used as the character similarity between the container name and the currently selected program name.

[0090] In some embodiments of the present application, the container name may be a container image name. There is a name similarity between the container name and the program related to the container function.

[0091] In an embodiment of the present application, the container name and the program name are compared for similarity. The higher the similarity, the greater the correlation between the two. Based on this, it is determined whether the program is a container function-related program.

[0092] Exemplarily, some embodiments of the present application combine the following two algorithms to match the program names of the application programs in the target container.

[0093] (a) Jaccard algorithm

[0094] The Jaccard algorithm is an algorithm used to calculate the similarity between two sets. Based on this algorithm, the ratio of the intersection and union between the container name and program name strings is first calculated to measure their similarity. The formula is as follows:

[0095]

[0096] in,

[0097] ImageName, indicating the container name;

[0098] ProgramName, which indicates the program name in the container.

[0099] Taking the mysql container as an example, the similarity between it and mysqlsh and nginx is calculated as follows:

[0100]

[0101]

[0102] The algorithm concludes that the similarity between mysqlsh and myql is 0.71, and the similarity between nginx and mysql is 0.

[0103] The Jaccard algorithm has high accuracy in judging programs with many similar characters in their names.

[0104] (b) Jaro-Winkler algorithm

[0105] The Jaro-Winkler algorithm is an improvement of the Jaro algorithm. It is a string similarity matching algorithm based on edit distance. It is based on the concept of edit distance and takes into account the prefix matching of the string. It gives a higher weight to the characters that match at the beginning, thereby improving the calculation accuracy of string similarity.

[0106] The formula of Jaro algorithm is as follows:

[0107]

[0108] Among them, |s1| and |s2| represent the length of the strings s1 and s2, that is, the container name and program name respectively;

[0109] m, represents the number of matching characters between the two strings;

[0110] t, represents the number of transpositions.

[0111] In the embodiment of the present application, the number of transpositions represents half of the number of matching characters in different orders.

[0112] For example, for the two character strings "kjcde" and "jked", 'k' and 'j' are matching characters; but 'k' and 'j' are represented as "kj..." and "jk..." in the two character strings, that is, the two matching characters 'k' and 'j' are in different orders. Therefore, the number of matching characters in different orders is 2, and the value of the transposition number t is 1.

[0113] Based on jaro, the Jaro-Winkler algorithm further highlights the importance of prefixes. The formula is as follows:

[0114] Similarity winkler =Similarity jaro +lp(1-Similarity jaro ),

[0115] Among them, Similarity jaro , is the similarity between s1 and s2;

[0116] l is the length of the common prefix at the beginning of the string, the maximum is 4;

[0117] p is the common prefix weight, which describes the contribution of the common prefix to the similarity. The larger p is, the greater the weight of the common prefix to the similarity. The maximum common prefix weight does not exceed 0.25, and the default value is 0.1.

[0118] Finally, add the two together to get the final character similarity:

[0119] Similarity=Similarity Jac +Similarity winkler .

[0120] Step S205: if the character similarity is greater than or equal to a preset similarity threshold, the currently selected program name is added to the programs to be statically analyzed in the target container.

[0121] In some embodiments of the present application, the similarity threshold is set to 0.6. If the character similarity exceeds 0.6, the application is considered to be a container function-related program, and the currently selected program name is added to the program to be statically analyzed in the target container.

[0122] The method of the above embodiment is concise in design and is very effective in identifying some container-related applications, especially containers with relatively standardized naming formats of some function-related programs. The method can successfully match more than 90% of the related applications in the container.

[0123] Step S103, static analysis is performed on the program to be statically analyzed to obtain a system call set of the program to be statically analyzed.

[0124] During specific implementation, a system call set of the program to be statically analyzed is extracted through static analysis.

[0125] In some embodiments of the present application, after matching the programs to be statically analyzed that are related to the functions in the container image, static analysis is performed on each program to be statically analyzed to extract the system calls required during its execution.

[0126] There are many ways of static analysis, including: disassembly analysis, using disassembly tools (such as objdump or IDAPro) to parse the application's binary file or its dependent libraries, obtain the executable instruction set, and find out the system calls that may be called under different paths; control flow analysis, combining disassembly and symbolic analysis results, tracing the program's calling path, and determining all possible system call points.

[0127] The details of the static analysis are not described in detail in this application. Through the above static analysis operations, a system call set of each program to be statically analyzed is finally formed.

[0128] Step S104: Control the system call of the target container based on the system call set.

[0129] In specific implementation, the process of controlling the system calls of the target container based on the system call set includes: building a seccomp BPF rule file based on the system call set obtained by static analysis; the seccomp BPF rule file includes a Seccomp BPF restriction policy; the Seccomp BPF restriction policy prohibits all system calls by default, and adds the obtained system call set to the policy in the form of a whitelist to allow the container to call it.

