Virtual machine mirror image static scanning method and system based on hyper-fusion platform

Abstract

The invention belongs to the technical field of virtual machine mirror image static scanning, and particularly relates to a virtual machine mirror image static scanning method and system based on a hyper-fusion platform, and the method comprises the steps: creating a to-be-scanned mirror image storage snapshot, employing an index and retrieval algorithm, obtaining a static virtual machine mirror image file, extracting and recording metadata information of the static virtual machine mirror image file, and then carrying out integrity verification; collecting all-around resource data of the hyper-fusion platform in real time, and distributing corresponding resource quotas for scanning tasks by using a preset algorithm; multi-stage deep scanning is carried out, file fingerprints and feature matching are firstly used for preliminary screening, then misjudgment is eliminated through version intelligent comparison, potential high-risk vulnerabilities are deeply excavated for key complex components by adopting static code analysis, and configuration files in mirror images are comprehensively examined through rapid screening and positioning of known malicious software; and a preset algorithm is used for carrying out deep classification arrangement, correlation analysis and summary statistics on various types of result data, so that virtual machine mirror image scanning in a large-scale hyper-fusion cluster is completed in a relatively short time.

Description

Technical Field

[0001] The present invention belongs to the technical field of virtual machine image static scanning, and in particular relates to a virtual machine image static scanning method and system based on a hyper-converged platform. Background Art

[0002] In today's era of surging digitalization, hyper-convergence platforms, relying on their excellent resource integration characteristics, cover the integration of computing, storage and network resources, and have become one of the core choices for many companies to build modern data centers and cloud computing infrastructure. As the fundamental template for building diversified virtual machine instances on the hyper-convergence platform, the security of virtual machine images undoubtedly occupies a pivotal position in the entire virtualization ecosystem.

[0003] With the continuous evolution of information technology, the forms of network security threats are becoming increasingly complex and varied, and traditional security protection measures for virtual machine images have gradually revealed many insurmountable limitations. In the complex and distributed environment architecture of the hyper-converged platform, existing scanning technologies often perform poorly in terms of scanning completeness, accuracy, rationality of resource utilization, and efficiency in dealing with large-scale static virtual machine image processing. This series of defects can easily cause virtual machines to suffer from severe security threats during the subsequent deployment and operation stages, such as malicious attackers using hidden vulnerabilities in the image to illegally invade, malware spreading through the image to destroy the stability and integrity of the entire system, and network security vulnerabilities caused by improper configuration leading to sensitive information leakage, etc., which bring immeasurable risks and losses to the business operations and data asset protection of enterprises.

[0004] Therefore, how to pre-emptively eliminate all kinds of potential security risks that may exist before virtual machines are deployed in a production environment and ensure that the virtualized environment supported by the hyper-converged platform can maintain a high level of security, stability, and compliance is a technical problem that urgently needs to be solved. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for static scanning of virtual machine images based on a hyper-converged platform, so as to pre-eliminate various potential security risks that may be hidden before the virtual machine is deployed in a production environment, and ensure that the virtualization environment supported by the hyper-converged platform can maintain a high degree of security, stability and compliance.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is as follows: A method for static scanning of virtual machine images based on a hyper-converged platform comprises the following steps: S1: Create a consistent snapshot of the image storage to be scanned through the image acquisition and preprocessing module, obtain static virtual machine image files based on hyper-integrated distributed nodes, use indexing and retrieval algorithms, extract and record their metadata information, perform multiple rounds of hash calculations on the virtual machine image files, and compare and verify them with the preset standard hash values; S2: The resource scheduling and monitoring module collects all-round resource data of the hyper-converged platform in real time, and uses the preset algorithm to allocate corresponding resource quotas for scanning tasks, including the optimal execution node of the scanning task, the allocation of CPU cores, the setting of memory capacity and network bandwidth limit; S3: Performs multi-stage deep scanning through the integrated scanning engine module, first screening with file fingerprints and feature matching, then eliminating misjudgments through intelligent version comparison, and finally using static code analysis to dig deep into potential high-risk vulnerabilities for key complex components. It quickly identifies and locates known malware through multi-dimensional feature extraction and analysis of various files in the virtual machine image, and conducts a comprehensive review of the configuration files in the image. S4: The result processing and report generation module comprehensively collects various result data generated by the scanning engine module during the scanning process, and uses the preset algorithm to deeply classify, organize, correlate and summarize the various result data.

[0007] Preferably, the specific process of creating a consistent snapshot of the image storage to be scanned by the image acquisition and preprocessing module in step S1 is as follows: S11: The image acquisition and preprocessing module receives an external startup instruction or activates the image acquisition and preprocessing module at a specified time node to start executing the task; S12: Generate a consistent snapshot for the target image storage when starting the collection by calling the snapshot creation interface provided by the distributed storage system; S13: Setting image index and retrieval based on hyper-converged distributed nodes, quickly locating and obtaining target images from massive static virtual machine images, obtaining image metadata information from distributed file image storage snapshot storage, filtering out specified index items from snapshot storage, obtaining image metadata information from snapshot storage, and using a preset hash algorithm to allocate node IDs and index item storage locations; S14: Create a distributed image scanning temporary storage file to store the image to be scanned, obtain a list of images to be scanned, record metadata information of the images to be scanned, determine the format of the images to be scanned, store the images in the newly created distributed image scanning temporary storage file, and perform image integrity calculation.

[0008] Preferably, the specific process of step S13 is as follows: S131: Obtain image metadata information from the distributed file image storage snapshot storage, and filter out key features including image name, creation time, and size as index items; S132: Using a preset hash algorithm to allocate node IDs and index item storage locations, each node generates a hash value as a node ID based on its own network address and hardware identification information; S133: For the index item, calculate its hash value, and map the index item to the corresponding node through the preset hash algorithm; S134: When a search request is received, multiple nodes are searched in parallel according to given query conditions to quickly locate the target image index.

[0009] Preferably, the specific process of step S14 is as follows: S141: Create a distributed image scanning temporary file to store the image to be scanned, obtain a list of images to be scanned, and capture key metadata including the image creation timestamp, version iteration information, image source, and last use time to formulate a scanning strategy; S142: Determine the image format to be scanned by reading the specified identifier and structure information in the image file header, wherein when the image format to be scanned is not in the QCOW2 format, when the image format is VMDK or RAW, start the corresponding lossless decompression and format conversion program to convert it into a unified QCOW2 format; S143: storing the image in the newly created distributed image scanning temporary file storage, and storing the QCOW2 image in the QCOW2 format and the processed non-QCOW2 format in the newly created distributed file storage location; S144: After the image acquisition, decompression, and conversion operations are completed and stored in the standard image cache, the integrity check of the system is started. For the QCOW2 format image, hash calculation is performed based on the image in the snapshot storage. For the non-QCOW2 format image, hash calculation is performed based on the QCOW2 format image converted from the image cache, and the calculated hash value is stored in the database as a reference value. S145: After a round of operations on the image, a hash value is calculated for the image, and the hash value of the current image is compared and verified with the pre-stored standard hash value. If the two are consistent, the image data is determined to be authentic and complete. If they are inconsistent, an alarm mechanism is triggered, and an alarm notification containing detailed information of the image identifier and the wrong hash value is sent to the operation and maintenance monitoring system.

[0010] Preferably, in step S2, the resource scheduling and monitoring module collects all-round resource data of the hyper-converged platform in real time, and uses a preset algorithm to allocate corresponding resource quotas to the scanning task. The specific process is as follows: S21: Deploy Node Exporter and Prometheus servers, use Node Exporter to collect various basic resource indicators of the hyper-converged platform nodes, and then use Prometheus servers to aggregate, store and query data to provide data support for subsequent processes; S22: The Prometheus server writes query statements using a specified query language, summarizes the resource data stored in the database at a specified time node, establishes a resource abundance scoring mechanism, determines the optimal cluster node for executing the scanning task based on the resource abundance scoring result, allocates corresponding CPU computing power to each scanning task based on the node CPU resource status and the complexity of the scanning task, and sets the memory capacity and network bandwidth; S23: assigning priorities to tasks according to task sources and task timeliness, creating task queues for all submitted scanning tasks based on task priorities, and assigning optimal execution nodes to each task in the task queue. According to the task queues, unloading tasks to the assigned optimal execution nodes in turn for processing; S24: Set multi-dimensional resource monitoring thresholds to monitor resource usage during task execution in real time, and use a preset scheduling algorithm to adjust and update the task scheduling strategy in real time.

[0011] Preferably, the specific process of step S3 is as follows: S31: Establish data connection with NVD and CVE databases, obtain the latest vulnerability information through regular data synchronization interfaces, clean data obtained from different sources, remove duplicate and invalid information, standardize the unified format, and extract key information including vulnerability number, vulnerability description, affected version range, and repair suggestions, integrate and store them into the local knowledge base, and build a unified data structure; S32: Set up a real-time monitoring component. When the NVD or CVE database releases an emergency security update or a major vulnerability is disclosed in the industry, the update process is immediately triggered to update the relevant information to the knowledge base within a specified time. S33: Through the initial screening of file fingerprints and feature matching, intelligent version comparison to eliminate misjudgment, and a progressive scanning method of key complex component code analysis, it comprehensively detects vulnerabilities from coarse-grained to fine-grained; S34: Build a malware feature recognition model, collect malware samples from public malware sample libraries and sample data shared by security agencies, extract multi-dimensional features from the samples, build feature vectors, and input them into the malware feature recognition model for training; S35: for various files in the virtual machine image to be scanned, the file hash value is calculated in sequence, the file header structure is parsed, and the semantic features of the code segment are extracted according to the feature extraction method in the training stage, a feature vector of the file to be detected is constructed, and the feature vector is input into the trained malware feature recognition model; S36: The malware feature recognition model outputs a malicious probability value for each file and compares it with a set probability threshold. When the probability value is greater than the threshold, the file is marked as suspected malware. S37: For suspected malware, intelligent feature matching technology based on machine learning models is used for verification. The model is trained based on typical feature patterns of known malware. The file features are matched with typical feature patterns including specified code segment sequences and file structure layouts. If the match is successful, the file is determined to be malware, and its location and type information in the image are recorded in detail to generate a malware identification report.

