Container migration method for relay penetration test assisted by unmanned aerial vehicle

Abstract

The invention belongs to the technical field of communication. The invention provides an unmanned aerial vehicle assisted relay penetration test-oriented container migration method. According to the embodiment of the invention, by monitoring the state of the unmanned aerial vehicle in time and intelligently scheduling the standby unmanned aerial vehicle, the system can quickly respond to the fault or load problem, and the reliability and stability of the system are improved. The CRIU technology is adopted to freeze the container state, and the Docker container migration technology is adopted, so that rapid migration and recovery of the container are realized, and the continuity and efficiency of task execution are guaranteed. When the unmanned aerial vehicle relay penetration test is carried out, various state information and data of the test software in current operation are seamlessly transited to a replacing unmanned aerial vehicle platform from an original unmanned aerial vehicle platform, then the operation state of the original unmanned aerial vehicle test platform is recovered on a new platform, and operation can be continued based on the current recovered state. And the working continuity and robustness of the unmanned aerial vehicle penetration test platform are improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of communication technologies, and in particular, to a container migration method for drone-assisted relay penetration testing. Background Art

[0002] As an efficient and flexible flying tool, a drone can carry various sensors and devices and has the ability to collect, record, and transmit data, making it widely used in fields such as data collection and monitoring, especially in scenarios where high-frequency data acquisition is required. Therefore, a network penetration testing platform can be built with drones. When continuous monitoring of the object to be tested is needed, a single drone has problems with insufficient endurance and computing power, so a method of multi-drone relay can be used to complete the task. In the prior art, a method and device for target monitoring based on drones are disclosed, in which the position coordinate information and movement height information of the first drone that was originally working are shared with the second relay drone, and the relay drone restarts the task after tracking the target. However, in the current relay method, when facing some detection tasks, especially penetration testing tasks, it is only a replacement at the hardware level, and the processes running on the original working platform are not replaced, which is prone to data interruption and transmission anomalies.

[0003] Therefore, it is necessary to improve one or more problems existing in the above related technical solutions.

[0004] It should be noted that this part is intended to provide background or context for the technical solutions of the present disclosure stated in the claims. The description herein is not admitted to be prior art merely because it is included in this part. Summary of the Invention

[0005] The purpose of the embodiments of the present disclosure is to provide a container migration method for drone-assisted relay penetration testing, thereby at least to some extent overcoming one or more problems caused by the limitations and defects of the related technologies.

[0006] According to the embodiments of the present disclosure, a container migration method for drone-assisted relay penetration testing is provided. The method includes: The drone monitoring and deployment module monitors the endurance data of the working drone in real time. When the battery power of the working drone is lower than the preset threshold, a standby drone with a battery power higher than the available threshold is scheduled to replace the working drone; When scheduling the standby drone, the Docker container migration module obtains the Docker container information of the penetration testing platform on the working drone; wherein, the Docker container information includes the container name, mapped port, image information, and startup command; Create a new Docker container on the standby drone, and migrate the Docker container layer data of the working drone to the container layer of the standby drone without migrating the rootfs of the container; Use CRIU technology to freeze the application state running in the Docker container of the working drone, generate a checkpoint file containing memory data, and pause the penetration testing task; Migrate the checkpoint file to the newly created Docker container on the standby drone; On the standby drone, restore the container running state based on the checkpoint file and continue to execute the penetration testing task.

[0007] Furthermore, the migration of the container layer data is achieved through iterative synchronization, including multiple incremental synchronizations to reduce the data transfer volume during the migration process.

[0008] Furthermore, when CRIU technology is used to freeze the application execution state, the memory data and process state of the container are written to a disk file.

[0009] Furthermore, the restoration of the container state includes: Parse the checkpoint file, reconstruct the memory mapping and process context of the container, and restore the running environment based on the migrated container layer data.

[0010] Furthermore, the acquisition and migration process of Docker container information is transmitted through an encrypted communication protocol to ensure data security.

[0011] Furthermore, the preset threshold is set based on at least one of the remaining battery power, computing load, or network connection status of the drone.

[0012] Furthermore, the scheduling of the standby drone adopts a dynamic priority algorithm, and the replacement order is comprehensively determined according to the real-time position, remaining battery power, and task queue length of the standby drone.

[0013] Furthermore, after the migration of the container layer data is completed, container logs and some metadata are retained on the working drone for rollback operations in case of migration anomalies.

