A container safety protection method, device, medium, and electronic device

Abstract

This application provides a container security protection method, apparatus, medium, and electronic device, relating to the field of information security technology. The method involves obtaining the container name of a target container and a preset application whitelist; the application whitelist includes user-selected auxiliary applications corresponding to containers of various functional types; determining the target container's static analysis program based on the application whitelist and preset similarity calculation rules; performing static analysis on the program to be statically analyzed to obtain its system call set; and controlling the target container's system calls based on the system call set. This method can improve container security.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a container security protection method, device, medium and electronic device. Background Technology

[0002] Currently, with the widespread adoption of cloud-native architectures, container technology, with its advantages of lightweight design, rapid deployment, and efficient resource utilization, has become a core means of modern application deployment. Container images, as the fundamental component of containerized deployment, determine the container's runtime environment and software dependencies. In the context of microservices and lightweight architectures, containers, as a core capability, are typically implemented to achieve a specific, single function; for example, Nginx provides load balancing and proxying of traffic, while MySQL provides persistent data storage.

[0003] However, many existing container images contain a large number of applications and tools, which not only increases system complexity but also significantly expands the potential attack surface. System calls are an interface provided by the operating system that allows applications to interact with the operating system kernel. Currently, the Linux kernel supports more than 300 system calls. System calls inadvertently increase the attack surface of containers, allowing attackers to use them as entry points to compromise system security and compromise container runtime security. Therefore, providing a method to improve container security is of great significance. Summary of the Invention

[0004] This application provides a container security protection method, apparatus, and device, which can control the system calls of the target container based on a system call set obtained according to an application whitelist and preset similarity calculation rules, thereby improving the security of the container.

[0005] In a first aspect, embodiments of this application provide a container safety protection method, the method comprising:

[0006] Obtain the container name of the target container and a preset application whitelist; the application whitelist includes user-selected auxiliary applications corresponding to each functional type of container;

[0007] Based on the application whitelist and preset similarity calculation rules, determine the static analysis program for the target container;

[0008] Perform static analysis on the program to be statically analyzed to obtain the system call set of the program to be statically analyzed.

[0009] Based on the system call set, control the system calls of the target container.

[0010] A second aspect of this application provides a container safety protection device, the device comprising:

[0011] The basic information capture module is used to obtain the container name of the target container and a preset application whitelist; the application whitelist includes user-selected auxiliary applications corresponding to each functional type of container;

[0012] The target program determination module is used to determine the static analysis program of the target container based on the application whitelist and preset similarity calculation rules.

[0013] The call set determination module is used to perform static analysis on the program to be statically analyzed and obtain the system call set of the program to be statically analyzed.

[0014] The system call control module is used to control the system calls of the target container based on the system call set.

[0015] In an optional embodiment, the target program determining module is specifically used for:

[0016] The first character set is obtained by finding the intersection of the characters of the container name and the currently selected program name; and the second character set is obtained by finding the union of the characters of the container name and the currently selected program name.

[0017] Based on the first character set and the second character set, the first similarity between the container name and the currently selected program name is obtained;

[0018] Based on the Jaro-WinklerS algorithm, the second similarity between the container name and the currently selected program name is determined;

[0019] Based on the first similarity and the second similarity, the character similarity between the container name and the currently selected program name is obtained.

[0020] In an optional embodiment, the target program determining module is specifically used for:

[0021] Get the number of characters contained in the first character set as the first count; and get the number of characters contained in the second character set as the second count;

[0022] The first quantity and the second quantity are used to quotient each other to obtain the first similarity between the container name and the currently selected program name.

[0023] In an optional embodiment, the target program determining module is specifically used for:

[0024] The first similarity and the second similarity are summed to obtain the character similarity between the container name and the currently selected program name.

[0025] In an optional embodiment, the target program determining module is specifically used for:

[0026] Based on the container name and the currently selected program name, the number of matching characters, the number of transpositions, the length of the first string, and the length of the second string are obtained for the container name and the currently selected program name; the length of the first string is the length of the container name; the length of the second string is the length of the currently selected program name.

[0027] The third similarity is obtained based on the number of matched characters, the number of transpositions, the length of the first string, and the length of the second string;

[0028] The second similarity between the container name and the currently selected program name is obtained based on the third similarity, the common prefix length, and the preset common prefix weight; the common prefix length is the feature value of the length of the common prefix at the beginning of the strings of the container name and the currently selected program name.

