Container system call risk assessment list generation method combining dynamic and static analysis

Abstract

The invention relates to the field of system security in computer science, in particular to a dynamic and static analysis combined container system call risk assessment list generation method. The invention provides a dynamic and static analysis combined container system call risk assessment list generation method, which is characterized in that a BM25 algorithm is adopted to calculate a score of each system call in a vulnerability utilization code system call list and collect data of the score; and performing data marking on each system call in a vulnerability utilization code system call list according to expert knowledge, training an XGBoost training model by using the BM25 score, the collected data and the data marks as a training set, updating the model in real time through online learning and incremental learning, and performing data marking on the system call in the vulnerability utilization code system call list. And sorting all system calls according to the data marks, and outputting a risk degree ranking in real time. The method aims at helping security personnel to quickly search and respond and preventing system calling with potential risks during container operation.

Description

Technical Field

[0001] The present invention relates to the field of system security in computer science, and in particular to a method for generating a container system call risk assessment list by combining dynamic and static analysis. Background Art

[0002] As cloud computing gradually becomes the foundation of digital infrastructure, many enterprises are transitioning from traditional, virtual machine-based, monolithic service architectures to emerging microservices architectures. The widespread adoption of microservices architectures is primarily driven by the lightweight, portable, and scalable nature of container technology.

[0003] However, this new architecture faces emerging and ongoing security challenges. While container technology improves performance, it also reduces isolation. The core difference between containers and virtual machines is that they share the host operating system kernel. This sharing grants applications within the container access to host system resources (such as the file system, network, and processes). Although the Linux kernel provides isolation and resource constraints between containers through namespaces and control groups, these isolation mechanisms remain vulnerable to security threats, such as the Dirty COW (CVE-2016-5195) vulnerability, a classic example of container escape using a kernel vulnerability. Furthermore, there are other security threats such as privilege escalation attacks and the leakage of sensitive data.

[0004] Regarding container security, the exploitation principles of many kernel vulnerabilities are tied to specific system calls. Restricting system calls effectively reduces the attack surface of containers. System calls are interfaces that enable interaction between applications and the operating system kernel, used to perform various kernel-level tasks. The implementation of Seccomp in container management systems also effectively restricts system calls, but it still has certain shortcomings. For example, the default system call whitelist used by Docker only blocks a limited number of system calls within a fixed range. This default profile allows a very broad range of system calls, which may expose many system calls that are not used by applications, expanding the attack surface of containers.

[0005] Existing research aims to reduce the attack surface by restricting system calls, thereby reducing container permissions and enhancing container security. Three main technical approaches are employed: static analysis, dynamic analysis, and machine learning. However, each has its own limitations and shortcomings.

[0006] For static analysis, its limitation is that it cannot monitor behavioral changes during container operation, which means that it may ignore system calls that are only executed during the container operation phase.

[0007] Dynamic analysis is limited by its reliance on the functionality executed by the container during runtime. Monitoring online containers may not be sufficient to track all necessary system calls, especially those that are not often encountered in normal operations and are triggered by abnormal situations.

[0008] The limitations of machine learning methods are that they consume a lot of computing time and resources. A single data model has high requirements for the data set and cannot adapt to the data in real time, nor can it dynamically adjust the risk score.

[0009] To alleviate the above problems, the present invention proposes a method for generating a container system call risk assessment list that combines dynamic and static analysis, generating a more accurate system call potential risk list for each container application. Through this list, security personnel can quickly respond to related potential risk system calls and avoid some potentially dangerous container security issues, thereby enhancing security while ensuring the normal function of the container. Summary of the Invention

[0010] The purpose of the present invention is to generate a more accurate system call potential risk list for each container application based on a container system call risk assessment list generation method that combines dynamic and static analysis. Through this list, security personnel can quickly respond to relevant potential risk system calls, avoid some potentially dangerous container security issues, and improve the problems that existing technologies cannot monitor behavioral changes during container operation, or rely on functions executed during container operation, or have high requirements for data sets and cannot adapt to data in real time or cannot dynamically adjust risk scores.

[0011] The present invention provides a method for generating a container system call risk assessment list by combining dynamic and static analysis, comprising the following steps: Combine dynamic and static analysis and supplement system calls to generate a container system call list; The generating container system call list selects vulnerability exploitation codes related to container security threats as a training data set to generate a vulnerability exploitation code system call list; Calculate the score of each system call in the system call list of the vulnerability exploit code using the BM25 algorithm and collect its data; Marking data for each system call in the system call list of the vulnerability exploit code according to expert knowledge; Training the XGBoost training model using the BM25 score, the collected data, and the data labels as a training set; Real-time model updates through online learning and incremental learning; All system calls are sorted according to the data tags, and the risk ranking is output in real time.