[0014] The technical solutions provided by the embodiments of the present disclosure may include the following beneficial effects: In the embodiments of the present disclosure, through the above-mentioned container migration method for drone-assisted relay penetration testing, on the one hand, by timely monitoring the drone status and intelligently scheduling standby drones, the system can quickly respond to faults or load problems, improving the reliability and stability of the system. By using the CRIU technology to freeze the container status and the Docker container migration technology, the rapid migration and recovery of the container are realized, thus ensuring the continuity and efficiency of task execution. On the other hand, during the drone relay penetration testing, various status information and its data of the currently running test software are seamlessly transferred from the original drone platform to the replacement drone platform, and then the running status of the original drone test platform is restored on the new platform and can continue to run based on the currently restored status, improving the persistence and robustness of the drone penetration testing platform. It can solve the problems that the current solution fails to achieve data migration between different drone test platforms and the transmission process is complex and time-consuming, and it also causes transmission anomalies and poor continuity of the test process during the relay of the cross-drone-assisted penetration testing platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and those of ordinary skill in the art can obtain other drawings without creative efforts based on these drawings.

[0016] Figure 1 A step diagram showing the container migration method for drone-assisted relay penetration testing in an exemplary embodiment of the present disclosure; Figure 2 A flowchart showing the Docker container online migration system in an exemplary embodiment of the present disclosure; Figure 3 A diagram showing the execution order of migration operations in an exemplary embodiment of the present disclosure; Figure 4 A memory iteration synchronization flowchart showing the Docker container migration algorithm in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0017] Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more complete and comprehensive, and will fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0018] In addition, the accompanying drawings are only schematic illustrations of the embodiments of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus repeated descriptions thereof will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0019] In this exemplary embodiment, a container migration method for drone-assisted relay penetration testing is provided. Referring to Figure 1 as shown in, the container migration method for drone-assisted relay penetration testing may include: Step S101 to Step S106.

[0020] Step S101: The drone monitoring and dispatching module monitors the battery life data of the working drone in real time. When the battery level of the working drone is lower than the preset threshold, a standby drone with a battery level higher than the available threshold is dispatched to replace the working drone; Step S102: When dispatching the standby drone, the Docker container migration module obtains the Docker container information of the penetration testing platform on the working drone; wherein, the Docker container information includes the container name, mapped port, image information, and startup command; Step S103: A new Docker container is created on the standby drone, and the Docker container layer data of the working drone is migrated to the container layer of the standby drone without migrating the rootfs of the container; Step S104: The CRIU technology is used to freeze the running application state in the Docker container of the working drone, generate a checkpoint file containing memory data, and suspend the penetration testing task; Step S105: The checkpoint file is migrated to the newly created Docker container on the standby drone; Step S106: On the standby drone, the container running state is restored based on the checkpoint file, and the penetration testing task is continued.

[0021] Through the above container migration method for drone-assisted relay penetration testing, on the one hand, by timely monitoring the drone status and intelligently scheduling standby drones, the system can quickly respond to faults or load problems, improving the reliability and stability of the system. By using CRIU technology to freeze the container status and Docker container migration technology, rapid migration and recovery of the container are achieved, thus ensuring the continuity and efficiency of task execution. On the other hand, during drone relay penetration testing, various status information and its data of the currently running test software are seamlessly transferred from the original drone platform to the replacement drone platform, and then the running status of the original drone test platform is restored on the new platform and can continue to run based on the currently restored status, improving the persistence and robustness of the drone penetration testing platform. It can solve the problems that the current solution fails to achieve data migration between different drone test platforms and the transmission process is complex and time-consuming, and it also causes transmission anomalies and poor test process persistence during cross-drone-assisted penetration testing platform relay.

[0022] Next, reference will be made to Figures 1 to 4 for a more detailed description of each step of the above container migration method for drone-assisted relay penetration testing in this exemplary embodiment.

[0023] Example 1 As Figure 2 shown, this embodiment includes the original working drone 1, the replacement drone 2, the drone monitoring module 3, and the Docker container migration module 4. The usage method includes the following steps: (1) The drone monitoring module 3 continuously monitors the running status of the original working drone 1, including battery life, computing load, storage and network status, and task execution status. Battery life monitoring includes battery power, battery voltage, and estimated remaining flight time; computing load monitoring includes CPU utilization, memory occupancy, and storage space remaining; network status monitoring measures signal strength, data bandwidth, and connection stability; task execution status monitoring focuses on the progress of the current penetration testing task and the running status of the Docker container. This module collects data once per second and issues a task switching request when a critical threshold is triggered.

[0024] (2) The drone monitoring module determines whether to switch tasks based on the set thresholds. The specific minimum thresholds are as follows: battery power is less than 20%, battery voltage is less than 3.6V, CPU utilization exceeds 90% for 10 consecutive minutes, memory occupancy exceeds 85%, storage space is less than 500MB, and network signal strength is less than -85dBm and persists for 5 minutes. If multiple indicators are met simultaneously, priority is given to battery power, followed by CPU load, task progress, storage space, and network status in sequence.