[0012] Preferably, the specific process of step S4 is as follows: S41: Establish an efficient data transmission interface between the scanning engine module and the result processing module, adopt a communication mechanism based on a message queue to enable real-time and stable data transmission, define a standardized data format, and the scanning engine outputs result data according to a unified structure; S42: Perform format check on the received data to determine whether it conforms to a predefined standard format. If not, feedback error information to the scanning engine module to request resending or correction. S43: Clean the received data, remove duplicate and redundant data records, and reasonably fill in the missing data of some key fields according to the distribution characteristics of the data and business knowledge. For the missing risk level fields of some vulnerabilities, fill in the missing data by inference based on the known risk levels of similar vulnerabilities and the relevant descriptions of the vulnerabilities. For those that cannot be filled, mark them as pending data and store them separately for subsequent manual processing; S44: Extract valuable features from raw data. For vulnerability data, extract vulnerability type, affected software components, and scanning tool features that discover vulnerabilities; for malware data, extract file hash values, propagation path features, infected system areas, and other features; for configuration defect data, extract configuration file types, user permission levels involved, and security policy category features, and combine the extracted features into a structured feature vector for use by subsequent algorithms; S45: The extracted feature vectors are classified into the categories of vulnerabilities, malware, and configuration defects, and each category is further subdivided, including vulnerabilities are classified into operating system vulnerabilities, application software vulnerabilities, and network protocol vulnerabilities; malware is classified into worms, Trojans, and viruses; configuration defects are classified into improper user permission configuration, encryption policy defects, and audit policy defects, forming a hierarchical classification system; S46: Look for combinations of vulnerabilities and malware that appear at the same time, and analyze whether there is malware that uses specific vulnerabilities to spread or attack; explore the relationship between configuration defects and vulnerabilities and malware, including whether over-configuration of user permissions makes it more vulnerable to specific types of malware attacks or vulnerability exploits; generate correlation analysis reports through correlation analysis.

[0013] Preferably, after step S46, the following process is also included: S47: Calculate basic statistics on the number and frequency of various vulnerabilities, malware, and configuration defects, and create risk rating models; S48: For each problem found by the scan, extract relevant feature information of the corresponding vulnerability, malware, and configuration defect, substitute it into the risk rating model to calculate and obtain the risk rating result, associate the risk rating result with the problem details and store it, and clearly mark the risk level of each problem in the database; S49: Configure multiple report templates in the template engine, define dynamic data filling areas in the template engine, associate them with the scan result data and risk rating information in the database, and convert the previously generated various visualization charts into pictures or HTML fragments based on the open source visualization chart library, embed them into the corresponding positions of the scan report, and generate targeted repair suggestions for vulnerabilities, malware, and configuration defects.

[0014] In a second aspect, a virtual machine image static scanning system based on a hyper-converged platform is provided, which is used to implement the virtual machine image static scanning method based on a hyper-converged platform, including an image acquisition and preprocessing module, a resource scheduling and monitoring module, a comprehensive scanning engine module and a result processing and report generation module, wherein the image acquisition and preprocessing module is connected to the resource scheduling and monitoring module, the resource scheduling and monitoring module is connected to the comprehensive scanning engine module, and the comprehensive scanning engine module is connected to the result processing and report generation module; The image acquisition and preprocessing module is used to create a consistent snapshot of the image storage to be scanned, based on the hyper-integrated distributed nodes, use the index and retrieval algorithm to obtain the static virtual machine image file, extract and record its metadata information, perform multiple rounds of hash calculations on the virtual machine image file, and compare and verify it with the preset standard hash value; The resource scheduling and monitoring module is used to collect all-round resource data of the hyper-converged platform in real time, and use a preset algorithm to allocate corresponding resource quotas for scanning tasks, including the optimal execution node of the scanning task, the allocation of CPU cores, the setting of memory capacity and network bandwidth limit; The comprehensive scanning engine module is used to perform multi-stage deep scanning, firstly screening by file fingerprint and feature matching, then eliminating misjudgment by intelligent version comparison, and finally using static code analysis to dig deep into potential high-risk vulnerabilities for key complex components, quickly identifying and locating known malware by performing multi-dimensional feature extraction and analysis on various files in the virtual machine image, and conducting a comprehensive review of the configuration files in the image; The result processing and report generation module is used to comprehensively collect various types of result data generated by the scanning engine module during the scanning process, and use a preset algorithm to perform in-depth classification, correlation analysis, and summary statistics on various types of result data.

[0015] The beneficial effects of the present invention include: The method and system for static scanning of virtual machine images based on a hyper-converged platform provided by the present invention create a storage snapshot of the image to be scanned, use an index and retrieval algorithm to obtain a static virtual machine image file, extract and record its metadata information, and then perform integrity verification; collect all-round resource data of the hyper-converged platform in real time, and use a preset algorithm to allocate corresponding resource quotas for scanning tasks; perform multi-stage deep scanning, first perform preliminary screening with file fingerprints and feature matching, then eliminate misjudgments through intelligent version comparison, use static code analysis to deeply explore potential high-risk vulnerabilities for key complex components, quickly identify and locate known malicious software, and conduct a comprehensive review of configuration files in the image; use a preset algorithm to perform in-depth classification, collation, correlation analysis, and summary statistics on various types of result data, thereby achieving the completion of virtual machine image scanning in a large-scale hyper-converged cluster in a relatively short time.

[0016] First, the static scanning architecture design of virtual machine images with deep integration of the hyper-converged platform covers the technical implementation of seamless connection and collaborative work of image acquisition, comprehensive scanning, resource scheduling, and result feedback with the hyper-converged platform, giving full play to the distributed, elastic, and integrated characteristics of the hyper-converged platform. By optimizing the image parsing process and intelligently scheduling resources, the present invention can complete the scanning of virtual machine images in large-scale hyper-converged clusters in a relatively short time, greatly shortening the waiting time.

[0017] Secondly, through the comprehensive scanning engine module, the construction of a multi-source fusion vulnerability knowledge base and multi-stage deep scanning technology, malware static detection, and configuration compliance fine detection, it is possible to quickly and efficiently identify malware, effectively reducing risks.

[0018] Finally, the resource scheduling and optimization module realizes rapid emergency response based on the intelligent prediction of real-time resource data of the hyper-converged platform, the optimization algorithm of the dynamic allocation strategy and the abnormal adjustment mechanism. The dynamic resource scheduling strategy ensures that the scanning task will not cause excessive burden on the normal operation of the hyper-converged platform and maintains a good performance level. With the help of advanced false alarm filtering mechanism, the present invention effectively reduces the number of false alarms, allowing administrators to focus more on truly important security issues. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a structural diagram of the virtual machine image static scanning system based on the hyper-converged platform of the present invention.

[0020] Figure 2 A schematic flow chart of a method for statically scanning a virtual machine image based on a hyper-converged platform of the present invention.

[0021] Figure 3 It is a flow chart of image acquisition and image preprocessing of the present invention.

[0022] Figure 4 This is a flow chart of the resource scheduling and monitoring module of the present invention.

[0023] Figure 5 It is a flow chart of the integrated scanning engine module of the present invention. DETAILED DESCRIPTION

[0024] The following is combined with Figure 1~Figure 5 The present invention is further described in detail: Example 1 See attached Figure 1-5 As shown, a static scanning method for a virtual machine image based on a hyper-converged platform includes the following steps: S1: Create a consistent snapshot of the image storage to be scanned through the image acquisition and preprocessing module. Based on the hyper-integrated distributed nodes, use the index and retrieval algorithm to obtain the static virtual machine image file, extract and record its metadata information, perform multiple rounds of hash calculations on the virtual machine image file, and compare and verify it with the preset standard hash value. Deeply integrate the distributed storage architecture of the hyper-converged platform. When starting the image acquisition process, first create a consistent snapshot of the image storage to be scanned to ensure the consistency and integrity of the data and avoid the impact of subsequent operations or dynamic changes in system operation on the scanning results. After the snapshot is generated, based on the hyper-integrated distributed nodes, use the index and retrieval algorithm to achieve agile acquisition of massive static virtual machine images. While acquiring the image, extract and record its metadata information, such as the image creation timestamp, version iteration information, etc., to provide a multi-dimensional decision-making basis for the subsequent scanning process.

[0025] S2: The resource scheduling and monitoring module collects all-round resource data of the hyper-converged platform in real time, and uses the preset algorithm to allocate corresponding resource quotas for the scanning task, including the optimal execution node of the scanning task, the allocation of CPU cores, the setting of memory capacity and network bandwidth restrictions. The resource scheduling and monitoring module fully considers the distributed characteristics of the hyper-converged platform and the need to execute parallel scanning tasks, collects all-round resource data of the hyper-converged platform in real time, and conducts all-round and dynamic monitoring and evaluation of the real-time utilization rate of platform node computing resources (CPU, memory), storage I / O load status, and network bandwidth utilization. Based on the above data, the most appropriate resource quota is allocated to the scanning task, including determining the optimal execution node of the scanning task, allocating the appropriate number of CPU cores, setting memory capacity and network bandwidth restrictions and other key parameters. At the same time, the module can intelligently arrange multiple mirror scanning tasks for parallel execution according to the real-time usage of platform resources. By comprehensively considering multiple factors such as task resource requirements and estimated execution time, the optimal parallel execution plan is formulated to ensure that the hyper-converged platform resources are maximized and the scanning process is accelerated without affecting the stability of the system.

[0026] S3: Performs multi-stage deep scanning through the integrated scanning engine module, first screening with file fingerprints and feature matching, then eliminating misjudgments through intelligent version comparison, and finally using static code analysis to dig deep into potential high-risk vulnerabilities for key complex components. It quickly identifies and locates known malware through multi-dimensional feature extraction and analysis of various files in the virtual machine image, and conducts a comprehensive review of the configuration files in the image. S4: The result processing and report generation module comprehensively collects various result data generated by the scanning engine module during the scanning process, and uses the preset algorithm to deeply classify, organize, correlate and summarize the various result data.

