Container anomaly detection method and device based on dynamic update behavior model

Abstract

The invention provides a container anomaly detection method and device based on a dynamic update behavior model. The method comprises the steps of obtaining behavior data of a container and querying a preset behavior model library according to a corresponding mirror image ID; under the condition that a behavior model corresponding to the mirror image ID exists in a preset behavior model library and the model state of the behavior model is a first preset state, determining the behavior model as a target model; performing abnormal behavior detection according to the first target data and the target model to obtain a container anomaly detection result; performing back propagation training on the target model according to the inconsistent container anomaly detection results to update the target model; and updating a preset behavior model library according to the updated target model so as to perform abnormal behavior detection on the first target data acquired next time. The method solves the problem that in the prior art, an unknown container anomaly detection method cannot be adjusted according to the real-time change of the container, so that the container anomaly detection precision is reduced in the use process.

Description

Technical Field

[0001] The present invention relates to the technical field of container anomaly detection, and in particular, to a container anomaly detection method, device, computer-readable storage medium, and container monitoring system based on a dynamically updated behavior model. Background Art

[0002] Container behavior anomaly detection is an important security protection measure, aiming to identify and handle the abnormal behaviors of application programs running in containers. These abnormal behaviors may include unsafe operations such as privilege escalation, cryptocurrency mining, unexpected network traffic, container escape, etc.

[0003] For the detection of such behaviors, there are some specialized tools that can provide assistance. For example, Falco is a process anomaly behavior detection tool open-sourced by Sysdig, which can detect application programs on traditional hosts as well as application programs in container environments and cloud platforms (mainly Kubernetes and Mesos). However, despite these tools and methods, the above tools mainly focus on the detection of known threats. Therefore, the anomaly detection of container behaviors is still a complex and challenging task. Due to the dynamic and lightweight characteristics of container technology, the life cycle of containers is short and changes rapidly.

[0004] For the detection of unknown threats, since most unknown threats cannot be matched by existing rules, the idea of unknown threat detection is to identify abnormal patterns from a large number of patterns, and then further generalize the abnormal models to form models or baselines for subsequent anomaly judgment. In the prior art, historical data is mostly used to construct a rule library / model / baseline, and then the rule library / model / baseline is used to determine whether an anomaly occurs in the current container environment. Due to the dynamic and lightweight characteristics of container technology, the life cycle of containers is short and changes rapidly. When the container environment changes, the rule library / model / baseline should be adjusted accordingly to ensure that the detection accuracy does not decrease when dealing with new data. However, no relevant settings have been made for this shortcoming in the prior art.

[0005] In summary, in the prior art, since the model / rule library / baseline for unknown anomaly detection is relatively fixed after training and cannot cope with the frequent changes in the container environment, the detection accuracy decreases. Summary of the Invention

[0006] The main objective of the present application is to provide a container anomaly detection method, device, computer-readable storage medium, and container monitoring system based on a dynamically updated behavior model, so as to at least solve the problem that the container unknown anomaly detection method in the prior art cannot be adjusted according to the real-time changes of containers, resulting in a decrease in the accuracy of container anomaly detection during use.

[0007] To achieve the above object, according to one aspect of the present application, a container anomaly detection method based on a dynamically updated behavior model is provided, including: obtaining behavior data of a container to obtain a plurality of first target data, querying a preset behavior model library according to the image ID corresponding to the first target data, where the container includes software and a running environment, and the image ID is used to uniquely identify the image that is the template of the container; in the case where there is a behavior model corresponding to the image ID in the preset behavior model library and the model state of the behavior model is the first preset state, determining the behavior model as the target model; performing anomaly behavior detection according to the first target data and the target model to obtain a container anomaly detection result; in the case where the container anomaly detection result is inconsistent with the actual running state of the container, performing backpropagation training on the target model according to the inconsistent container anomaly detection result to update the target model; updating the preset behavior model library according to the updated target model to perform anomaly behavior detection on the first target data obtained next time.