[0029] According to a third aspect provided in the embodiments of this application, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the method described in the first aspect.

[0030] According to a fourth aspect provided in the embodiments of this application, an electronic device is provided, including a processor and a memory, wherein the memory stores a computer program that can run on the processor, and when the computer program is executed by the processor, implements the method as described in the first aspect.

[0031] In the above embodiments of this application, the container name of the target container and a preset application whitelist are obtained; the application whitelist includes user-selected auxiliary applications corresponding to containers of various functional types; based on the application whitelist and preset similarity calculation rules, the program to be statically analyzed for the target container is determined; static analysis is performed on the program to be statically analyzed to obtain the system call set of the program to be statically analyzed; based on the system call set, the system calls of the target container are controlled. Therefore, this embodiment can control the system calls of the target container based on the system call set obtained according to the application whitelist and preset similarity calculation rules, providing a mechanism for restricting system calls during container operation. By combining the container name and the application whitelist to accurately determine the program to be statically analyzed, it can reduce system calls that are not used during actual container operation, reduce the attack surface of the container, and improve container security. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 A schematic flowchart illustrating a container safety protection method provided in an embodiment of this application;

[0034] Figure 2 A flowchart illustrating the static analysis procedure for determining the target container in a container safety protection method provided in this application embodiment;

[0035] Figure 3 A flowchart illustrating the determination of character similarity between a container name and a currently selected program name in a container security protection method provided in this application embodiment;

[0036] Figure 4 A schematic flowchart illustrating the process of obtaining the first similarity between a container name and a currently selected program name in a container security protection method provided in this application embodiment;

[0037] Figure 5 A schematic flowchart illustrating the process of obtaining the second similarity between the container name and the currently selected program name in a container security protection method provided in this application embodiment;

[0038] Figure 6 This is a schematic diagram of the structure of a container safety protection device provided in an embodiment of this application;

[0039] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] It should be noted that the terms "comprising" and "having" and their variations used in this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0042] The following are explanations of some of the words that appear in the text:

[0043] (1) Seccomp (Secure Computing Mode): Seccomp is a kernel security mechanism used to restrict the set of system calls that Linux processes can execute. Seccomp defines a set of rules that allow processes to call only specific system calls; calls outside this set will be rejected or trigger an exception.

[0044] (2) Containers: A container is a lightweight, operating system-level virtualization technology that allows applications and their dependencies to run in resource isolation. All the necessary components for running an application are packaged into a single, reusable image. When the image runs, it operates in an isolated environment and does not share the host operating system's memory, CPU, or disk with other applications. This ensures that processes within the container do not affect any processes outside the container.

[0045] (3) BPF (Berkeley Packet Filter): BPF is an efficient mechanism for filtering and processing network packets. BPF runs user-defined bytecode through a virtual machine (BPF VM), which can perform filtering operations in kernel space, improving the efficiency of network packet capture.

[0046] Currently, with the widespread adoption of cloud-native architectures, container technology, with its advantages of lightweight design, rapid deployment, and efficient resource utilization, has become a core means of modern application deployment. Container images, as the fundamental component of containerized deployment, determine the container's runtime environment and software dependencies. In the context of microservices and lightweight architectures, containers, as a core capability, are typically implemented to achieve a specific, single function; for example, Nginx provides load balancing and proxying of traffic, while MySQL provides persistent data storage.

[0047] However, many existing container images contain a large number of applications and tools, which not only increases system complexity but also significantly expands the potential attack surface. System calls are an interface provided by the operating system that allows applications to interact with the operating system kernel. Currently, the Linux kernel supports more than 300 system calls. System calls inadvertently increase the attack surface of containers, allowing attackers to use them as entry points to compromise system security and compromise container runtime security. Therefore, providing a method to improve container security is of great significance.

[0048] To address existing technical problems, this application provides a container security protection method. The method involves obtaining the container name of the target container and a preset application whitelist. The application whitelist includes user-selected auxiliary applications corresponding to containers of various functional types. Based on the application whitelist and preset similarity calculation rules, a static analysis program for the target container is determined. Static analysis is performed on the program to be analyzed to obtain a set of system calls for the program. Based on the system call set, the system calls of the target container are controlled. Therefore, this embodiment can control the system calls of the target container based on the system call set obtained according to the application whitelist and preset similarity calculation rules, thereby improving container security.