[0027] In this embodiment, all kinds of result data generated by the scanning engine module during the scanning process are comprehensively collected, and the result data are deeply classified, sorted, correlated and summarized using data mining and machine learning algorithms. A risk rating model is constructed based on multi-dimensional factors such as the type and degree of harm of the vulnerability, the propagation characteristics and destructive potential of malware, and the scope of influence and difficulty of repair of configuration defects. The model is used to accurately assess the risk and grade each problem found in the scan. For example, high-risk vulnerabilities that can directly lead to remote code execution, complete loss of control of system permissions, or large-scale leakage of sensitive data are rated as the highest risk level, and improper configuration problems that may only cause minor information leakage or have a minor impact on system performance are rated as low risk levels.

[0028] Based on the scan result data and risk rating information, the template engine and data visualization technology are used to generate a detailed and intuitive scan report. The report content not only covers the basic information of the virtual machine image (such as name, unique identifier, etc.), the start and end time of the scan task, the details of the scan result (classified and listed in detail according to categories such as vulnerabilities, malware, configuration defects, etc.), the risk rating results and professional repair suggestions for each specific problem, but also provides experience references based on historical repair cases of similar problems and value-added information such as post-repair effect prediction analysis. The scan report supports generation and output in a variety of common formats (such as HTML, PDF, etc.) to meet the diverse needs of different user groups and application scenarios. At the same time, this module also has the function of exporting result data, which can seamlessly export the scan result data to other security management systems, work order management systems or the enterprise's internal big data analysis platform, so as to carry out subsequent repair process tracking and monitoring, security situation analysis and data mining and utilization operations.

[0029] Example 2 Based on Example 1, the specific process of creating a consistent snapshot of the image storage to be scanned by the image acquisition and preprocessing module in step S1 is as follows: S11: The image acquisition and preprocessing module receives an external startup instruction or activates the image acquisition and preprocessing module at a specified time node to start executing the task; S12: Generate a consistent snapshot for the target image storage when starting the collection by calling the snapshot creation interface provided by the distributed storage system; S13: Setting image index and retrieval based on hyper-converged distributed nodes, quickly locating and obtaining target images from massive static virtual machine images, obtaining image metadata information from distributed file image storage snapshot storage, filtering out specified index items from snapshot storage, obtaining image metadata information, and using a preset hash algorithm to allocate node IDs and index item storage locations; S14: Create a distributed image scanning temporary storage file to store the image to be scanned, obtain a list of images to be scanned, record metadata information of the images to be scanned, determine the format of the images to be scanned, store the images in the newly created distributed image scanning temporary storage file, and perform image integrity calculation.

[0030] In this embodiment, the specific process of step S13 is as follows: S131: Obtain image metadata information from the distributed file image storage snapshot storage, and filter out key features including image name, creation time, and size as index items; S132: Using a preset hash algorithm to allocate node IDs and index item storage locations, each node generates a hash value as a node ID based on its own network address and hardware identification information; S133: For the index item, calculate its hash value, and map the index item to the corresponding node through the preset hash algorithm; S134: When a search request is received, multiple nodes are searched in parallel according to given query conditions to quickly locate the target image index.

[0031] The specific process of step S14 is as follows: S141: Create a distributed image scanning temporary file to store the image to be scanned, obtain a list of images to be scanned, and capture key metadata including the image creation timestamp, version iteration information, image source, and last use time to formulate a scanning strategy; S142: Determine the image format to be scanned by reading the specified identifier and structure information in the image file header, wherein when the image format to be scanned is not in the QCOW2 format, when the image format is VMDK or RAW, start the corresponding lossless decompression and format conversion program to convert it into a unified QCOW2 format; S143: storing the image in the newly created distributed image scanning temporary file storage, and storing the QCOW2 image in the QCOW2 format and the processed non-QCOW2 format in the newly created distributed file storage location; S144: After the image acquisition, decompression, and conversion operations are completed and stored in the standard image cache, the integrity check of the system is started. For the QCOW2 format image, hash calculation is performed based on the image in the snapshot storage. For the non-QCOW2 format image, hash calculation is performed based on the QCOW2 format image converted from the image cache, and the calculated hash value is stored in the database as a reference value. S145: After a round of operations on the image, a hash value is calculated for the image, and the hash value of the current image is compared and verified with the pre-stored standard hash value. If the two are consistent, the image data is determined to be authentic and complete. If they are inconsistent, an alarm mechanism is triggered, and an alarm notification containing detailed information of the image identifier and the wrong hash value is sent to the operation and maintenance monitoring system.

[0032] In this embodiment, the start instruction of the entire module operation is first initiated, triggering a subsequent series of collection and preprocessing operations for the virtual machine image. The system receives external instructions or activates the image collection and preprocessing module to start executing tasks according to preset timed tasks.

[0033] With the help of the distributed files of the hyper-converged platform, a consistent snapshot is generated for the target image storage when the collection is started. Use write-time copy to ensure that the image data is completely "frozen" at the moment the snapshot is created. No matter whether the processing flow of the module itself changes or the dynamic update and modification during the operation of the system, it will not interfere with the consistency and integrity of the original image data, thereby providing a reliable data foundation for subsequent scans and ensuring the authenticity of the scan results. Trigger the snapshot generation operation by calling the snapshot creation interface provided by the distributed storage system. Set up image indexing and retrieval based on the hyper-converged distributed nodes, and use the constructed indexing and retrieval system to quickly locate and obtain the target image in massive static virtual machine images, shorten the acquisition time, improve overall efficiency, and ensure the timely advancement of subsequent processes.

[0034] The image collection and preprocessing module mainly includes building a distributed index module, retrieving an image module, as well as a consistency algorithm module and Bloom filter description.

[0035] Construct a distributed index module to obtain image metadata information from the distributed file image storage snapshot storage for easy retrieval. Filter out key features such as image name, creation time, size, etc. as index items. Use the consistent hashing algorithm to allocate node IDs and index item storage locations. Each node generates a hash value as the node ID based on its own network address, hardware identification and other comprehensive information. For index items, their hash values ​​are also calculated, and the index items are mapped to the corresponding nodes through the consistent hashing algorithm. Compared with traditional modulo operations, this method can effectively reduce the amount of data migration and ensure the stability of the system when nodes are dynamically increased or decreased. For example, when a new node is added, only a small number of index items need to be reallocated.

[0036] The image retrieval module searches multiple nodes in parallel according to the given query conditions to quickly locate the target image index. When a search request is received, whether it is a precise search by image name or a filter by time period, the system first searches in the global index cache. The global index cache stores the index items that have been frequently accessed recently and the corresponding node location information. If a hit is found, a search request is directly initiated to the corresponding node, greatly speeding up the initial response speed. After each node receives the search request, it uses the local Bloom filter to quickly exclude the index area where the target image definitely does not exist. The Bloom filter is built based on the hash value of the index item, and can efficiently determine whether an element is in the set with minimal memory usage, avoiding invalid searches. Then, the node compares and filters the search conditions based on the locally stored index items to find the image set that meets the conditions, and finally summarizes the results of each node to obtain the search result set.

[0037] The consistency algorithm module is described by the image name to build a 0~2^32-1 consistent hash ring: Assume that the hyper-integrated platform contains 4 nodes, and the node identifiers are HNode1, HNode2, HNode3, and HNode4, and their corresponding network addresses are "192.168.12.101", "192.168.12.102", "192.168.12.103", and "192.168.12.104".

[0038] The MurmurHash function is used to perform hash calculations on these node identifiers, and the results are mapped to the range of 0~2^32-1. For HNode1, MurmurHash ("192.168.12.101") is converted (according to the binary sequence output by the MurmurHash function, it is converted to the range of 0~2^32-1 according to the unsigned integer rule, and the accuracy is ensured by the underlying logic of the function), and the hash value is assumed to be 35000000. Similarly, the "192.168.12.102" of HNode2 is calculated to obtain a hash value of 800000000, HNode3 is 125000000, and HNode4 is 180000000. These node hash values ​​are arranged in a virtual ring space in ascending order, and the range of the ring space is 0~2^32-1. In this way, a basic consistent hash ring is constructed, and each server node occupies a specific position on the ring, which provides a basis for subsequent data storage allocation.

[0039] Assign index items to nodes: There are a large number of virtual machine images in the system that need to be stored and managed. These images use names as key identifiers. For example, there are several typical image names: "webserver_vm_001.qcow2", "dbserver_vm_002.vmdk", "appserver_vm_003.raw", etc. The MurmurHash function is also used to hash these image names and map them to the range of 0~2^32-1. Assume that "webserver_vm_001.qcow2" is calculated and converted by the MurmurHash function to obtain a hash value of 60000000, "dbserver_vm_002.vmdk" is obtained by hashing the value 100000000, and "appserver_vm_003.raw" is obtained by hashing the value 150000000.

[0040] Mapping of image names to hyper-integrated nodes: According to the consistent hashing algorithm rules, starting from the corresponding position of the hash value of each image name on the ring, search in a clockwise direction to find the first node hash value greater than or equal to the hash value. The corresponding hyper-integrated platform node is the location where the image metadata is stored. For example, for "webserver_vm_001.qcow2", its hash value is 60000000. The first node hash value greater than or equal to it found clockwise is 80000000 (HNode2), so the image metadata of "webserver_vm_001.qcow2" will be stored on HNode2. The hash value of "dbserver_vm_002.vmdk" is 100000000. The first node hash value greater than or equal to it found clockwise is 125000000 (HNode3), so its related image metadata is stored on HNode3. The hash value of "appserver_vm_003.raw" is 150000000. The first node hash value that is greater than or equal to it is 180000000 (HNode4), so its related image metadata is stored on HNode4.

[0041] The retrieval and data acquisition process based on consistent hashing is as follows: Client retrieval request processing: When the client initiates a request to retrieve a specific image, whether the request is based on an accurate search based on the image name or based on other associated conditions (provided that these conditions can be associated with a specific image name), the client first needs to use the MurmurHash function to perform a hash calculation on the key retrieval information (such as the image name), and map the result to the range of 0~2^32-1. For example, if you want to retrieve the image "webserver_vm_001.qcow2", first calculate its hash value 60000000 (consistent with the calculation when storing).