[0012] The present invention provides a method for generating a container system call risk assessment list by combining dynamic and static analysis, which has the technical effects of rapid response and strong security.

[0013] Optionally, the combining of dynamic and static analysis and supplementing system calls to generate a container system call list includes: Use dynamic tracing methods to extract the binary files corresponding to the actual running processes in the container, including applications, dynamic link libraries, and command-line tools, as input for subsequent static analysis and dynamic analysis to extract system calls; By converting the extracted binary file into assembly code, the register value backtracing method is used to extract direct system calls from the three ways of calling system calls in the assembly code; Use dynamic analysis methods combined with statistical research to extract the system calls required to build container isolation environments and initialize program runtime environments; Implement a crash loop mechanism, use test tools to test in the running state of the container, and supplement the system call whitelist based on the feedback of crash information to make it more complete.

[0014] Optionally, the step of generating the vulnerability exploit code system call list includes: Select vulnerability exploitation codes related to container security threats as training datasets; Analyze the compiler intermediate representation to extract direct system calls; Constructing a call graph of library functions in the exploit code; Extract system calls indirectly called through library functions; Get all system calls related to container security vulnerabilities to generate a system call list of vulnerability exploit codes.

[0015] Optionally, the content of the collected data includes: related processes, system call names, parameters, call frequencies, and system call timestamps.

[0016] Optionally, when data labeling is performed on each system call in the system call list of the vulnerability exploit code based on expert knowledge, a risk score is used as a label of the training data set, with a score ranging from 0 to 1, 0.1 being low risk and 0.9 being high risk, and the scoring criteria are constructed based on known attack information and professional security knowledge.

[0017] Optionally, when training the XGBoost training model, after selecting appropriate hyperparameters in XGBoost, training is performed to obtain a decision tree-based model. XGBoost optimizes the tree structure through multiple trainings and outputs its corresponding risk score in combination with the features of all system calls.

[0018] Optionally, when the model is updated in real time through online learning and incremental learning, when new data arrives, the model is gradually updated through online learning without the need to retrain the entire model. The model is gradually updated, and whenever a new attack sample appears, the model is updated in real time and the prediction results are adjusted to adapt to the new attack pattern.

[0019] Optionally, when the model is updated in real time through online learning and incremental learning, an incremental learning approach is adopted to update the model in batches, and the model is continuously optimized as new data arrives.

[0020] Optionally, the sorting of all system calls is performed according to a risk score of each system call, and a risk ranking is output.

[0021] Optionally, when all system calls are sorted according to the data tags and the risk ranking is output in real time, when a new container instance is running, the system call data of the container is extracted and input into the trained XGBoost model for risk score prediction, and its risk ranking is output in real time. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 The present invention provides a method for generating a container system call risk assessment list by combining dynamic and static analysis and supplementing system calls to generate a flowchart of a container system call list; Figure 2 This is a flowchart of a container system call risk assessment list generation method combining dynamic and static analysis provided by the present invention to generate a vulnerability exploitation code system call list; Figure 3 The present invention provides a method for generating a container system call risk assessment list by combining dynamic and static analysis, and a flow chart for generating a risk ranking by using a vulnerability exploitation code system call list. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0024] An embodiment of the present invention provides a method for generating a container system call risk assessment list by combining dynamic and static analysis, comprising the following steps: S1. Combine dynamic and static analysis and add system calls to generate a container system call list; S2. Generating a container system call list, selecting vulnerability exploit codes related to container security threats as a training data set to generate a vulnerability exploit code system call list; S3. Calculate the score of each system call in the system call list of the vulnerability exploit code using the BM25 algorithm and collect its data; S4, marking data for each system call in the system call list of the vulnerability exploit code based on expert knowledge; S5. Train the XGBoost training model using the BM25 score, the collected data, and the data labels as a training set; S6, real-time model updates through online learning and incremental learning; S7. Sort all system calls according to the data tags and output the risk ranking in real time.

[0025] The present invention provides a method for generating a container system call risk assessment list by combining dynamic and static analysis and supplementing system calls to generate a container system call list. Figure 1 shown.