[0008] Optionally, querying the preset behavior model library according to the image ID corresponding to the first target data, where the container includes software and a running environment, includes: determining the images corresponding to the containers to obtain target images, adding the behavior data corresponding to the same target image to the same set to obtain at least one target set; determining the image ID of the target image as the image ID corresponding to the first target data in the target set; traversing the first key-value pairs of the behavior models in the preset behavior model library according to the image ID to determine whether there is a behavior model corresponding to the image ID in the preset behavior model library, and the first key-value pair includes at least the image ID and the model state.

[0009] Optionally, after querying the preset behavior model library according to the image ID corresponding to the first target data, the method further includes: in the case where there is no behavior model corresponding to the image ID in the preset behavior model library, constructing a model according to a preset clustering algorithm to obtain a target clustering model, performing clustering on the target set through the target clustering model to obtain a plurality of target clustering clusters; adding a model ID to the target clustering model, and constructing a second key-value pair according to the model ID and the image ID; determining the target set as the first input data, determining the category of the target clustering cluster as the first label data, performing supervised training according to the first input data and the first label data to obtain a behavior model; determining the model state of the behavior model as the second preset state, and constructing a first key-value pair according to the model state and the image ID; storing the target clustering model and the behavior model in the preset behavior model library according to the first key-value pair and the second key-value pair.

[0010] Optionally, after querying the preset behavior model library according to the mirror ID corresponding to the first target data, the method further includes: when there is a behavior model corresponding to the mirror ID in the preset behavior model library and the model state of the behavior model is the second preset state, query the preset behavior model library according to the mirror ID to obtain a target clustering model corresponding to the mirror ID; obtain the clustering center of the target clustering cluster with the first preset category in the target clustering model to obtain the first target center, and obtain the clustering center of the target clustering cluster with the second preset category in the target clustering model to obtain the second target center; calculate the distance between the first target data in the target set and the first target center to obtain the first target distance, and calculate the distance between the first target data in the target set and the second target center to obtain the second target distance; when the first target distance is less than the second target distance, divide the first target data into the target clustering cluster corresponding to the first preset category, and when the first target distance is greater than the second target distance, divide the first target data into the target clustering cluster corresponding to the second preset category; update the corresponding clustering center according to the updated target clustering cluster; determine the target set as the second input data, determine the updated clustering center as the second label data, and perform supervised training on the behavior model according to the second input data and the second label data; update the preset behavior model library according to the updated target clustering model and the behavior model.

[0011] Optionally, updating the preset behavior model library according to the behavior model includes: obtaining preset verification data, inputting the preset verification data into the updated target model to obtain a test anomaly detection result; calculating the loss function value of the updated target model according to the test anomaly detection result; when the loss function value is less than or equal to the first threshold, update the corresponding behavior model in the preset behavior model library according to the behavior model, and update the second preset state in the first key-value pair corresponding to the behavior model to the first preset state; when the loss function value is greater than the first threshold, only update the corresponding behavior model in the preset behavior model library according to the behavior model.

[0012] Optionally, performing backpropagation training on the target model according to the inconsistent container anomaly detection results to update the target model includes: adding the inconsistent container anomaly detection results to the negative sample set; calculating the accuracy, precision, and recall rate of the target model according to the container anomaly detection results; calculating a comprehensive performance index according to the accuracy, precision, and recall rate, and when the comprehensive performance index is less than the previously calculated comprehensive performance index and the difference between the comprehensive performance index and the previously calculated comprehensive performance index is greater than the second threshold; traverse the negative sample set, and perform backpropagation training on the target model in turn according to the sample data in the negative sample set using the gradient descent method.

[0013] Optionally, update the preset behavior model library according to the target model after backpropagation training, including: updating the corresponding behavior model in the preset behavior model library according to the target model after backpropagation training, and updating the first preset state in the first key-value pair corresponding to the behavior model to the second preset state.

[0014] According to another aspect of the present application, there is provided a container anomaly detection device based on a behavior model. The device includes: obtaining behavior data of a container to obtain a plurality of first target data, querying a preset behavior model library according to the mirror ID corresponding to the first target data, where the container includes software and a running environment, and the mirror ID is used to uniquely identify the mirror serving as the template of the container; when there is a behavior model corresponding to the mirror ID in the preset behavior model library and the model state of the behavior model is the first preset state, determining the behavior model as the target model; performing anomaly behavior detection according to the first target data and the target model to obtain a container anomaly detection result; when the container anomaly detection result is inconsistent with the actual running state of the container, performing backpropagation training on the target model according to the inconsistent container anomaly detection result to update the target model; updating the preset behavior model library according to the updated target model to perform anomaly behavior detection on the first target data obtained next time.