[0042] Locate the index storage node and obtain data: Based on the established rules of the consistent hashing ring, starting from the hash value, quickly locate the hyper-integrated platform node that may store the target image metadata in a clockwise direction. In this example, search clockwise from the position corresponding to 60000000 to locate HNode2 as the node that may store the target image index. The client then sends a data acquisition request to HNode2, and HNode2 searches for the image metadata "webserver_vm_001.qcow2" in the local storage area and returns the result to the client. Make full use of the efficient characteristics of the consistent hashing algorithm to ensure the speed and accuracy of image index retrieval and acquisition, and improve the operating efficiency of the entire distributed system.

[0043] Bloom filter example: Assume that there is a hyper-integrated node that stores 1,000 index items locally, covering various image-related information. To build a Bloom filter, first determine the appropriate number of hash functions (assuming MurmurHash, FNV1a hash, BKDR hash) and the number of Bloom filter bits (assuming 10,000 bits, determined based on factors such as data volume and false positive rate).

[0044] For each index item, such as "webserver_vm_001.qcow2", the hash value is calculated using these three hash functions: MurmurHash("webserver_vm_001.qcow2") = 12345678 (corresponding to the 12345678th bit of the Bloom filter, set this bit to 1); FNV1a hash ("webserver_vm_001.qcow2") = 98765432 (same process, 98765432 % 10000 = 5432, set bit 5432 to 1); BKDR hash("image_file_001") = 43219876 (43219876 % 10000 = 9876, set bit 9876 to 1); When a search request is received to find an image named "search_image.qcow2", the same three hash functions are used to calculate the hash value of "search_image.qcow2": MurmurHash("search_image.qcow2") = 65432109; FNV1a hash("search_image.qcow2") = 87654321; BKDR hash("search_image.qcow2") = 32109876; Check the corresponding three bits in the Bloom filter: 65432109 % 10000 = 2109, 87654321 % 10000 = 4321, 32109876 % 10000 = 9876. If any one of them is 0, it can be determined that "search_image.qcow2" is definitely not in the locally stored index items and is directly excluded to avoid invalid retrieval. Only when these three bits are all 1, the subsequent detailed index comparison and screening process is entered, which greatly improves the retrieval efficiency and achieves efficient pre-filtering with extremely small memory usage (10,000 bits, about 1.2KB).

[0045] Create a distributed image scanning temporary file storage to store the images to be scanned and obtain the list of images to be scanned, regardless of whether the request is based on precise search based on image name or filtering based on other related conditions.

[0046] Record the metadata information of the image to be scanned, and capture key metadata such as the image creation timestamp, version iteration information, the image source (from which source virtual machine it was cloned), and the last time it was used. This information can provide a reference for subsequent scanning processes, such as predicting the scope of possible vulnerabilities based on version iterations, assisting in analyzing the historical evolution of the image based on the creation timestamp, and tracing the source of the problem in combination with the source information, helping the scanning strategy to be more targeted and improving scanning efficiency and accuracy.

[0047] By parsing the metadata storage area inside the image file (images of different formats have different metadata storage methods, such as QCOW2 images have relevant records in the file header or specific metadata blocks, and VMDK images also have their fixed metadata storage structure), use the corresponding parsing tools or library functions to read and extract the required metadata information, provide support for subsequent operations, and store it in the local database for subsequent use.

[0048] Determine the image format to be scanned: Since virtual machine images exist in a variety of storage formats, in order to unify the processing flow, it is necessary to accurately identify the image format. By reading the specified identifier and structure information in the image file header, determine whether it is QCOW2, VMDK, RAW or other formats, and provide a decision basis for subsequent format conversion.

[0049] Start the corresponding lossless decompression and format conversion program under specified circumstances. When it is determined that the image is not in QCOW2 format, such as VMDK format, start the corresponding lossless decompression and format conversion program (with the help of tools such as qemu-img) to convert it to a unified QCOW2 format, ensuring that the subsequent scanning process does not need to be adapted separately for different formats, simplifying the process and improving compatibility, ensuring smooth scanning.

[0050] Take the conversion using qemu-img tool as an example. Run the following command in Linux system to complete the conversion: qemu-img convert -f vmdk -O qcow2input.vmdk output.qcow2; Store the image in the newly created distributed image scanning temporary file storage, and store the qcow2 format and processed non-qcow2 images in the newly created distributed file storage location for use in subsequent scanning processes, thereby achieving centralized management and efficient use of image data.

[0051] Image integrity calculation: To prevent image data from being damaged due to unexpected errors during storage transmission or scanning, the system integrity check module starts after image acquisition, decompression, conversion and other operations are completed and stored in the standard image cache. For qcow2 format images, hash calculation is performed based on the image in the snapshot storage. For non-qcow2 format images, hash algorithm calculation is performed based on the qcow2 format image converted from the image cache. At the same time, the calculated hash value is stored in the database as a reference value.

[0052] After a round of operations (such as scanning) on ​​the image, the image needs to be hashed and finally the hash value of the current image is compared with the pre-stored standard hash value for verification. If the two are completely matched, it indicates that the image data is authentic and complete. If there is a difference, the alarm mechanism is triggered and an alarm notification containing detailed information such as the image ID and the wrong hash value is sent to the operation and maintenance monitoring system.

[0053] Hash algorithm implementation logic: In the first round, the hash values ​​are calculated one by one in data blocks of a fixed size of 4KB. The formula is: H = sha256(Mi), where H is the hash value of data block Mi, and i represents the i-th data block. Using the hash calculation library function (such as the sha256 calculation function provided by OpenSSL, the memory address of the data block is passed as a parameter when calling the function), the memory address of each data block is passed into the function to obtain the corresponding hash value. Subsequently, all the data block hash values ​​are concatenated into a string in sequence, and the SHA-256 calculation is performed again to obtain the final image hash value Hfinal.

[0054] Example 3 On the basis of Example 1 or Example 2, in step S2, the resource scheduling and monitoring module collects all-round resource data of the hyper-converged platform in real time, and uses the preset algorithm to allocate corresponding resource quotas for the scanning task. The specific process is as follows: S21: Deploy Node Exporter and Prometheus servers, use Node Exporter to collect various basic resource indicators of the hyper-converged platform nodes, and then use Prometheus servers to aggregate, store and query data to provide data support for subsequent processes; S22: The Prometheus server writes query statements using a specified query language, summarizes the resource data stored in the database at a specified time node, establishes a resource abundance scoring mechanism, determines the optimal cluster node for executing the scanning task based on the resource abundance scoring result, allocates corresponding CPU computing power to each scanning task based on the node CPU resource status and the complexity of the scanning task, and sets the memory capacity and network bandwidth; S23: assigning priorities to tasks according to task sources and task timeliness, creating task queues for all submitted scanning tasks based on task priorities, and assigning optimal execution nodes to each task in the task queue. According to the task queues, unloading tasks to the assigned optimal execution nodes in turn for processing; S24: Set multi-dimensional resource monitoring thresholds to monitor resource usage during task execution in real time, and use a preset scheduling algorithm to adjust and update the task scheduling strategy in real time.

[0055] Deploy Node Exporter and Prometheus server: Use Node Exporter to collect various basic resource indicators of the hyper-converged platform nodes, and then use Prometheus to aggregate, store and query data to provide data support for subsequent processes. Install NodeExporter on each node of the hyper-converged platform and set it to start automatically at startup so that it can continuously collect node resource data. Install and configure the Prometheus server, and specify the target nodes to be monitored in the configuration file, that is, all cluster nodes of the hyper-converged platform. Start the Prometheus server, which will send data collection requests to the Node Exporter of each node at the configured time interval (default 15 seconds) to obtain resource data.

[0056] Collect node computing resource usage: Understand the CPU and memory usage, so as to judge the resource margin later and allocate scanning task nodes reasonably. Prometheus collects CPU usage indicators by sending requests to Node Exporter. In the query interface of Prometheus or through its API, use the node_cpu_usage_seconds_total indicator to obtain the cumulative CPU usage time of each node, and calculate the current CPU usage rate by combining information such as system startup time. The acquired data is stored in the time series database of Prometheus in the form of time series. The record format is similar to: {node ID: [timestamp 1, CPU usage 1], [timestamp 2, CPU usage 2],...}, where the node ID can correspond to the node's IP address or custom name for subsequent identification.

[0057] For memory usage, the node_memory_MemTotal_bytes and node_memory_MemUsed_bytes indicators are used to obtain the total capacity and used amount of the node memory respectively. The real-time usage is obtained through simple calculation and is also stored in the Prometheus database. The storage format is similar: {node ID: [timestamp 1, memory usage 1], [timestamp 2, memory usage 2], ...}.

[0058] Monitor storage I / O load: Understand the busyness of storage devices, avoid delays in scanning tasks due to storage I / O bottlenecks, and ensure efficient execution of tasks. Node Exporter cooperates with storage driver plug-ins to collect storage I / O indicators. Prometheus obtains indicator data such as node_disk_io_time_seconds_total (accumulated time consumed by disk I / O operations), node_disk_read_bytes_total (accumulated number of bytes read from disk), and node_disk_write_bytes_total (accumulated number of bytes written to disk) through configured collection rules. Classify and store them in the Prometheus database according to nodes and storage devices, for example: {node ID: {storage device ID 1: [timestamp 1, IOPS 1, read and write bandwidth 1], [timestamp 2, IOPS2, read and write bandwidth 2], ...}, storage device ID 2: [...]}}, where indicators such as IOPS can be obtained by further calculation of related indicator data, such as estimating read and write bandwidth based on read and write bytes and time interval.