[0049] The technical solutions provided in the embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0050] This application provides a container safety protection method, such as... Figure 1 As shown, it includes the following steps:

[0051] Step S101: Obtain the container name of the target container and the preset application whitelist; the application whitelist includes the auxiliary applications selected by the user that correspond to each function type container.

[0052] In practical implementation, considering the actual container usage and functional requirements of the users, embodiments of this application maintain a whitelist of functional auxiliary applications for containers of different functional types. This list specifies the essential applications within the container as part of static analysis.

[0053] Operating system containers, such as Ubuntu, provide a general and clean operating system environment and are often used by users as a foundation for customizing their own containers. This type of container typically retains a large number of applications. Programming language containers are also frequently used as the base container, with users often using them for document editing, code debugging, and related applications. Web service containers frequently handle request and response, port management, and configuration management. Database service containers frequently perform operations such as document deletion or backup, status queries, and encryption / decryption.

[0054] In some embodiments of this application, a pre-defined application whitelist is provided; the application whitelist includes user-selected auxiliary applications corresponding to various function type containers. For example, the pre-defined application whitelist is shown in Table 1:

[0055] Table 1: Application Whitelist

[0056]

[0057] In the embodiments of this application, the container name of the target container and a preset application whitelist are first obtained to implement a container security protection process based on the container name of the target container and the preset application whitelist; the application whitelist includes functional auxiliary applications selected by the user that correspond to each functional type of container.

[0058] Step S102: Determine the static analysis program for the target container based on the application whitelist and preset similarity calculation rules.

[0059] In some embodiments of this application, the application in the container image is matched with the container name of the target container by pattern matching. For applications that meet a certain threshold, they are identified as container function-related programs. Based on the container function-related programs, the program to be statically analyzed is obtained.

[0060] In some embodiments of this application, the application in the container image is matched with the container name of the target container by pattern matching. For an application that meets a specific threshold, it is identified as a container function-related application. The application in the container image is matched with an application whitelist by pattern matching. For an application that falls into the application whitelist, it is identified as a container function-auxiliary application. Based on the container function-related application and the container function-auxiliary application, the application to be statically analyzed is obtained.

[0061] The method in this embodiment efficiently combines container names and application whitelists through pattern matching to accurately identify the program to be statically analyzed. This reduces system calls that are not used during actual container operation, reduces the attack surface of the container, and improves container security.

[0062] In some embodiments of this application, container-specific programs refer to core programs natively associated with the container to enable its operation. Examples include the nginx and nginx-debug programs within an nginx container, and the mysqld and mysqlsh programs within a mysql container. These programs play a crucial role in resource configuration and functional debugging, and are the core applications of the container.

[0063] For example, container-specific programs are shown in Table 2:

[0064] Table 2

[0065]

[0066]

[0067] In an optional embodiment, step S102, which involves determining the target container's static analysis program based on the application whitelist and preset similarity calculation rules, is as follows: Figure 2 As shown, this can be achieved through the following steps:

[0068] Step S201: Determine the application name of the application within the target container based on the container name of the target container.

[0069] In practice, based on the container name of the target container, all applications in the target container are traversed to obtain the application names of the applications within the target container.

[0070] Step S202: Select program names one by one. For each selected program name, determine whether the currently selected program name is included in the application whitelist.

[0071] In practice, program names are selected one by one. For each selected program name, it is first determined whether the currently selected program name is a program in the whitelist in order to obtain the functional auxiliary application in the application of the target container.

[0072] Step S203: If the result of the judgment is "included", then add the currently selected program name to the static analysis program of the target container.

[0073] In some embodiments of this application, if it is determined that the currently selected program name is a program in the whitelist, then a functional auxiliary application in an application within the target container is obtained; the obtained functional auxiliary application in the application within the target container is used as a container functional auxiliary program; and the container functional auxiliary program is added to the program to be statically analyzed in the target container.

[0074] Step S204: If the result of the judgment is that it does not include, then the character similarity between the container name and the currently selected program name is determined according to the preset similarity calculation rules.