[0015] According to still another aspect of the present application, there is provided a computer-readable storage medium. The computer-readable storage medium includes a stored program. When the program runs, it controls the device where the computer-readable storage medium is located to execute any one of the methods.

[0016] According to yet another aspect of the present application, there is provided a container monitoring system, including: one or more processors, a memory, and one or more programs. One or more programs are stored in the memory and are configured to be executed by one or more processors. One or more programs include methods for executing any one of the above.

[0017] Applying the technical solution of the present application, in the above-mentioned container anomaly detection method based on a dynamically updated behavior model, first, obtain the behavior data of the container to obtain a plurality of first target data, and query a preset behavior model library according to the mirror ID corresponding to the first target data. The container includes software and a running environment, and the mirror ID is used to uniquely identify the mirror that is the template of the container; then, when there is a behavior model corresponding to the mirror ID in the preset behavior model library and the model state of the behavior model is the first preset state, determine the behavior model as the target model; after that, perform anomaly behavior detection according to the first target data and the target model to obtain a container anomaly detection result; after that, when the container anomaly detection result is inconsistent with the actual running state of the container, perform backpropagation training on the target model according to the inconsistent container anomaly detection result to update the target model; finally, update the preset behavior model library according to the updated target model to perform the anomaly behavior detection on the first target data obtained next time. The present application constructs a corresponding behavior model for each template of the container for container environment anomaly detection, ensuring that the model is fully matched with the container. In addition, the present application also sets to dynamically update the behavior model according to the actual running state of the container uploaded by the staff when correcting the anomaly behavior during the process of the behavior model performing container environment anomaly detection, so as to cope with the characteristics of the short life cycle and fast changes of the container, and solves the problem that the existing container unknown anomaly detection method cannot be adjusted according to the real-time changes of the container, resulting in a decrease in the accuracy of container anomaly detection during use. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 FIG. shows a hardware structure block diagram of a mobile terminal for a container anomaly detection method based on a dynamically updated behavior model provided in an embodiment of the present application;

[0019] Figure 2 FIG. shows a flowchart of a container anomaly detection method based on a dynamically updated behavior model provided in an embodiment of the present application;

[0020] Figure 3 FIG. shows a flowchart of a training method for a behavior model provided in an embodiment of the present application;

[0021] Figure 4 FIG. shows a flowchart of a method for creating and storing a behavior model when there is no behavior model corresponding to the mirror in the preset behavior model library provided in an embodiment of the present application;

[0022] Figure 5 FIG. shows a flowchart of a method for forward updating a behavior model provided in an embodiment of the present application;

[0023] Figure 6 The structural block diagram of a container anomaly detection device based on a dynamically updated behavior model provided according to an embodiment of the present application is shown.

[0024] Among them, the above-mentioned drawings include the following reference numerals:

[0025] 102, a processor; 104, a memory; 106, a transmission device; 108, an input / output device. Specific embodiments

[0026] It should be noted that, without conflict, the embodiments in the present application and the features in the embodiments may be combined with each other. The present application will be described in detail below with reference to the drawings and in combination with the embodiments.

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily need to be used to describe a specific order or sequence. It should be understood that such data may be interchanged under appropriate circumstances so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0029] For the convenience of description, some nouns or terms related to the embodiments of the present application are described below:

[0030] Behavior model: Here, the behavior refers to the process behavior of the container environment in which the mirror runs. The model is a behavior classification model established through artificial intelligence algorithms such as deep learning, and the unknown threats in the container are detected through the behavior model.

[0031] Container environment: The container environment can provide an operating environment isolated from the host for the application program. Compared with the virtual machine, it uses process-level system isolation rather than operating system-level resource isolation.

[0032] Anomaly Detection: Anomaly detection of container environment behavior is an important security protection measure, aiming to identify and handle abnormal behaviors of applications running in containers. These abnormal behaviors may include unsafe operations such as privilege escalation, cryptocurrency mining, unexpected network traffic, container escape, etc.