[0059] Track network bandwidth utilization: Ensure that the network resources allocated to the scanning task are reasonable, do not affect the network communication of other services on the platform, and meet the data transmission requirements of the scanning task. Node Exporter uses network interface statistics to collect network inbound and outbound traffic data, and Prometheus obtains relevant indicators such as node_network_receive_bytes_total (accumulated number of bytes received by the network) and node_network_transmit_bytes_total (accumulated number of bytes sent by the network). Combined with the bandwidth configuration information of the node network interface (which can be pre-configured in Prometheus or obtained from other configuration management systems), the network bandwidth utilization is calculated. The storage format is: {node ID: [timestamp 1, network bandwidth utilization 1], [timestamp 2, network bandwidth utilization 2],...}, stored in the Prometheus database.

[0060] Evaluation and task resource allocation based on collected data, data aggregation and analysis: Prometheus provides a powerful query language, PromQL, which can be used to write query statements and summarize resource data stored in the database at regular intervals (such as every 1 minute). For example, the average CPU usage of each node in the past 5 minutes can be calculated through a statement like avg_over_time(node_cpu_usage_seconds_total[5m]). It can also calculate key statistics such as the peak and average of storage I / O load, and the average of network bandwidth utilization. These summary data are stored in a database table dedicated to task scheduling for subsequent quick access.

[0061] Determine the optimal cluster node for executing the scan task: Find nodes with relatively abundant resources and the most suitable for executing scanning tasks, improve task execution efficiency, and reduce resource competition. Set resource abundance scoring rules, such as assigning certain weights (such as 0.3, 0.3, 0.2, 0.2) to each node's CPU, memory, storage I / O, and network bandwidth, and score them based on the resource statistics of each node obtained through summary analysis. Use PromQL combined with weights to calculate node scores. The calculation formula can be: Node score = CPU average usage weight × (1 - CPU average usage) + memory average usage weight × (1 - memory average usage) + storage I / O load average weight × (1 / (1 + storage I / O load average)) + network bandwidth utilization average weight × (1 - network bandwidth average utilization). The average usage rate and other indicators here are obtained through PromQL query to obtain real-time data for calculation. Sort the nodes according to the score, and select several nodes with the highest scores (determined by the number of scanning tasks) as candidate execution nodes.

[0062] Allocate CPU cores: Allocate appropriate CPU computing power to each scanning task based on the node CPU resource status and the complexity of the scanning task to ensure the smooth progress of the task. Estimate the CPU requirements of different types of scanning tasks and establish a mapping table between task types and CPU core requirements. For example, set 2 cores for simple file scanning tasks and 4 cores for complex system vulnerability scanning tasks.

[0063] Set memory capacity: Provide enough memory space for scanning tasks to prevent tasks from being stuck or failing due to insufficient memory, and avoid wasting memory. Similar to CPU core allocation, estimate memory requirements based on the type of scanning task, such as setting 4GB of memory for small image scanning and 8GB of memory for large and complex image scanning, to form a memory requirement mapping table. Consider the node memory usage rate. If the current node memory usage rate is less than 50%, allocate it in full according to demand; if it is higher than 80%, appropriately compress the allocation amount (such as allocating according to 60% demand) and record the allocation status: {scanning task ID: [execution node ID, allocated memory capacity]}.

[0064] Set network bandwidth limits: While meeting the data transmission requirements of the scanning task, ensure the network smoothness of other services on the platform and avoid network congestion. Analyze the data transmission characteristics of the scanning task and estimate the required network bandwidth, such as based on factors such as the image size. For regular image scanning tasks, set a bandwidth of 100Mbps; for deep scanning of large data volumes, set a bandwidth of 500Mbps. Combined with the current network bandwidth utilization of the node, if the utilization is less than 40%, allocate the estimated bandwidth in full; if it is higher than 60%, reduce it by a certain proportion (such as 70% of the estimated bandwidth) and record: {Scanning task ID: [Execution node ID, allocated network bandwidth]}. At the network level, use the software-defined networking (SDN) function of the hyper-converged platform to set traffic policies or QoS (Quality of Service) rules to limit the network traffic of the scanning task to ensure that the bandwidth allocation meets the requirements.

[0065] Intelligent parallel task scheduling, task queuing and priority setting: All submitted scanning tasks enter the task queue. The system assigns a priority value (such as 1-10, 10 is the highest priority) to each task based on factors such as the source of the task (such as the system critical update scanning task has a high priority, and the daily scanning task initiated by ordinary users has a low priority), task timeliness requirements (urgent tasks have a high priority), etc. The task queue is sorted from high to low according to priority, and the task submission time is recorded at the same time, so that when the priority is the same, it is executed in a first-come, first-served order. Use a memory queue structure to store task queue information to ensure efficient queue entry and exit operations.

[0066] Formulate a parallel execution plan: Starting from the head of the task queue, select tasks in turn, and formulate a detailed execution schedule based on the determined optimal execution node and resource allocation. For example, task 1 starts execution on node A at 10:00, with an estimated execution time of 30 minutes; task 2 starts execution on node B at 10:05, with an estimated execution time of 40 minutes, etc., to form an execution plan list: {scan task ID: [execution node ID, start time, estimated execution time]}. By collaborating with the task scheduling system, the execution plan is sent to each execution node to ensure that the task starts on time. When scheduling tasks, the parallel carrying capacity of node resources is fully considered to avoid excessive concentration of tasks on the same node leading to resource exhaustion. By simulating the execution of different task combinations on the node, the execution plan is optimized to ensure maximum resource utilization. Some scheduling algorithm simulation tools or analysis models based on historical data can be used to assist decision-making and continuously adjust task scheduling strategies.

[0067] Resource monitoring and dynamic adjustment, real-time resource consumption tracking: Keep an eye on the resource usage during the execution of the scanning task, discover potential problems in a timely manner, and provide data support for dynamic adjustment. At the set time interval (such as every 10 seconds), use PromQL to query the Prometheus database again to obtain the actual CPU, memory, storage I / O, and network bandwidth usage of the scanning task on each execution node, and compare it with the allocated resource quota. Update the real-time resource consumption data to the task execution status monitoring table in the format of: {Scanning task ID: [Execution node ID, current CPU usage, current memory usage, current storage I / O load, current network bandwidth utilization]}. This monitoring table is an in-memory data structure used to display the task resource consumption status in real time, facilitating subsequent early warning judgment.

[0068] Threshold judgment and early warning: detect abnormal resource consumption in advance and take timely measures to prevent impact on normal platform business. Set multi-dimensional resource monitoring thresholds, such as a CPU usage threshold of 90%, a memory usage threshold of 95%, a storage I / O load peak threshold of 1,000 reads and writes per second, and a network bandwidth utilization threshold of 90%. When a resource usage indicator of a scan task exceeds the corresponding threshold, the early warning mechanism is immediately triggered to send an alert message to the system administrator, including detailed information such as the task ID, the type of resource that exceeds the standard, and the current resource usage value. You can integrate with the monitoring system (such as Prometheus's own Alertmanager) to configure alert rules and implement automated alert notifications to ensure that administrators can respond in a timely manner.

[0069] Dynamic resource adjustment strategy: If the CPU usage rate exceeds the standard, suspend the execution of non-critical tasks that can be suspended to release CPU resources. For critical tasks that are running, try to transfer part of their computing load to other idle nodes, and realize dynamic migration of tasks through the distributed computing framework; when the memory is insufficient, first try to reclaim the cache resources occupied by the task. If it is still insufficient, suspend some low-priority tasks in order of priority to release memory. At the same time, for problems such as memory leaks, start the memory optimization program to repair them. By combining with the memory management tool jemalloc, detect memory usage, perform memory analysis and optimization for tasks suspected of memory leaks, or directly restart related tasks to release memory; if the storage I / O load is too high, adjust the storage access strategy of the scanning task, such as increasing the data read cache, optimizing the data write order, and reducing the frequent reading and writing of small data blocks. If the problem is serious, suspend the relevant tasks and wait for the storage load to ease; if the network bandwidth is tight, reduce the data transmission frequency of the scanning task, such as extending the data synchronization interval, giving priority to key business network needs, and suspending the network transmission of non-urgent tasks when necessary. By modifying the configuration parameters of the scanning task (such as the transmission interval) or adjusting the QoS rules at the network level, the network bandwidth usage of non-critical tasks can be limited to ensure smooth operation of the critical business network.

[0070] Troubleshooting and optimization repair: Analyze the root cause of resource anomalies, solve problems, and improve system stability and task execution efficiency. When resource anomalies trigger an early warning, the system automatically starts the troubleshooting program, collects relevant log information (including task execution logs, system resource monitoring logs, node hardware logs, etc.), and uses data analysis tools to locate the root cause of the problem, such as whether there is a program deadlock that causes high CPU usage, memory leaks, storage device failures that cause I / O anomalies, network congestion nodes, etc. With the help of some log analysis platforms (such as ELK Stack), logs can be quickly retrieved and analyzed to find clues to the problem. According to the troubleshooting results, targeted optimization and repair measures are taken. For software problems, such as updating defective code modules and adjusting task configuration parameters; for hardware problems, promptly notify the operation and maintenance personnel to replace or repair the hardware, and adjust the task allocation strategy to avoid faulty nodes. Throughout the process, a detailed problem tracking record should be established to facilitate subsequent review and continuous optimization of system performance.

[0071] Example 4 On the basis of Example 1 or Example 2 or Example 3, the specific process of step S3 is as follows: S31: Establish data connection with NVD and CVE databases, obtain the latest vulnerability information through regular data synchronization interfaces, clean data obtained from different sources, remove duplicate and invalid information, standardize the unified format, and extract key information including vulnerability number, vulnerability description, affected version range, and repair suggestions, integrate and store them into the local knowledge base, and build a unified data structure; S32: Set up a real-time monitoring component. When the NVD or CVE database releases an emergency security update or a major vulnerability is disclosed in the industry, the update process is immediately triggered to update the relevant information to the knowledge base within a specified time. S33: Through the initial screening of file fingerprints and feature matching, intelligent version comparison to eliminate misjudgment, and a progressive scanning method of key complex component code analysis, it comprehensively detects vulnerabilities from coarse-grained to fine-grained; S34: Build a malware feature recognition model, collect malware samples from public malware sample libraries and sample data shared by security agencies, extract multi-dimensional features from the samples, build feature vectors, and input them into the malware feature recognition model for training; S35: for various files in the virtual machine image to be scanned, the file hash value is calculated in sequence, the file header structure is parsed, and the semantic features of the code segment are extracted according to the feature extraction method in the training stage, a feature vector of the file to be detected is constructed, and the feature vector is input into the trained malware feature recognition model; S36: The malware feature recognition model outputs a malicious probability value for each file and compares it with a set probability threshold. When the probability value is greater than the threshold, the file is marked as suspected malware. S37: For suspected malware, intelligent feature matching technology based on machine learning models is used for verification. The model is trained based on typical feature patterns of known malware. The file features are matched with typical feature patterns including specified code segment sequences and file structure layouts. If the match is successful, the file is determined to be malware, and its location and type information in the image are recorded in detail to generate a malware identification report.