[0075] In an optional embodiment, step S204, which involves determining the character similarity between the container name and the currently selected program name according to a preset similarity calculation rule, is as follows: Figure 3 As shown, this can be achieved through the following steps:

[0076] Step S301: Find the intersection of the characters of the container name and the currently selected program name to obtain the first character set; and find the union of the characters of the container name and the currently selected program name to obtain the second character set.

[0077] Step S302: Based on the first character set and the second character set, obtain the first similarity between the container name and the currently selected program name.

[0078] In an optional embodiment, step S302, which involves obtaining the first similarity between the container name and the currently selected program name based on the first character set and the second character set, is as follows: Figure 4 As shown, this can be achieved through the following steps:

[0079] Step S401: Obtain the number of characters contained in the first character set as the first number; and obtain the number of characters contained in the second character set as the second number.

[0080] Step S402: Calculate the quotient of the first quantity and the second quantity to obtain the first similarity between the container name and the currently selected program name.

[0081] Step S303: Based on the Jaro-WinklerS algorithm, determine the second similarity between the container name and the currently selected program name.

[0082] In an optional embodiment, step S303, which involves determining the second similarity between the container name and the currently selected program name based on the Jaro-Winkler algorithm, is as follows: Figure 5 As shown, this can be achieved through the following steps:

[0083] Step S501: Based on the container name and the currently selected program name, obtain the number of matching characters, the number of transpositions, the length of the first string, and the length of the second string for the container name and the currently selected program name; the length of the first string is the length of the container name; the length of the second string is the length of the currently selected program name.

[0084] Step S502: Based on the number of matched characters, the number of transpositions, the length of the first string, and the length of the second string, obtain the third similarity.

[0085] Step S503: Based on the third similarity, the common prefix length, and the preset common prefix weight, obtain the second similarity between the container name and the currently selected program name; the common prefix length is the feature value of the length of the common prefix at the beginning of the strings of the container name and the currently selected program name.

[0086] In the embodiments of this application, the length feature value represents the length of the common prefix at the beginning of the string; the maximum value of the length feature value is 4; when the length of the common prefix at the beginning of the string is less than or equal to 4, the length feature value is the same as the length of the common prefix at the beginning of the string; when the length of the common prefix at the beginning of the string is greater than 4, the length feature value is 4.

[0087] Step S304: Based on the first similarity and the second similarity, obtain the character similarity between the container name and the currently selected program name.

[0088] In one optional embodiment, the character similarity between the container name and the currently selected program name is obtained based on the first similarity and the second similarity. Specifically, the first similarity and the second similarity are summed to obtain the character similarity between the container name and the currently selected program name.

[0089] In other embodiments, the character similarity between the container name and the currently selected program name is obtained based on the first similarity and the second similarity. Specifically, the first similarity and the second similarity are weighted and summed, and the result of the weighted sum is used as the character similarity between the container name and the currently selected program name.

[0090] In some embodiments of this application, the container name may be the container image name. There is name similarity between the container name and container-related programs.

[0091] In the embodiments of this application, the similarity between the container name and the program name is compared. The higher the similarity, the greater the correlation between the two. Based on this, it is determined whether the program is a container-related program.

[0092] For example, some embodiments of this application combine the following two algorithms to match the program names of applications within a target container.

[0093] (a) Jaccard algorithm

[0094] The Jaccard algorithm is an algorithm used to calculate the similarity between two sets. Based on this algorithm, the similarity is first measured by the ratio of the intersection to the union of the container name and the program name strings, as shown in the following formula:

[0095]

[0096] in,

[0097] ImageName represents the container name;

[0098] ProgramName represents the name of the program within the container.

[0099] Taking the MySQL container as an example, its similarity to mysqlsh and nginx is calculated as follows:

[0100]

[0101]

[0102] The algorithm found that the similarity between mysqlsh and mysql was 0.71, while the similarity between nginx and mysql was 0.

[0103] The Jaccard algorithm is highly accurate in identifying programs with many similar characters in their names.

[0104] (b) Jaro-Winkler algorithm

[0105] The Jaro-Winkler algorithm is an improvement on the Jaro algorithm. It is a string similarity matching algorithm based on edit distance. It is based on the concept of edit distance and also considers the prefix matching of the string, giving higher weight to the first matching character, thus improving the accuracy of string similarity calculation.

[0106] The formula for the Jaro algorithm is as follows:

[0107]

[0108] Where |s1| and |s2| represent the lengths of strings s1 and s2, respectively, which represent the container name and the program name, respectively;

[0109] m represents the number of matching characters between the two strings;

[0110] t represents the number of transpositions.