[0033] Unknown Anomaly Detection: It refers to anomalies that cannot be matched by known rules, but rather to identify anomaly patterns from a large number of patterns and then generalize and judge the anomaly patterns.

[0034] As introduced in the background art, in the prior art, since the model / rule library / baseline of unknown anomaly detection is relatively fixed after training and cannot cope with the frequent changes in the container environment, resulting in a decline in detection accuracy. To solve the problem that the container unknown anomaly detection method in the prior art cannot be adjusted according to the real-time changes of the container, resulting in a decline in the accuracy of container anomaly detection during use, the embodiments of the present application provide a container anomaly detection method, device, computer-readable storage medium, and container monitoring system based on a dynamically updated behavior model.

[0035] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention.

[0036] The method embodiments provided in the embodiments of the present application can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking the operation on a mobile terminal as an example, Figure 1 is a hardware structure block diagram of a mobile terminal of a container anomaly detection method based on a dynamically updated behavior model according to an embodiment of the present invention. As Figure 1 shown, the mobile terminal may include one or more ( Figure 1 only one is shown in Figure 1 a processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. Among them, the above mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those of ordinary skill in the art can understand that Figure 1 the structure shown is only schematic and does not limit the structure of the above mobile terminal. For example, the mobile terminal may further include more or fewer components than Figure 1 shown, or have a different configuration from

[0037] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the container anomaly detection method based on the dynamic update behavior model in the embodiments of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above-mentioned method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some instances, the memory 104 may further include a memory remotely disposed relative to the processor 102, and these remote memories may be connected to the mobile terminal through a network. Examples of the above-mentioned network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof. The transmission device 106 is used to receive or send data via a network. A specific example of the above-mentioned network may include a wireless network provided by a communication provider of the mobile terminal. In one instance, the transmission device 106 includes a network adapter (Network Interface Controller, abbreviated as NIC), which can be connected to other network devices through a base station and thus can communicate with the Internet. In one instance, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0038] In this embodiment, a container anomaly detection method based on a dynamic update behavior model running on a mobile terminal, a computer terminal, or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0039] Figure 2 It is a flowchart of the container anomaly detection method based on the dynamic update behavior model according to the embodiments of the present application. As Figure 2 shown, the method includes the following steps:

[0040] Step S201, obtain the behavior data of the container to obtain a plurality of first target data, query a preset behavior model library according to the mirror ID corresponding to the first target data. The container includes software and a running environment, and the mirror ID is used to uniquely identify the mirror that is the template of the container;

[0041] Specifically, the behavior data of the container is captured through a preset tool to obtain the above-mentioned first target data, such as Figure 3As shown, the above first target data includes, but is not limited to, container ID, container process PID (process identifier), operation command, CPU utilization, memory usage, disk I / O, and network traffic, etc. In the preprocessing stage, multiple first target data are classified according to the corresponding image ID. The image ID is the unique identifier of the container template, and the corresponding behavior model can be found in the preset behavior model library.

[0042] In a specific embodiment, the data collector deployed by the DaemonSet resource running in the Kubernetes cluster can be used to regularly collect the behavior data of the container to obtain the above first target data.

[0043] Step S202, when there is a behavior model corresponding to the image ID in the preset behavior model library and the model state of the behavior model is the first preset state, determine the behavior model as the target model;

[0044] Specifically, if there is a behavior model corresponding to the image ID in the preset behavior model library, and the state of the model is "trained" (the above first preset state), then determine the behavior model as the "target model".

[0045] Step S203, perform abnormal behavior detection based on the first target data and the target model to obtain the container abnormal detection result;

[0046] Specifically, use the target model to detect the first target data. The model analyzes the behavior characteristics of the data points and compares them with the normal behavior patterns defined in the model to determine whether there is abnormal behavior in the container and then generate the container abnormal detection result.

[0047] Step S204, when the container abnormal detection result is inconsistent with the actual running state of the container, perform backpropagation training on the target model according to the inconsistent container abnormal detection result to update the target model;

[0048] Specifically, compare the container abnormal detection result with the actual running state of the container. If the detection result is inconsistent with the actual running state, that is, there is a false alarm or missed alarm situation, the backpropagation training process will be triggered.