[0072] In this embodiment, the comprehensive scanning engine module includes a vulnerability detection submodule, a malware identification submodule and a configuration compliance review submodule. Through the vulnerability detection submodule, a multi-source fusion and real-time updated vulnerability knowledge base is created, including the authoritative database NVD, CVE, and industry cutting-edge research. Through continuous data collection and analysis, it is ensured that the knowledge base always keeps up with the latest developments in the security field and provides solid data support for vulnerability scanning. At the same time, a multi-stage deep scan is implemented: first, the file fingerprint and feature matching are used for preliminary screening, then the version intelligent comparison is used to eliminate misjudgment, and finally, static code analysis (symbolic execution, taint analysis, etc.) is used for key complex components to dig deep into potential high-risk vulnerabilities. Malware identification submodule: Use deep learning algorithms to conduct deep training and learning on massive malware samples, and build a highly accurate and powerful generalization malware feature recognition model. Through multi-dimensional feature extraction and analysis of various files in the virtual machine image, including but not limited to file hash value calculation, file header structure analysis, code segment semantic feature extraction, and intelligent feature matching based on machine learning models, the rapid identification and positioning of known malware is achieved.

[0073] Configuration compliance review submodule: deeply analyze various configuration files in the virtual machine image, use syntax and semantic fusion analysis technology to conduct a comprehensive review of the configuration files in the image, and focus on the two core areas of user permission configuration and security policy configuration. In terms of user permission review, strictly follow the principle of least privilege, and evaluate whether the permissions of each user exceed the minimum required for their work by carefully analyzing the correspondence between user accounts and permissions. For example, check the / etc / passwd, / etc / shadow and other files in the Linux system in detail, accurately identify user accounts with excessive permissions (such as unnecessary root permissions or administrator permissions), and passwords that are too simple or empty passwords, to ensure that user permission configuration eliminates security risks from the source. In terms of security policy review, for encryption policies, carefully check whether the strength of the encryption algorithm meets the current security standards and whether the management of encryption keys is standardized and rigorous. For audit policies, ensure that audit logs can comprehensively and accurately record key operation events, such as user logins, important file access, etc., so that when security incidents occur, the source can be quickly traced, providing solid protection for security audits and data protection.

[0074] Example 5 On the basis of Example 1 or Example 2 or Example 3 or Example 4, the specific process of step S4 is as follows: S41: Establish an efficient data transmission interface between the scanning engine module and the result processing module, adopt a communication mechanism based on a message queue to enable real-time and stable data transmission, define a standardized data format, and the scanning engine outputs result data according to a unified structure; S42: Perform format check on the received data to determine whether it conforms to a predefined standard format. If not, feedback error information to the scanning engine module to request resending or correction. S43: Clean the received data, remove duplicate and redundant data records, and reasonably fill in the missing data of some key fields according to the distribution characteristics of the data and business knowledge. For the missing risk level fields of some vulnerabilities, fill in the missing data by inference based on the known risk levels of similar vulnerabilities and the relevant descriptions of the vulnerabilities. For those that cannot be filled, mark them as pending data and store them separately for subsequent manual processing; S44: Extract valuable features from raw data. For vulnerability data, extract vulnerability type, affected software components, and scanning tool features that discover vulnerabilities; for malware data, extract file hash values, propagation path features, infected system areas, and other features; for configuration defect data, extract configuration file types, user permission levels involved, and security policy category features, and combine the extracted features into a structured feature vector for use by subsequent algorithms; S45: The extracted feature vectors are classified into the categories of vulnerabilities, malware, and configuration defects, and each category is further subdivided, including vulnerabilities are classified into operating system vulnerabilities, application software vulnerabilities, and network protocol vulnerabilities; malware is classified into worms, Trojans, and viruses; configuration defects are classified into improper user permission configuration, encryption policy defects, and audit policy defects, forming a hierarchical classification system; S46: Look for combinations of vulnerabilities and malware that appear at the same time, and analyze whether there is malware that uses specific vulnerabilities to spread or attack; explore the relationship between configuration defects and vulnerabilities and malware, including whether over-configuration of user permissions makes it more vulnerable to specific types of malware attacks or vulnerability exploits; generate correlation analysis reports through correlation analysis.

[0075] After step S46, the following process is also included: S47: Calculate basic statistics on the number and frequency of various vulnerabilities, malware, and configuration defects, and create risk rating models; S48: For each problem found by the scan, extract relevant feature information of the corresponding vulnerability, malware, and configuration defect, substitute it into the risk rating model to calculate and obtain the risk rating result, associate the risk rating result with the problem details and store it, and clearly mark the risk level of each problem in the database; S49: Configure multiple report templates in the template engine, define dynamic data filling areas in the template engine, associate them with the scan result data and risk rating information in the database, and convert the previously generated various visualization charts into pictures or HTML fragments based on the open source visualization chart library, embed them into the corresponding positions of the scan report, and generate targeted repair suggestions for vulnerabilities, malware, and configuration defects.

[0076] Data collection interface construction: Establish an efficient data transmission interface between the scanning engine module and the result processing module, and adopt the Kafka communication mechanism based on the message queue to ensure real-time and stable data transmission. For example, when the scanning engine completes the scanning of a virtual machine image, it immediately pushes the result data to the result processing module through the pre-set Kafka topic to ensure that the data is not lost and arrives in order. In addition, define a standardized data format, requiring the scanning engine to output the result data in a unified structure, including but not limited to key information such as file path, vulnerability name, malware characteristics, configuration problem description, and related timestamps, to facilitate subsequent analysis and processing.

[0077] Perform format check on the received data to check whether it conforms to the pre-defined standard format. If a format mismatch is found, promptly feedback error information to the scanning engine module and request resending or correction. For example, verify whether the vulnerability name follows common naming conventions and whether the timestamp format is correct. Perform integrity check on the data content to ensure that key information is not missing. For example, for vulnerability data, confirm whether it contains necessary fields such as vulnerability number and affected version; for configuration defect data, check whether the configuration file path and specific configuration items where the problem lies are clearly stated. If data is found to be missing, try to complete it from the cache or log of the scanning engine. If it cannot be completed, mark it as suspicious data and verify it manually later.

[0078] Clean the data and remove duplicate and redundant data records. For example, if the same vulnerability information appears when scanning the same file or image multiple times, only one record is retained and the relevant auxiliary information such as the scanning timestamp is updated. Handle missing values. For data with missing key fields, fill them in reasonably according to the distribution characteristics of the data and business knowledge. For example, if the risk level field of some vulnerabilities is missing, fill them in based on the known risk level of similar vulnerabilities and the relevant description of the vulnerability. For those that cannot be filled in, mark them as pending data and store them separately for subsequent manual processing. Feature extraction. Extract valuable features from the original data. For example, for vulnerability data, extract features such as vulnerability type, affected software components, and scanning tools that discover vulnerabilities. For malware data, extract file hash values, propagation path features (such as whether it is spread through network sharing, email attachments, etc.), infected system areas, etc. For configuration defect data, extract features such as configuration file type, user permission level involved, and security policy category, and combine these features into a structured feature vector for use by subsequent algorithms.

[0079] The machine learning decision tree algorithm uses the extracted feature vector as input and divides the resulting data into categories such as vulnerabilities, malware, and configuration defects. Under each category, it is further subdivided according to specific features, such as vulnerabilities are divided into subcategories such as operating system vulnerabilities, application software vulnerabilities, and network protocol vulnerabilities; malware is divided into subcategories such as worms, Trojans, and viruses; configuration defects are divided into subcategories such as improper user permission configuration, encryption policy defects, and audit policy defects, forming a hierarchical classification system that is stored in the database for easy query and retrieval.

[0080] Association analysis: Use the association rule mining Apriori algorithm to analyze the classified and sorted result data. For example, look for the combination of vulnerabilities and malware that appear at the same time, and analyze whether there is malware that uses specific vulnerabilities to spread or attack; explore the association between configuration defects and vulnerabilities and malware, such as whether certain user permissions are too high, making them more vulnerable to specific types of malware attacks or vulnerability exploits. Through association analysis, weak links in the system are discovered, and association analysis reports are generated to provide a more comprehensive perspective for risk assessment.

[0081] Summary statistics: Calculate the number and frequency of occurrence of various types of vulnerabilities, malware, and configuration defects. For example, count the number of times different types of vulnerabilities are discovered over a period of time, draw trend charts, and observe the growth trend of vulnerabilities; count the infection ratios of different malware families and analyze which malware is more active in the enterprise network; count the distribution of configuration defects in various business systems and find out the weak links in configuration management. Display these summary statistics in the form of visual charts (such as bar charts, line charts, pie charts, etc.) to help security managers quickly understand the overall situation.

[0082] Construction and application of risk rating model, quantification of factors and determination of weights: For the type and severity of vulnerabilities, refer to the industry standard CVSS scoring system, combined with the sensitivity of the company's own business, divide the vulnerabilities into high, medium and low hazard levels, and assign corresponding quantitative scores, such as high-risk vulnerabilities 9-10 points, medium-risk vulnerabilities 5-8 points, and low-risk vulnerabilities 1-4 points.

[0083] Regarding the propagation characteristics and destructive potential of malware, factors such as propagation speed (for example, fast-spreading network worms are given higher scores), infection scope (whether it can spread across network segments and systems), and destructive consequences (whether it causes system paralysis, data loss, etc.) are taken into consideration and quantified into different scores. For example, malware with high destructive potential is given 8-10 points, medium is given 5-7 points, and low is given 1-4 points.