[0111] In the embodiments of this application, the number of transpositions represents half the number of matching characters in different orders.

[0112] For example, for two strings “kjcde” and “jked”, 'k' and 'j' are matching characters; however, 'k' and 'j' are represented as “kj…” and “jk…” in the two strings, that is, the order of the two matching characters 'k' and 'j' is different. Therefore, the number of matching characters with different orders is 2, and the value of the number of transpositions t is 1.

[0113] Building upon the Jaro algorithm, the Jaro-Winkler algorithm further emphasizes the importance of prefixes, as shown in the following formula:

[0114] Similarity winkler =Similarity jaro +lp(1-Similarity jaro ),

[0115] Among them, Similarity jaro , is the similarity between s1 and s2;

[0116] l is the length of the common prefix at the beginning of the string, with a maximum of 4;

[0117] p is the common prefix weight, which describes the contribution of the common prefix to the similarity. The larger the p is, the greater the weight of the common prefix to the similarity. The maximum common prefix weight is 0.25, and the default value is 0.1.

[0118] Finally, the two are added together to obtain the final character similarity score:

[0119] Similarity = Similarity Jac +Similarity winkler .

[0120] Step S205: If the character similarity is greater than or equal to the preset similarity threshold, then add the currently selected program name to the static analysis program in the target container.

[0121] In some embodiments of this application, the similarity threshold is set to 0.6. If the character similarity exceeds 0.6, the application is considered to be a container-functional related program, and the currently selected program name is added to the static analysis program of the target container.

[0122] The method described in the above embodiments is simple in design and is very effective in identifying some container-related applications, especially containers with relatively standardized naming formats for some function-related programs. This method can successfully match more than 90% of the related applications inside the container.

[0123] Step S103: Perform static analysis on the program to be statically analyzed to obtain the system call set of the program to be statically analyzed.

[0124] In practice, the system call set of the program to be statically analyzed is extracted through static analysis.

[0125] In some embodiments of this application, after matching the static analysis program related to the function in the container image, static analysis is performed on each static analysis program to extract the system calls required during its execution.

[0126] There are many ways to perform static analysis, including: disassembly analysis, which uses disassemblers (such as objdump or IDAPro) to parse the application's binary file or its dependent libraries, obtain the executable instruction set, and find the system calls that it may call under different paths; and control flow analysis, which combines the results of disassembly and symbolic analysis to trace the program's call path and determine all possible system call points.

[0127] The details of static analysis are not elaborated in this application. Through the above static analysis operations, a set of system calls for each program to be statically analyzed is ultimately formed.

[0128] Step S104: Control the system calls of the target container based on the system call set.

[0129] In practice, the process of controlling the system calls of the target container based on the system call set includes: constructing a seccomp BPF rule file based on the system call set obtained from static analysis; the seccomp BPF rule file includes a seccomp BPF restriction policy; the seccomp BPF restriction policy is to prohibit all system calls by default, and to add the obtained system call set to the policy in the form of a whitelist so that the container can call it.

[0130] In the embodiments of this application, Seccomp and BPF are used together, complementing each other and enabling Seccomp to perform filtering by specifying system calls.

[0131] The container security protection method provided in this application embodiment obtains the container name of the target container and a preset application whitelist. The application whitelist includes user-selected auxiliary applications corresponding to containers of various functional types. Based on the application whitelist and preset similarity calculation rules, the program to be statically analyzed for the target container is determined. Static analysis is performed on the program to be statically analyzed to obtain the system call set of the program to be statically analyzed. Based on the system call set, the system calls of the target container are controlled. Therefore, this embodiment can control the system calls of the target container based on the system call set obtained according to the application whitelist and preset similarity calculation rules, providing a mechanism for restricting system calls during container operation. This can reduce system calls that are not used by the container during actual operation, reduce the attack surface of the container, and improve the security of the container.

[0132] and Figure 1 The container safety protection method shown is based on the same inventive concept. This application also provides a container safety protection device. Since this device corresponds to the container safety protection method of this application, and the principle by which this device solves the problem is similar to that of the method, the implementation of this device can refer to the implementation of the above method; repeated details will not be elaborated further.