[0049] In a specific implementation, the inconsistent detection results will be marked and added to the negative sample set. Then, preprocess the data in the negative sample set to construct a feature vector set that conforms to the input format of the behavior model. Finally, use the gradient descent method to adjust the model parameters according to the differences between these feature vectors and the model prediction values to improve the accuracy of the model.

[0050] Step S205: Update the preset behavior model library according to the updated target model to detect abnormal behaviors in the first target data obtained next time.

[0051] Specifically, after updating the behavior model, store the model back in the preset behavior model library in the form of a mirror-level key-value pair <Mirror ID, Model ID>, overwriting the original model. This mechanism ensures the real-time performance and accuracy of the models in the behavior model library. At the same time, through continuous data collection and model updates, the invention can continuously learn and adapt to new abnormal behaviors in the container environment, improving the detection effect.

[0052] Through this embodiment, first, obtain the behavior data of the container to obtain multiple pieces of first target data, query the preset behavior model library according to the mirror ID corresponding to the first target data. The container includes software and a running environment, and the mirror ID is used to uniquely identify the mirror that is the template of the container. Then, when there is a behavior model corresponding to the mirror ID in the preset behavior model library and the model state of the behavior model is the first preset state, determine the behavior model as the target model. After that, perform abnormal behavior detection based on the first target data and the target model to obtain a container abnormal detection result. Then, when the container abnormal detection result is inconsistent with the actual running state of the container, perform backpropagation training on the target model according to the inconsistent container abnormal detection result to update the target model. Finally, update the preset behavior model library according to the updated target model to perform the abnormal behavior detection on the first target data obtained next time. In this application, a corresponding behavior model is constructed for each template of the container to detect abnormal behaviors in the container environment, ensuring a perfect match between the model and the container. In addition, this application also sets to dynamically update the behavior model according to the actual running state of the container uploaded by the staff when correcting abnormal behaviors during the process of the behavior model detecting abnormal behaviors in the container environment, so as to cope with the characteristics of the short life cycle and fast changes of the container, and solve the problem that the existing container unknown abnormal detection method cannot be adjusted according to the real-time changes of the container, resulting in a decrease in the accuracy of container abnormal detection during use.

[0053] To determine whether there is a corresponding behavior model for the first target data in the preset behavior model library, in an optional implementation manner, step S201 above includes:

[0054] Step S2011: Determine the mirrors corresponding to each container to obtain target mirrors, and add the behavior data corresponding to the same target mirror to the same set to obtain at least one target set;

[0055] Specifically, in the data collection phase, the running data of the containers is analyzed, including CPU usage, memory usage, network traffic, etc., and at the same time, the image ID corresponding to each container is identified. The container behavior data for the same target image is added to the same set, forming at least one target set.

[0056] For example, if containers A, B, and C are all running the image with image ID 123, then their behavior data will be classified into set 123.

[0057] Step S2012, determine the image ID of the target image as the image ID corresponding to the first target data in the target set;

[0058] Specifically, determine the image ID of the target image as the image ID corresponding to the first target data in the target set.

[0059] For example, if the image IDs of all container behavior data in set 123 are 123, then associate image ID 123 with set 123.

[0060] Step S2013, traverse the first key-value pairs of the behavior models in the preset behavior model library according to the image ID to determine whether there is a behavior model corresponding to the image ID in the preset behavior model library, and the first key-value pair at least includes the image ID and the model status.

[0061] Specifically, traverse the first key-value pairs of the behavior models in the preset behavior model library. Each key-value pair contains at least two fields: the image ID and the model status. By comparing the image ID in the key-value pair with the image ID in the target set, find out whether there is a behavior model corresponding to the target image ID.

[0062] It can be understood that in containerization and virtualization technologies, an image is a template for a container, containing all the configurations and software environments required for the container to run. Each image has a unique ID, called the image ID, which is used to identify different images. Based on the image ID, the behavior data of the containers can be effectively classified and managed, and associated with the behavior models trained for specific images, so as to realize the detection of abnormal behaviors for specific container templates.

[0063] In this application, using the image ID as the key identifier, the collected container behavior data is classified into the corresponding image to form a target set. By querying the preset behavior model library, find the behavior model corresponding to the image ID. If the status of this model is "trained", it can be used to detect abnormal behaviors of the current container.