[0084] The impact scope and repair difficulty of configuration defects are quantified based on factors such as the system level involved in the configuration item (core system configuration defects have high scores), the number of user groups (configuration problems that affect a large number of users have high scores), and the technical complexity required for repair (professional technicians and complex operations are difficult to repair). For example, high-impact and high-difficulty configuration defects are 7-10 points, medium 4-6 points, and low 1-3 points. Through expert evaluation, historical data backtesting and other methods, the weight of each dimensional factor in the risk rating is determined, such as the weight of vulnerability factor 0.4, the weight of malware factor 0.3, and the weight of configuration defect factor 0.3, to ensure that the weight distribution reasonably reflects the contribution of each factor to the overall risk.

[0085] Risk assessment and classification: For each problem found in the scan, extract the relevant feature information of the corresponding vulnerability, malware, and configuration defect, and substitute it into the risk rating model for calculation. For example, for a newly discovered buffer overflow vulnerability, it belongs to the high-risk vulnerability type, and the quantitative score is 10 points; combined with the business importance of the system in which it is located, the final score of the vulnerability factor is determined to be 8 points (after considering the weight). If no malware and configuration defects associated with it are found, according to the model calculation, the total risk score of the problem is 8 points, corresponding to the high risk level.

[0086] The risk rating results are stored in association with the problem details, and the risk level of each problem is clearly marked in the database to facilitate subsequent queries and report generation.

[0087] Scan report generation, template engine configuration, design of multiple report templates, including detailed report templates, summary report templates, etc., to meet the needs of different user groups and application scenarios. The detailed report template covers all relevant information of the virtual machine image and the details of the scan results, which is suitable for in-depth analysis by security professionals. The summary report template highlights key information, such as risk rating results and high-risk issue summary, so that management can quickly understand the overall situation.

[0088] Define dynamic data filling areas in the template engine and associate them with fields such as scan result data and risk rating information in the database to ensure that data can be accurately and quickly embedded in the corresponding location when generating reports. For example, in the HTML template, use the placeholder {{image_name}} to represent the virtual machine image name. When generating a report, the template engine automatically obtains the actual image name from the database and replaces the placeholder.

[0089] Data visualization integration: Based on the open source visualization chart library Echarts, previously generated visualization charts (such as vulnerability trend charts, malware infection ratio pie charts, etc.) are converted into images or HTML fragments and embedded in the corresponding position of the scan report. For example, in the "Security Situation Analysis" section of the detailed report, a vulnerability trend chart is inserted to intuitively display the changes in vulnerabilities, allowing users to understand the system security dynamics at a glance.

[0090] Generation of repair suggestions and case references: Generate targeted repair suggestions based on different types of problems (such as vulnerabilities, malware, and configuration defects) combined with industry best practice repair experience. For example, for a high-risk operating system vulnerability discovered, it is recommended to immediately download and install the official security patch, and provide a patch download link and installation steps; for malware infection, it is recommended to use specific antivirus software to detect and kill, and a recommended list of antivirus software and operation guides are provided.

[0091] Report format output: Use report generation tools (such as Python's ReportLab library to generate PDF format, Jinja2 template engine combined with HTML to generate HTML format, etc.) to convert the report content after the template engine fills in data and embeds visual charts into the corresponding format according to the format selected by the user. For example, when the user needs a report in PDF format, the ReportLab library formats the report content into a standardized PDF file according to the preset layout, font and other requirements to ensure good printing and reading effects; when the user chooses HTML format, the Jinja2 template engine generates a dynamic HTML page for easy viewing and interaction in the browser.

[0092] The result data export enables seamless connection between the scan result data and other security management systems, work order management systems, or internal big data analysis platforms of the enterprise, facilitating the collaborative operation of subsequent processes. Study the data access requirements of the target system and develop an adaptive data interface. For example, for a security management system that supports RESTful API access, write a data export function in accordance with its API specification, convert the scan result data into JSON format data that meets the API requirements, and send it to the target system via HTTP request; for a work order management system, if Excel table data is required, use Python's Pandas library to organize the scan result data into Excel format, and push it according to the import process of the work order system.

[0093] A virtual machine image static scanning system based on a hyper-converged platform is used to implement a virtual machine image static scanning method based on a hyper-converged platform, comprising an image acquisition and preprocessing module, a resource scheduling and monitoring module, a comprehensive scanning engine module and a result processing and report generation module, wherein the image acquisition and preprocessing module is connected to the resource scheduling and monitoring module, the resource scheduling and monitoring module is connected to the comprehensive scanning engine module, and the comprehensive scanning engine module is connected to the result processing and report generation module.

[0094] The image acquisition and preprocessing module is used to create a consistent snapshot of the image storage to be scanned. Based on the hyper-integrated distributed nodes, it uses the indexing and retrieval algorithm to obtain the static virtual machine image file, extract and record its metadata information, perform multiple rounds of hash calculations on the virtual machine image file, and compare and verify it with the preset standard hash value; the resource scheduling and monitoring module is used to collect all-round resource data of the hyper-converged platform in real time, and use the preset algorithm to allocate corresponding resource quotas for the scanning task, including the optimal execution node of the scanning task, the allocation of CPU cores, the setting of memory capacity and network bandwidth restrictions; the comprehensive scanning engine module is used to perform multi-stage deep scanning, first with file fingerprints and feature matching for preliminary screening, then through version intelligent comparison to eliminate misjudgment, and finally for key complex components. Static code analysis is used to dig deep into potential high-risk vulnerabilities, and through multi-dimensional feature extraction and analysis of various files in the virtual machine image, known malware is quickly identified and located, and the configuration files in the image are reviewed in an all-round manner; the result processing and report generation module is used to comprehensively collect various types of result data generated by the scanning engine module during the scanning process, and use the preset algorithm to perform in-depth classification, correlation analysis and summary statistics on various types of result data.

[0095] In summary, the method and system for static scanning of virtual machine images based on a hyper-converged platform provided by the present invention create a storage snapshot of the image to be scanned, use indexing and retrieval algorithms to obtain static virtual machine image files, extract and record their metadata information, and then perform integrity verification; collect all-round resource data of the hyper-converged platform in real time, and use a preset algorithm to allocate corresponding resource quotas for scanning tasks; multi-stage deep scanning, first pre-screening with file fingerprints and feature matching, then eliminating misjudgments through intelligent version comparison, and using static code analysis to dig deep into potential high-risk vulnerabilities for key complex components, through rapid identification and positioning of known malicious software, and a comprehensive review of configuration files in the image; use a preset algorithm to deeply classify and organize various types of result data, perform correlation analysis, and summarize statistics, so as to achieve the completion of virtual machine image scanning in a large-scale hyper-converged cluster in a relatively short time.

[0096] The design of the virtual machine image static scanning architecture with deep integration of the hyper-convergence platform covers the technical realization of seamless docking and collaborative work of each link of image collection, comprehensive scanning, resource scheduling, and result feedback with the hyper-convergence platform, giving full play to the distributed, elastic, integrated and other characteristics of the hyper-convergence platform. By optimizing the image parsing process and intelligently scheduling resources, the present invention can complete the virtual machine image scanning in a large-scale hyper-convergence cluster in a short time, greatly shortening the waiting time. Through the comprehensive scanning engine module, the multi-source fusion vulnerability knowledge base construction and multi-stage deep scanning technology, malware static detection, and configuration compliance fine detection, it can quickly and efficiently identify malware, etc., effectively reducing the risk. Through the intelligent prediction of the real-time resource data of the hyper-convergence platform based on the resource scheduling and optimization module, the optimization algorithm of the dynamic allocation strategy and the abnormal adjustment mechanism realize rapid emergency processing. The dynamic resource scheduling strategy ensures that the scanning task will not cause too much burden on the normal operation of the hyper-convergence platform, and maintains a good performance level. And with the help of advanced false alarm filtering mechanism, the present invention effectively reduces the number of false alarms, allowing administrators to focus more on truly important security issues.

Claims

1. A static scanning method for a virtual machine image based on a hyper-converged platform, characterized in that: The following steps are involved: S1: Create a consistent snapshot of the image storage to be scanned through the image acquisition and preprocessing module, obtain static virtual machine image files based on hyper-integrated distributed nodes, use indexing and retrieval algorithms, extract and record their metadata information, perform multiple rounds of hash calculations on the virtual machine image files, and compare and verify them with the preset standard hash values; S2: The resource scheduling and monitoring module collects all-round resource data of the hyper-converged platform in real time, and uses the preset algorithm to allocate corresponding resource quotas for scanning tasks, including the optimal execution node of the scanning task, the allocation of CPU cores, the setting of memory capacity and network bandwidth limit; S3: Performs multi-stage deep scanning through the integrated scanning engine module, first screening with file fingerprints and feature matching, then eliminating misjudgments through intelligent version comparison, and finally using static code analysis to dig deep into potential high-risk vulnerabilities for key complex components. It quickly identifies and locates known malware through multi-dimensional feature extraction and analysis of various files in the virtual machine image, and conducts a comprehensive review of the configuration files in the image. S4: The result processing and report generation module comprehensively collects various result data generated by the scanning engine module during the scanning process, and uses the preset algorithm to deeply classify, organize, correlate and summarize the various result data.

2. The method for statically scanning a virtual machine image based on a hyper-converged platform according to claim 1, characterized in that: The specific process of creating a consistent snapshot of the image storage to be scanned by the image acquisition and preprocessing module in step S1 is as follows: S11: The image acquisition and preprocessing module receives an external startup instruction or activates the image acquisition and preprocessing module at a specified time node to start executing the task; S12: Generate a consistent snapshot for the target image storage when starting the collection by calling the snapshot creation interface provided by the distributed storage system; S13: Setting image index and retrieval based on hyper-converged distributed nodes, quickly locating and obtaining the target image in the massive static virtual machine images, obtaining image metadata information from the distributed file image storage snapshot storage, filtering out the specified index item storage snapshot storage, obtaining image metadata information, and using a preset hash algorithm to allocate node ID and index item storage location; S14: Create a distributed image scanning temporary file storage to store the image to be scanned, obtain a list of images to be scanned, record metadata information of the images to be scanned, determine the format of the images to be scanned, store the images in the newly created distributed image scanning temporary file storage, and perform image integrity calculation.