[0026] When executing step S1, the system call list generation is divided into five parts: (1) Extract binary files: Use dynamic tracing methods to extract the binary files corresponding to the actual running processes in the container, including applications, dynamic link libraries, and command line tools, as input for subsequent static analysis and dynamic analysis to extract system calls.

[0027] (2) Extract indirect system calls: By analyzing the source code of the corresponding version of the application to build a call graph, the system calls called by the program through library functions are extracted.

[0028] (3) Extracting direct system calls: By converting the extracted binary file into assembly code, the register value backtracing method is used to extract direct system calls from the three ways of calling system calls in the assembly code.

[0029] (4) Extracting the system calls of the operating environment: Using dynamic analysis methods combined with statistical research on commonalities, extract the system calls required to build the container isolation environment and initialize the program operating environment.

[0030] (5) Supplement system calls: Implement a crash loop mechanism, use test tools to test in the container running state, and supplement the system call whitelist based on the feedback crash information to make it more complete.

[0031] The flowchart of the method for generating a container system call risk assessment list by combining dynamic and static analysis to generate a vulnerability exploit code system call list is as follows: Figure 2 shown.

[0032] When executing step S2, vulnerability exploitation code related to container security threats is selected as a training dataset; on this basis, direct system calls are extracted by analyzing the compiler intermediate representation, and system calls indirectly called through library functions are extracted by constructing a library function call graph in the vulnerability exploitation code; and all system calls related to the container security vulnerability are obtained.

[0033] The present invention provides a method for generating a container system call risk assessment list by combining dynamic and static analysis. The flowchart of generating a risk ranking by using a vulnerability exploit code system call list is as follows: Figure 3 shown.

[0034] During step S3, the BM25 algorithm is used to calculate the score of each system call in the exploit code's system call list and collect its data as follows: After extracting the system calls from the exploit code, the BM25 algorithm is used to process the data obtained to calculate the corresponding BM25 score for each system call. The BM25 score here represents the importance of the system call relative to the container. The system call data collected from the exploit code includes the relevant process, system call name, parameters, call frequency, system call timestamp, etc.

[0035] The scoring formula of the BM25 algorithm is: , in It is a document and query The matching degree, is a word The frequency of the word in document d, It is a document The length of the document (typically the number of words in the document). avgdl is the average length of documents in the entire corpus. k1 is a constant that controls term frequency saturation, typically ranging from 1.2 to 2.0. b is a parameter that controls the effect of document length on the score, typically set to 0.75.

[0036] Term Frequency (TF): Indicates how often a word appears in a document. In BM25, the impact of term frequency is limited because if a word appears too frequently in a document, the algorithm will adjust to avoid overweighting it.

[0037] Inverse Document Frequency (IDF): measures the scarcity of a word in a document collection. The higher the IDF, the more the word distinguishes documents. The calculation formula is usually: , Where N is the total number of documents and n(w) is the number of documents containing word w. A higher IDF value indicates that the word is more discriminative.

[0038] During step S4, the system calls in the extracted vulnerability exploit code are labeled based on expert knowledge. We use a risk score as the label for the training dataset, with a score ranging from 0 to 1, for example, 0.1 for low risk and 0.9 for high risk. The scoring criteria can be constructed using known attack information (such as CVE vulnerabilities) and professional security knowledge.

[0039] During step S5, the XGBoost model is trained: the features (BM25 score, frequency, type, and parameters) of all system calls extracted from the exploit code, along with the risk score labels, are fed into the XGBoost model as a training set. After selecting appropriate hyperparameters within XGBoost, training is performed to produce a decision tree-based model. XGBoost optimizes the tree structure through multiple training runs, combining the features of all system calls to output the corresponding risk score.

[0040] XGBoost (eXtreme Gradient Boosting) is an efficient and scalable machine learning algorithm based on the Gradient Boosting Tree (GBT) framework. It was developed by Tianqi Chen et al.

[0041] XGBoost is a reinforcement learning (Boosting) algorithm that uses the Gradient Boosting method. It combines multiple weak learners (typically decision trees) into a single strong learner for prediction. Specifically, XGBoost gradually improves the model's predictive power by training multiple decision trees (typically of limited depth).

[0042] During step S6, when new data arrives (e.g., new exploit code updates), the model is gradually updated through online learning, without the need to retrain the entire model. Whenever a new attack sample appears, the model is updated in real time, adjusting the prediction results to accommodate the new attack pattern. Considering that if the data volume is too large to train all at once, which may lead to a continuous accumulation of system call data, the present invention adopts an incremental learning approach. By updating the model in batches, the model can be continuously optimized as new data arrives. With each update, only the newly added data needs to be trained, preserving the model's existing knowledge, thereby improving training efficiency.