[0025] After confirming the task migration, the standby UAV 2 starts the replacement process. The Docker container migration module 4 obtains the container information of the current task, including the container name, mapped port, image information, and task execution command, to ensure that the new UAV can correctly receive the task. The standby UAV 2 synchronously obtains the network configuration to ensure normal communication after the switch.

[0026] (4)The standby UAV 2 pre-creates the same container environment as the original working UAV 1 based on the received container information and migrates the container layer data. Integrity verification is performed during the migration process to prevent data loss or damage.

[0027] (5)In the Docker container of the original working UAV, the checkpoint technology is used, and the CRIU technology is adopted to freeze the execution of the application on the system. At the same time, the memory data that the container needs to transmit is written out to the specified file, and the penetration testing work is paused.

[0028] (6)The file is migrated to the Docker container on the replacement UAV platform through the Docker container migration module, and the local container recovery technology of Docker is adopted to restore the task process, memory, and network status. After recovery, the network is reconfigured to enable it to provide services externally normally. After the task recovery is completed, the standby UAV 2 replaces the original working UAV 1 to continue the penetration testing task, realizing uninterrupted tasks.

[0029] Embodiment 2 As Figure 3 shown, for the implementation of the migration operation, this embodiment includes the original working UAV 1 and the replacement UAV 2, and includes the following steps: (1)At the start of the migration, the original working UAV 1 runs the penetration testing task and continuously monitors its own battery power, computing load, storage space, and network status. When a certain index reaches the set minimum threshold, the task migration process is triggered, notifying the replacement UAV 2 to enter the standby state and starting the migration preparation.

[0030] (2)Obtain the information of the original working UAV 1. The original working UAV 1 collects the information of the currently running task, including the container name, image version, port mapping, task progress, and file system structure. At the same time, obtain the current CPU, memory, and storage occupancy to evaluate the amount of data required for migration.

[0031] (3)The replacement UAV 2 creates a new Docker container according to the task information transmitted by the original working UAV 1. The environment configuration of the new container needs to be consistent with that of the original working UAV 1, including the image version, port mapping, network configuration, and computing resource allocation.

[0032] (4) Iteratively synchronize the container layer data of the original working drone, and gradually transfer the container layer data of the original working drone 1 to the replacement drone 2. The complete container layer data is transferred initially, and then only the changed data is synchronized while performing data integrity verification to prevent data loss or damage. (5) The original working drone 1 migrates the file system configuration, including mount points, directory structures, permission settings, log files, and dependencies required for task execution, and synchronizes it to the replacement drone 2.

[0033] (6) Freeze the container state of the original working drone and generate a checkpoint file containing process status, memory snapshot, network connections, and file descriptor information. After the task is frozen, the penetration testing work is paused to ensure that the data does not change during the migration process.

[0034] (7) After freezing the task state, continue to perform incremental synchronization of the memory data and transfer the changed part of the memory since the freezing moment to the replacement drone 2 again.

[0035] (8) The replacement drone 2 receives the checkpoint file transmitted by the original working drone 1 and performs integrity verification to ensure the integrity of data such as process status, network connections, and file descriptors without damage.

[0036] (9) The replacement drone 2 parses the checkpoint file and restores the task state in the newly created Docker container. The frozen processes, memory data, and network configuration are loaded during the restoration process.

[0037] (10) The migration is completed.

[0038] Embodiment 3 As Figure 4 shown, implement memory iterative synchronization. This embodiment includes the original working drone 1 and the replacement drone 2, and includes the following steps: (1) Before migrating the task, the original working drone 1 uses the CRIU technology to capture the state of the running Docker container and generate a memory checkpoint file, including process status, memory snapshot, network connections, and file descriptor information. The memory checkpoint ensures the integrity during task migration, enabling the task to be restored to the same state on the replacement drone 2.

[0039] (2) The original working drone 1 writes the container memory data to the checkpoint file in batches through the memory iterative synchronization technology and uses the incremental synchronization method for transmission. The complete memory snapshot is transmitted in the initial stage, and then the newly added or changed memory data is continuously synchronized.

[0040] (3) The replacement UAV 2 starts the newly created Docker container, gradually receives the memory data transmitted by the original working UAV 1, and performs preloading. After receiving the initial memory snapshot, the container continues to receive incremental synchronization data to ensure that the memory state is consistent with that of the original working UAV 1.

[0041] (4) When all the memory data is synchronized to the replacement UAV 2, it enters the Stop-and-Copy phase. The original working UAV 1 disconnects the data volume and network connections to complete the final incremental synchronization. The replacement UAV 2 uses CRIU to restore the task process, memory state, and network connections to ensure seamless task handover and switches to the formal running state, while the original working UAV 1 enters the standby or return-to-base mode.