[0130] In the embodiment of the present application, Seccomp and BPF are used in combination to complement each other, so that Seccomp has the function of filtering specified system calls.

[0131] The container security protection method provided in the embodiment of the present application obtains the container name of the target container and the preset application whitelist; the application whitelist includes the function-assisted applications corresponding to each function type container selected by the user; the program to be statically analyzed of the target container is determined according to the application whitelist and the preset similarity calculation rules; the program to be statically analyzed is statically analyzed to obtain the system call set of the program to be statically analyzed; based on the system call set, the system call of the target container is controlled. Therefore, in this embodiment, the system call of the target container can be controlled based on the system call set obtained according to the application whitelist and the preset similarity calculation rules, and a restriction mechanism for system calls during container operation is provided, which can reduce the system calls that are not used by the container during actual operation, reduce the attack surface of the container, and improve the security of the container.

[0132] and Figure 1 The container safety protection method shown is based on the same inventive concept, and a container safety protection device is also provided in the embodiment of the present application. Since the device is a device corresponding to the container safety protection method of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated.

[0133] Figure 6 A schematic diagram of the structure of a container safety protection device provided in an embodiment of the present application is shown. Figure 6 As shown, the container security protection device includes a basic information capture module 601, a target program determination module 602, a call set determination module 603 and a system call control module 604.

[0134] The basic information capture module 601 is used to obtain the container name of the target container and a preset application whitelist; the application whitelist includes function-assisted applications corresponding to each function type container selected by the user;

[0135] A target program determination module 602 is used to determine the program to be statically analyzed in the target container according to the application whitelist and a preset similarity calculation rule;

[0136] A call set determination module 603 is used to perform static analysis on the program to be statically analyzed to obtain a system call set of the program to be statically analyzed;

[0137] The system call control module 604 is used to control the system calls of the target container based on the system call set.

[0138] In an optional embodiment, the target program determination module 602 is specifically configured to:

[0139] Determine the program name of the application program in the target container according to the container name of the target container;

[0140] Select program names one by one, and for each selected program name, determine whether the currently selected program name is included in the application whitelist;

[0141] If the result of the judgment is included, the currently selected program name is added to the programs to be statically analyzed in the target container;

[0142] If the result of the judgment is not included, then according to the preset similarity calculation rule, the character similarity between the container name and the currently selected program name is determined;

[0143] If the character similarity is greater than or equal to a preset similarity threshold, the currently selected program name is added to the programs to be statically analyzed in the target container.

[0144] In an optional embodiment, the target program determination module 602 is specifically configured to:

[0145] The characters of the container name and the currently selected program name are intersected to obtain a first character set; and the characters of the container name and the currently selected program name are unioned to obtain a second character set;

[0146] Obtaining a first similarity between the container name and the currently selected program name according to the first character set and the second character set;

[0147] Based on the Jaro-WinklerS algorithm, determine the second similarity between the container name and the currently selected program name;

[0148] The character similarity between the container name and the currently selected program name is obtained according to the first similarity and the second similarity.

[0149] In an optional embodiment, the target program determination module 602 is specifically configured to:

[0150] Obtaining the number of characters included in the first character set as a first number; and obtaining the number of characters included in the second character set as a second number;

[0151] The first number and the second number are divided to obtain a first similarity between the container name and the currently selected program name.

[0152] In an optional embodiment, the target program determination module 602 is specifically configured to:

[0153] The first similarity and the second similarity are summed to obtain the character similarity between the container name and the currently selected program name.

[0154] In an optional embodiment, the target program determination module 602 is specifically configured to:

[0155] According to the container name and the currently selected program name, the number of matching characters, the number of transpositions, the first string length, and the second string length of the container name and the currently selected program name are obtained; the first string length is the string length of the container name; the second string length is the string length of the currently selected program name;

[0156] Obtain a third similarity based on the number of matching characters, the number of transpositions, the length of the first character string, and the length of the second character string;

[0157] The second similarity between the container name and the currently selected program name is obtained according to the third similarity, the common prefix length and the preset common prefix weight; the common prefix length is the length characteristic value of the common prefix at the beginning of the string of the container name and the string of the currently selected program name.

[0158] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. The electronic device can be used for container security protection. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. In this embodiment, the structure of the electronic device can be as follows: Figure 7 As shown, it includes a memory 701 , a communication module 703 and one or more processors 702 .

[0159] The memory 701 is used to store computer programs executed by the processor 702. The memory 701 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0160] The memory 701 may be a volatile memory, such as a random-access memory (RAM); the memory 701 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 701 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 701 may be a combination of the above memories.