3. The method for static scanning of virtual machine images based on a hyper-converged platform according to claim 2, characterized in that: The specific process of step S13 is as follows: S131: Obtain image metadata information from the distributed file image storage snapshot storage, and filter out key features including image name, creation time, and size as index items; S132: Using a preset hash algorithm to allocate node IDs and index item storage locations, each node generates a hash value as a node ID based on its own network address and hardware identification information; S133: For the index item, calculate its hash value, and map the index item to the corresponding node through the preset hash algorithm; S134: When a search request is received, multiple nodes are searched in parallel according to given query conditions to quickly locate the target image index.

4. The method for statically scanning a virtual machine image based on a hyper-converged platform according to claim 2, characterized in that: The specific process of step S14 is as follows: S141: Create a distributed image scanning temporary file storage to store the image to be scanned, obtain a list of images to be scanned, and capture key metadata including the image creation timestamp, version iteration information, image source, and last use time to formulate a scanning strategy; S142: Determine the image format to be scanned by reading the specified identifier and structure information in the image file header, wherein when the image format to be scanned is not in the QCOW2 format, when the image format is VMDK or RAW, start the corresponding lossless decompression and format conversion program to convert it into a unified QCOW2 format; S143: storing the image in the newly created distributed image scanning temporary file storage, and storing the QCOW2 image in the QCOW2 format and the processed non-QCOW2 format in the newly created distributed file storage location; S144: After the image acquisition, decompression, and conversion operations are completed and stored in the standard image cache, the integrity check of the system is started. For the QCOW2 format image, hash calculation is performed based on the image in the snapshot storage. For the non-QCOW2 format image, hash calculation is performed based on the QCOW2 format image converted from the image cache, and the calculated hash value is stored in the database as a reference value. S145: After a round of operations on the image, a hash value is calculated for the image, and the hash value of the current image is compared and verified with the pre-stored standard hash value. If the two are consistent, the image data is determined to be authentic and complete. If they are inconsistent, an alarm mechanism is triggered, and an alarm notification containing detailed information of the image identifier and the wrong hash value is sent to the operation and maintenance monitoring system.

5. The method for static scanning of virtual machine images based on a hyper-converged platform according to claim 1, characterized in that: In step S2, the resource scheduling and monitoring module collects all-round resource data of the hyper-converged platform in real time, and uses the preset algorithm to allocate corresponding resource quotas for the scanning task. The specific process is as follows: S21: Deploy Node Exporter and Prometheus servers, use Node Exporter to collect various basic resource indicators of the hyper-converged platform nodes, and then use Prometheus servers to aggregate, store and query data to provide data support for subsequent processes; S22: The Prometheus server writes query statements using a specified query language, summarizes the resource data stored in the database at a specified time node, establishes a resource abundance scoring mechanism, determines the optimal cluster node for executing the scanning task based on the resource abundance scoring result, allocates corresponding CPU computing power to each scanning task based on the node CPU resource status and the complexity of the scanning task, and sets the memory capacity and network bandwidth; S23: assigning priorities to tasks according to task sources and task timeliness, creating task queues for all submitted scanning tasks based on task priorities, and assigning optimal execution nodes to each task in the task queue. According to the task queues, unloading tasks to the assigned optimal execution nodes in turn for processing; S24: Set multi-dimensional resource monitoring thresholds to monitor resource usage during task execution in real time, and use a preset scheduling algorithm to adjust and update the task scheduling strategy in real time.

6. The method for static scanning of virtual machine images based on a hyper-converged platform according to claim 1, characterized in that: The specific process of step S3 is as follows: S31: Establish data connection with NVD and CVE databases, obtain the latest vulnerability information through regular data synchronization interfaces, clean data obtained from different sources, remove duplicate and invalid information, standardize the unified format, and extract key information including vulnerability number, vulnerability description, affected version range, and repair suggestions, integrate and store them into the local knowledge base, and build a unified data structure; S32: Set up a real-time monitoring component. When the NVD or CVE database releases an emergency security update or a major vulnerability is disclosed in the industry, the update process is immediately triggered to update the relevant information to the knowledge base within a specified time. S33: Through the initial screening of file fingerprints and feature matching, intelligent version comparison to eliminate misjudgment, and a progressive scanning method of key complex component code analysis, it comprehensively detects vulnerabilities from coarse-grained to fine-grained; S34: Build a malware feature recognition model, collect malware samples from public malware sample libraries and sample data shared by security agencies, extract multi-dimensional features from the samples, build feature vectors, and input them into the malware feature recognition model for training; S35: for various files in the virtual machine image to be scanned, the file hash value is calculated in sequence, the file header structure is parsed, and the semantic features of the code segment are extracted according to the feature extraction method in the training stage, a feature vector of the file to be detected is constructed, and the feature vector is input into the trained malware feature recognition model; S36: The malware feature recognition model outputs a malicious probability value for each file and compares it with a set probability threshold. When the probability value is greater than the threshold, the file is marked as suspected malware. S37: For suspected malware, intelligent feature matching technology based on machine learning models is used for verification. The model is trained based on typical feature patterns of known malware. The file features are matched with typical feature patterns including specified code segment sequences and file structure layouts. If the match is successful, the file is determined to be malware, and its location and type information in the image are recorded in detail to generate a malware identification report.

7. The method for static scanning of virtual machine images based on a hyper-converged platform according to claim 1, characterized in that: The specific process of step S4 is as follows: S41: Establish an efficient data transmission interface between the scanning engine module and the result processing module, adopt a communication mechanism based on a message queue to enable real-time and stable data transmission, define a standardized data format, and the scanning engine outputs result data according to a unified structure; S42: Perform format check on the received data to determine whether it conforms to a predefined standard format. If not, feedback error information to the scanning engine module to request resending or correction. S43: Clean the received data, remove duplicate and redundant data records, and reasonably fill in the missing data of some key fields according to the distribution characteristics of the data and business knowledge. For the missing risk level fields of some vulnerabilities, fill in the missing data by inference based on the known risk levels of similar vulnerabilities and the relevant descriptions of the vulnerabilities. For those that cannot be filled, mark them as pending data and store them separately for subsequent manual processing; S44: Extract valuable features from raw data. For vulnerability data, extract vulnerability type, affected software components, and scanning tool features that discover vulnerabilities; for malware data, extract file hash values, propagation path features, and infected system area features; for configuration defect data, extract configuration file types, involved user permission levels, and security policy category features, and combine the extracted features into a structured feature vector for use by subsequent algorithms; S45: The extracted feature vectors are classified into the categories of vulnerabilities, malware, and configuration defects, and each category is further subdivided, including vulnerabilities are classified into operating system vulnerabilities, application software vulnerabilities, and network protocol vulnerabilities; malware is classified into worms, Trojans, and viruses; configuration defects are classified into improper user permission configuration, encryption policy defects, and audit policy defects, forming a hierarchical classification system; S46: Look for combinations of vulnerabilities and malware that appear at the same time, and analyze whether there is malware that uses specified vulnerabilities to spread or attack; explore the relationship between configuration defects and vulnerabilities and malware, including whether excessive user rights configuration makes it more vulnerable to specified types of malware attacks or vulnerability exploits; generate correlation analysis reports through correlation analysis.

8. The method for statically scanning a virtual machine image based on a hyper-converged platform according to claim 7, characterized in that: After step S46, The process includes: S47: Calculate basic statistics on the number and frequency of various vulnerabilities, malware, and configuration defects, and create risk rating models; S48: For each problem found by the scan, extract relevant feature information of the corresponding vulnerability, malware, and configuration defect, substitute it into the risk rating model to calculate and obtain the risk rating result, associate the risk rating result with the problem details and store it, and clearly mark the risk level of each problem in the database; S49: Configure multiple report templates in the template engine, define dynamic data filling areas in the template engine, associate them with the scan result data and risk rating information in the database, and convert the previously generated various visualization charts into pictures or HTML fragments based on the open source visualization chart library, embed them into the corresponding positions of the scan report, and generate targeted repair suggestions for vulnerabilities, malware, and configuration defects.

9. A virtual machine image static scanning system based on a hyper-converged platform, used to implement a virtual machine image static scanning method based on a hyper-converged platform as described in any one of claims 1 to 9, characterized in that: It includes an image acquisition and preprocessing module, a resource scheduling and monitoring module, a comprehensive scanning engine module and a result processing and report generation module, wherein the image acquisition and preprocessing module is connected to the resource scheduling and monitoring module, the resource scheduling and monitoring module is connected to the comprehensive scanning engine module, and the comprehensive scanning engine module is connected to the result processing and report generation module; The image acquisition and preprocessing module is used to create a consistent snapshot of the image storage to be scanned, based on the hyper-integrated distributed nodes, use the index and retrieval algorithm to obtain the static virtual machine image file, extract and record its metadata information, perform multiple rounds of hash calculations on the virtual machine image file, and compare and verify it with the preset standard hash value; The resource scheduling and monitoring module is used to collect all-round resource data of the hyper-converged platform in real time, and use a preset algorithm to allocate corresponding resource quotas for scanning tasks, including the optimal execution node of the scanning task, the allocation of CPU cores, the setting of memory capacity and network bandwidth limit; The comprehensive scanning engine module is used to perform multi-stage deep scanning, firstly screening by file fingerprint and feature matching, then eliminating misjudgment by intelligent version comparison, and finally using static code analysis to dig deep into potential high-risk vulnerabilities for key complex components, quickly identifying and locating known malware by performing multi-dimensional feature extraction and analysis on various files in the virtual machine image, and conducting a comprehensive review of the configuration files in the image; The result processing and report generation module is used to comprehensively collect various types of result data generated by the scanning engine module during the scanning process, and use a preset algorithm to perform in-depth classification, correlation analysis, and summary statistics on various types of result data.

Images