[0042] Through the above container migration method for UAV-assisted relay penetration testing, on the one hand, by timely monitoring the UAV status and intelligently scheduling standby UAVs, the system can quickly respond to faults or load problems, improving the reliability and stability of the system. By using CRIU technology to freeze the container state and Docker container migration technology, rapid migration and recovery of the container are achieved, thus ensuring the continuity and efficiency of task execution. On the other hand, during UAV relay penetration testing, various status information and its data of the currently running test software are seamlessly transferred from the original UAV platform to the replacement UAV platform, and then the running state of the original UAV test platform is restored on the new platform and can continue to run based on the restored state, improving the persistence and robustness of the UAV penetration testing platform. It can solve the problems that the current solution fails to achieve data migration between different UAV test platforms, the transmission process is complex and time-consuming, and it also causes transmission anomalies and poor test process persistence during relay across UAV-assisted penetration testing platforms.

[0043] It should be understood that the orientation or positional relationship indicated by the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise", etc. in the above description is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the embodiments of the present disclosure and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation to the embodiments of the present disclosure.

[0044] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of such features. In the description of the embodiments of the present disclosure, "a plurality" means two or more, unless otherwise specifically defined.

[0045] In the embodiments of the present disclosure, unless otherwise clearly defined and limited, terms such as "mounted", "connected", "coupled", "fixed", etc. shall be construed in a broad sense. For example, it may be a fixed connection, a detachable connection, or integrated; it may be a mechanical connection or an electrical connection; it may be directly connected or indirectly connected through an intermediate medium, and it may be the communication inside two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present disclosure may be understood according to specific circumstances.

[0046] In the embodiments of the present disclosure, unless otherwise clearly defined and limited, the first feature being "on" or "under" the second feature may include the first and second features being in direct contact, or may include the first and second features not being in direct contact but in contact through additional features therebetween. Moreover, the first feature being "above", "over" and "on top of" the second feature includes the first feature being directly above and obliquely above the second feature, or merely indicating that the first feature has a higher horizontal height than the second feature. The first feature being "under", "beneath" and "underneath" the second feature includes the first feature being directly below and obliquely below the second feature, or merely indicating that the first feature has a lower horizontal height than the second feature.

[0047] In the description of this specification, the description with reference to terms such as "one embodiment", "some embodiments", "example", "specific example" or "some examples", etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0048] Those skilled in the art will readily conceive of other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include known common general knowledge or conventional technical means in the technical field not disclosed in the present disclosure. The specification and examples are only regarded as exemplary, and the true scope and spirit of the present disclosure are pointed out by the appended claims.

Claims

1. A container migration method for drone-assisted relay penetration testing, characterized in that, The method includes: Real - time monitoring of the battery life data of the working drone through the drone monitoring and deployment module. When the battery level of the working drone is lower than the preset threshold, dispatch a standby drone with a battery level higher than the available threshold to replace the working drone; When dispatching the standby drone, obtain the Docker container information of the penetration testing platform on the working drone through the Docker container migration module; among them, the Docker container information includes the container name, mapped port, image information, and startup command; Create a new Docker container on the standby drone, and migrate the Docker container layer data of the working drone to the container layer of the standby drone without migrating the rootfs of the container; Use the CRIU technology to freeze the running application state in the Docker container of the working drone, generate a checkpoint file containing memory data, and pause the penetration testing task; Migrate the checkpoint file to the newly created Docker container on the standby drone; On the standby drone, restore the container running state based on the checkpoint file and continue to execute the penetration testing task.

2. The container migration method for drone-assisted relay penetration testing according to claim 1, wherein The migration of the container layer data is achieved through an iterative synchronization method, including multiple incremental synchronizations to reduce the data transfer volume during the migration process.

3. The container migration method for drone-assisted relay penetration testing according to claim 1, wherein When the CRIU technology is used to freeze the application execution state, the memory data and process state of the container are written to a disk file.

4. The container migration method for drone-assisted relay penetration testing according to claim 1, wherein The restoration of the container state includes: Parse the checkpoint file, reconstruct the memory mapping and process context of the container, and restore the running environment based on the migrated container layer data.

5. The container migration method for drone-assisted relay penetration testing according to claim 1, wherein The process of obtaining and migrating the Docker container information is transmitted through an encrypted communication protocol to ensure data security.

6. The container migration method for drone-assisted relay penetration testing according to claim 1, wherein The preset threshold is set based on at least one of the remaining battery power, computing load, or network connection status of the drone.

7. The container migration method for drone-assisted relay penetration testing according to claim 1, characterized in that The scheduling of the standby drone adopts a dynamic priority algorithm, and the replacement order is comprehensively determined according to the real - time position, remaining battery power, and task queue length of the standby drone.

8. The container migration method for drone-assisted relay penetration testing according to claim 1, wherein After the migration of the container layer data is completed, keep the container logs and some metadata on the working drone for rollback operations in case of migration anomalies.

Images