[0133] Figure 6 This application provides a schematic diagram of the structure of a container safety protection device according to an embodiment of the present application. Figure 6 As shown, the container safety protection device includes a basic information capture module 601, a target program determination module 602, a call set determination module 603, and a system call control module 604.

[0134] The basic information capture module 601 is used to obtain the container name of the target container and the preset application whitelist; the application whitelist includes the auxiliary application selected by the user that corresponds to each functional type of container.

[0135] The target program determination module 602 is used to determine the static analysis program of the target container based on the application whitelist and preset similarity calculation rules.

[0136] The call set determination module 603 is used to perform static analysis on the program to be statically analyzed and obtain the system call set of the program to be statically analyzed.

[0137] System call control module 604 is used to control the system calls of the target container based on the system call set.

[0138] In an optional embodiment, the target program determination module 602 is specifically used for:

[0139] Determine the application name within the target container based on the container name of the target container;

[0140] Select program names one by one. For each program name selected, check whether the currently selected program name is included in the application whitelist.

[0141] If the result of the judgment is "included", then the currently selected program name is added to the static analysis program in the target container;

[0142] If the result of the judgment is that it does not include, then the character similarity between the container name and the currently selected program name is determined according to the preset similarity calculation rules.

[0143] If the character similarity is greater than or equal to the preset similarity threshold, the currently selected program name will be added to the static analysis program in the target container.

[0144] In an optional embodiment, the target program determination module 602 is specifically used for:

[0145] Find the intersection of the characters in the container name and the currently selected program name to obtain the first character set; and find the union of the characters in the container name and the currently selected program name to obtain the second character set.

[0146] Based on the first character set and the second character set, obtain the first similarity between the container name and the currently selected program name;

[0147] Based on the Jaro-WinklerS algorithm, determine the second similarity between the container name and the currently selected program name;

[0148] Based on the first and second similarity scores, the character similarity between the container name and the currently selected program name is obtained.

[0149] In an optional embodiment, the target program determination module 602 is specifically used for:

[0150] Get the number of characters contained in the first character set as the first count; and get the number of characters contained in the second character set as the second count;

[0151] The first and second quantities are quotiented to obtain the first similarity between the container name and the currently selected program name.

[0152] In an optional embodiment, the target program determination module 602 is specifically used for:

[0153] The sum of the first and second similarities is used as the character similarity between the container name and the currently selected program name.

[0154] In an optional embodiment, the target program determination module 602 is specifically used for:

[0155] Based on the container name and the currently selected program name, obtain the number of matching characters, the number of transpositions, the length of the first string, and the length of the second string for the container name and the currently selected program name; the length of the first string is the length of the container name; the length of the second string is the length of the currently selected program name.

[0156] The third similarity is obtained based on the number of matched characters, the number of transpositions, the length of the first string, and the length of the second string;

[0157] The second similarity between the container name and the currently selected program name is obtained based on the third similarity, the common prefix length, and the preset common prefix weight; the common prefix length is the feature value of the length of the common prefix at the beginning of the strings of the container name and the currently selected program name.

[0158] Based on the same inventive concept as the above-described method embodiments, this application also provides an electronic device. This electronic device can be used for container security protection. In one embodiment, the electronic device can be a server, a terminal device, or other electronic equipment. In this embodiment, the structure of the electronic device can be as follows... Figure 7 As shown, it includes a memory 701, a communication module 703, and one or more processors 702.

[0159] The memory 701 is used to store computer programs executed by the processor 702. The memory 701 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0160] Memory 701 may be volatile memory, such as random-access memory (RAM); memory 701 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 701 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 701 may be a combination of the above-described memories.

[0161] The processor 702 may include one or more central processing units (CPUs) or digital processing units, etc. The processor 702 is used to implement the aforementioned container security protection method when calling computer programs stored in the memory 701.

[0162] The communication module 703 is used to communicate with terminal devices and other servers.