[0161] The processor 702 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 702 is used to implement the above container security protection method when calling the computer program stored in the memory 701.

[0162] The communication module 703 is used to communicate with terminal devices and other servers.

[0163] The specific connection medium between the memory 701, the communication module 703 and the processor 702 is not limited in the embodiment of the present application. Figure 7 In the embodiment, the memory 701 and the processor 702 are connected via a bus 704. The bus 704 is connected to the processor 702 via a bus 704. Figure 7 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. Bus 704 can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0164] According to one aspect of the present application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions so that the computer device performs the container safety protection method in the above embodiment. The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0165] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A container safety protection method, characterized in that: The method comprises: Obtaining a container name of a target container and a preset application whitelist; the application whitelist includes function-assisted applications corresponding to containers of various function types selected by a user; Determining the program to be statically analyzed of the target container according to the application whitelist and a preset similarity calculation rule; Performing static analysis on the program to be statically analyzed to obtain a system call set of the program to be statically analyzed; Based on the system call set, the system call of the target container is controlled.

2. The method according to claim 1, characterized in that: The step of determining the program to be statically analyzed of the target container according to the application whitelist and a preset similarity calculation rule includes: Determining a program name of an application program in the target container according to the container name of the target container; Selecting program names one by one, and for each selected program name, determining whether the application whitelist includes the currently selected program name; If the result of the judgment is inclusion, then the currently selected program name is added to the programs to be statically analyzed in the target container; If the result of the judgment is not included, determining the character similarity between the container name and the currently selected program name according to a preset similarity calculation rule; If the character similarity is greater than or equal to a preset similarity threshold, the currently selected program name is added to the programs to be statically analyzed in the target container.

3. The method according to claim 2, characterized in that The determining, according to a preset similarity calculation rule, the character similarity between the container name and the currently selected program name includes: The characters of the container name and the currently selected program name are intersected to obtain a first character set; and the characters of the container name and the currently selected program name are unioned to obtain a second character set; Obtaining a first similarity between the container name and a currently selected program name according to the first character set and the second character set; Determine a second similarity between the container name and the currently selected program name based on the Jaro-WinklerS algorithm; The character similarity between the container name and the currently selected program name is obtained according to the first similarity and the second similarity.

4. The method according to claim 3, characterized in that The obtaining, according to the first character set and the second character set, a first similarity between the container name and the currently selected program name includes: Obtaining the number of characters included in the first character set as a first number; and obtaining the number of characters included in the second character set as a second number; The first number and the second number are divided to obtain a first similarity between the container name and the currently selected program name.

5. The method according to claim 3, characterized in that: The obtaining, according to the first similarity and the second similarity, the character similarity between the container name and the currently selected program name includes: The first similarity and the second similarity are summed to obtain the character similarity between the container name and the currently selected program name.

6. The method according to claim 3, characterized in that The determining, based on the Jaro-WinklerS algorithm, a second similarity between the container name and the currently selected program name includes: According to the container name and the currently selected program name, the number of matching characters, the number of transpositions, the first string length, and the second string length of the container name and the currently selected program name are obtained; the first string length is the string length of the container name; the second string length is the string length of the currently selected program name; Obtaining a third similarity according to the number of matching characters, the number of transpositions, the length of the first character string, and the length of the second character string; A second similarity between the container name and the currently selected program name is obtained according to the third similarity, the common prefix length and a preset common prefix weight; the common prefix length is a length characteristic value of a common prefix at the beginning of a character string of the container name and a character string of the currently selected program name.

7. A container safety protection device, characterized in that: The device comprises: A basic information capture module, used to obtain the container name of the target container and a preset application whitelist; the application whitelist includes function-assisted applications corresponding to each function type container selected by the user; A target program determination module, used to determine the program to be statically analyzed of the target container according to the application whitelist and a preset similarity calculation rule; A call set determination module, used for performing static analysis on the program to be statically analyzed to obtain a system call set of the program to be statically analyzed; The system call control module is used to control the system call of the target container based on the system call set.

8. The device according to claim 7, characterized in that The target program determination module is specifically used for: Determining a program name of an application program in the target container according to the container name of the target container; Selecting program names one by one, and for each selected program name, determining whether the application whitelist includes the currently selected program name; If the result of the judgment is inclusion, then the currently selected program name is added to the programs to be statically analyzed in the target container; If the result of the judgment is not included, determining the character similarity between the container name and the currently selected program name according to a preset similarity calculation rule; If the character similarity is greater than or equal to a preset similarity threshold, the currently selected program name is added to the programs to be statically analyzed in the target container.

9. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the computer program is executed by the processor, the method according to any one of claims 1 to 6 is implemented.

Images