[0043] Online learning is a learning method that incrementally updates a model as data streams in. Instead of seeing all the data at once, the model processes one example (or a mini-batch of examples) at a time, and after each update, the model immediately applies the new information. It is well-suited for scenarios involving large-scale data processing, real-time data streams, or datasets that change over time.

[0044] Incremental learning is a learning method in which a model continuously updates its existing knowledge based on new data, rather than retraining from scratch. Incremental learning generally refers to the model updating its existing knowledge as it receives new data, rather than completely discarding previous knowledge. Compared to online learning, incremental learning focuses more on gradually accumulating a model's knowledge.

[0045] During step S7, all system calls are sorted according to their risk scores, and a risk ranking is output. System calls with higher risk scores are ranked first, while those with lower risk scores are ranked last. When a new container instance runs, the system call data for that container is extracted and fed into the trained XGBoost model to predict the risk score, outputting the risk ranking in real time.

[0046] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A method for generating a container system call risk assessment list by combining dynamic and static analysis, characterized in that: The following steps are involved: Combine dynamic and static analysis and supplement system calls to generate a container system call list; The generating container system call list selects vulnerability exploit codes related to container security threats as a training data set to generate a vulnerability exploit code system call list; Calculate the score of each system call in the system call list of the vulnerability exploit code using the BM25 algorithm and collect its data; Marking data for each system call in the system call list of the vulnerability exploit code according to expert knowledge; Train the XGBoost training model using the BM25 score, the collected data, and the data labels as the training set; Real-time model updates through online learning and incremental learning; All system calls are sorted according to the data tags, and the danger ranking is output in real time.

2. According to the method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, it is characterized in that: The contents of combining dynamic and static analysis and supplementing system calls to generate a container system call list include: Use dynamic tracing methods to extract binary files corresponding to the actual running processes in the container, including applications, dynamic link libraries, and command line tools, as input for subsequent static analysis and dynamic analysis to extract system calls; By converting the extracted binary file into assembly code, the register value backtracing method is used to extract direct system calls from the three ways of calling system calls in the assembly code; Use dynamic analysis methods combined with statistical research to extract the system calls required to build container isolation environments and initialize program running environments; Implement a crash loop mechanism, use test tools to test in the running state of the container, and supplement the system call whitelist based on the feedback of crash information to make it more complete.

3. According to the method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, it is characterized in that: The steps of generating the system call list of the vulnerability exploit code include: Select vulnerability exploit codes related to container security threats as training data sets; Analyze the compiler intermediate representation to extract direct system calls; Constructing a call graph of library functions in the exploit code; Extract system calls indirectly called through library functions; Get all system calls related to container security vulnerabilities to generate a system call list of vulnerability exploit codes.

4. According to the method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, it is characterized in that: The content of the collected data includes: related processes, system call names, parameters, call frequencies, and system call timestamps.

5. According to the method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, it is characterized in that: When data is labeled for each system call in the system call list of the vulnerability exploit code based on expert knowledge, the risk score is used as the label of the training data set, and the score ranges from 0 to 1, with 0.1 being low risk and 0.9 being high risk. The scoring criteria are constructed based on known attack information and professional security knowledge.

6. According to the method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, it is characterized in that: When the XGBoost training model is trained, after selecting appropriate hyperparameters in XGBoost, training is performed to obtain a decision tree-based model. XGBoost optimizes the structure of the tree through multiple trainings and outputs the corresponding risk score in combination with the features of all system calls.

7. According to the method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, it is characterized in that: When the model is updated in real time through online learning and incremental learning, when new data arrives, the model is gradually updated through online learning without the need to retrain the entire model. The model is gradually updated, and whenever a new attack sample appears, the model is updated in real time and the prediction result is adjusted to adapt to the new attack pattern.

8. According to the method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, it is characterized in that: When the model is updated in real time through online learning and incremental learning, an incremental learning method is adopted to update the model in batches, and the model is continuously optimized as new data arrives.

9. According to the method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, it is characterized in that: The method of sorting all system calls is to sort all system calls according to the risk score of each system call and output a risk ranking.

10. The method for generating a container system call risk assessment list combining dynamic and static analysis according to claim 1, characterized in that: When all system calls are sorted according to the data tags and the risk ranking is output in real time, when a new container instance is running, the system call data of the container is extracted and input into the trained XGBoost model for risk score prediction, and its risk ranking is output in real time.

Images