[0163] This application does not limit the specific connection medium between the memory 701, communication module 703, and processor 702 described above. This disclosure embodiment... Figure 7 The memory 701 and the processor 702 are connected via a bus 704, and the bus 704 is in Figure 7 The connections between other components are shown in bold lines only and are not intended to be limiting. The 704 bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0164] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the container security protection method described in the above embodiments. The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0165] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A container safety protection method, characterized in that, The method includes: Obtain the container name of the target container and a preset application whitelist; the application whitelist includes user-selected auxiliary applications corresponding to each functional type of container; Based on the application whitelist and preset similarity calculation rules, determine the static analysis program for the target container; Perform static analysis on the program to be statically analyzed to obtain the system call set of the program to be statically analyzed. Based on the system call set, control the system calls of the target container; The step of determining the static analysis program for the target container based on the application whitelist and preset similarity calculation rules includes: Based on the container name of the target container, determine the application name of the application within the target container; Select program names one by one. For each program name selected, determine whether the currently selected program name is included in the application whitelist. If the result of the judgment is "included", then the currently selected program name is added to the static analysis program of the target container; If the result of the judgment is that it does not include, then the character similarity between the container name and the currently selected program name is determined according to the preset similarity calculation rules. If the character similarity is greater than or equal to the preset similarity threshold, then the currently selected program name is added to the static analysis program of the target container; The step of determining the character similarity between the container name and the currently selected program name according to a preset similarity calculation rule includes: The first character set is obtained by finding the intersection of the characters of the container name and the currently selected program name; and the second character set is obtained by finding the union of the characters of the container name and the currently selected program name. Based on the first character set and the second character set, the first similarity between the container name and the currently selected program name is obtained; Based on the Jaro-Winkler algorithm, the second similarity between the container name and the currently selected program name is determined; Based on the first similarity and the second similarity, the character similarity between the container name and the currently selected program name is obtained.

2. The method according to claim 1, characterized in that, The step of obtaining the first similarity between the container name and the currently selected program name based on the first character set and the second character set includes: Get the number of characters contained in the first character set as the first count; and get the number of characters contained in the second character set as the second count; The first quantity and the second quantity are used to quotient each other to obtain the first similarity between the container name and the currently selected program name.

3. The method according to claim 1, characterized in that, The step of obtaining the character similarity between the container name and the currently selected program name based on the first similarity and the second similarity includes: The first similarity and the second similarity are summed to obtain the character similarity between the container name and the currently selected program name.

4. The method according to claim 1, characterized in that, The determination of the second similarity between the container name and the currently selected program name based on the Jaro-Winkler algorithm includes: Based on the container name and the currently selected program name, obtain the number of matching characters, the number of transpositions, the length of the first string, and the length of the second string for the container name and the currently selected program name; the length of the first string is the length of the container name; the length of the second string is the length of the currently selected program name. The third similarity is obtained based on the number of matched characters, the number of transpositions, the length of the first string, and the length of the second string; The second similarity between the container name and the currently selected program name is obtained based on the third similarity, the common prefix length, and the preset common prefix weight; the common prefix length is the feature value of the length of the common prefix at the beginning of the strings of the container name and the currently selected program name.

5. A container safety protection device, characterized in that, The device includes: The basic information capture module is used to obtain the container name of the target container and a preset application whitelist; the application whitelist includes user-selected auxiliary applications corresponding to each functional type of container; The target program determination module is used to determine the static analysis program of the target container based on the application whitelist and preset similarity calculation rules. The call set determination module is used to perform static analysis on the program to be statically analyzed and obtain the system call set of the program to be statically analyzed. The system call control module is used to control the system calls of the target container based on the system call set; The target program determination module is specifically used for: Based on the container name of the target container, determine the application name of the application within the target container; Select program names one by one. For each program name selected, determine whether the currently selected program name is included in the application whitelist. If the result of the judgment is "included", then the currently selected program name is added to the static analysis program of the target container; If the result of the judgment is that it does not include, then the character similarity between the container name and the currently selected program name is determined according to the preset similarity calculation rules. If the character similarity is greater than or equal to the preset similarity threshold, then the currently selected program name is added to the static analysis program of the target container; The target program determination module is specifically used for: The first character set is obtained by finding the intersection of the characters of the container name and the currently selected program name; and the second character set is obtained by finding the union of the characters of the container name and the currently selected program name. Based on the first character set and the second character set, the first similarity between the container name and the currently selected program name is obtained; Based on the Jaro-Winkler algorithm, the second similarity between the container name and the currently selected program name is determined; Based on the first similarity and the second similarity, the character similarity between the container name and the currently selected program name is obtained.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the method of any one of claims 1 to 4.

7. An electronic device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program that can run on the processor, and when the computer program is executed by the processor, it implements the method of any one of claims 1 to 4.

Images