[0064] Through the above embodiments, by using the image ID as a bridge, the container behavior data is closely associated with the pre-trained behavior model, ensuring the accuracy and pertinence of anomaly detection. Among them, by classifying the container behavior data according to the image ID, the behavior data confusion between different image containers can be avoided, enhancing the efficiency and accuracy of data processing. Further, by querying the preset behavior model library, the trained model applicable to the current container can be quickly located, reducing the uncertainty of model selection. And by judging the model status, it is ensured that only the fully trained models are used for anomaly detection, thus avoiding the misuse of models and improving the reliability of detection.

[0065] In order to construct a behavior model corresponding to the above first target data, in an alternative embodiment, as Figure 3 shown, after querying the preset behavior model library according to the image ID corresponding to the first target data, the above method further includes:

[0066] Step S301, in the case where there is no behavior model corresponding to the image ID in the preset behavior model library, construct a model according to the preset clustering algorithm to obtain a target clustering model, and perform clustering on the target set through the target clustering model to obtain multiple target clustering clusters;

[0067] Specifically, when it is determined that the behavior model of the target image does not exist in the preset behavior model library, a preset clustering algorithm (such as Figure 3 shown, for example, Gaussian mixture model, local outlier factor, support vector data description, etc.) is used to perform preliminary clustering on the behavior data of the target container. The purpose of clustering is to automatically divide the behavior data into several clusters, and these clusters may correspond to different types of running behaviors (normal or abnormal). The algorithm selection needs to be based on data characteristics, such as dimensions and distributions. The behavior data in the target set is processed by the target clustering model to generate multiple target clustering clusters. Each cluster represents a similar behavior pattern, which provides a basis for subsequent classification.

[0068] It can be understood that it is difficult to label the behavior data of unknown abnormal behaviors. This application processes and then classifies through a clustering algorithm, and trains the model in a semi-supervised learning manner to avoid the problem that the labeling operation required in the traditional model training process is difficult to perform.

[0069] In a specific embodiment, the behavior data of the container is collected and preprocessed before training the model, and then the above target set is constructed, where the above preprocessing includes missing value filling, numericalization, normalization, feature extraction, and feature weight ranking, etc.

[0070] Step S302, add a model ID to the target clustering model, and construct a second key-value pair according to the model ID and the image ID;

[0071] Specifically, add a model ID to the constructed target clustering model as its unique identifier in the model library. Then, construct a second key-value pair based on the model ID and the mirror ID for easy management and retrieval in the model library, as Figure 3 shown. The above second key-value pair can be <mirror name (usually the ID), initial model ID (clustering model ID)>.

[0072] Step S303: Determine the target set as the first input data, determine the category of the target clustering cluster as the first label data, and perform supervised training based on the first input data and the first label data to obtain a behavior model;

[0073] Specifically, determine the target set as the first input data, and determine the category of the target clustering cluster (for example, normal behavior cluster and abnormal behavior cluster) as the first label data. Use the first input data and the first label data to perform supervised training to generate a behavior model that can distinguish normal and abnormal behaviors.

[0074] In a specific implementation, as Figure 3 shown, the supervised training can be GBDT or LSYM, etc.

[0075] In another embodiment, as Figure 3 shown, the above first key-value pair can be stored in the form of <mirror name, behavior model ID>, and the model status is marked in the form of a label.

[0076] Step S304: Determine the model status of the behavior model as the second preset status, and construct a first key-value pair based on the model status and the mirror ID;

[0077] Specifically, set the model status of the behavior model to "being trained" or "learning" (the second preset status), and then construct a first key-value pair based on the model status and the mirror ID.

[0078] Step S305: Store the target clustering model and the behavior model in a preset behavior model library according to the first key-value pair and the second key-value pair.

[0079] Specifically, store the target clustering model and the behavior model in a preset behavior model library according to the first key-value pair and the second key-value pair for further training later. The above second preset status will change with subsequent data updates and training.

[0080] In a specific embodiment, assume that in a Kubernetes cluster, a new container with a mirror ID of 987 is deployed, and there is no corresponding model stored in the behavior model library. The above model training process is as follows:

[0081] Data collection: Collect multi-dimensional behavioral data during the operation of the container to form the first target data set.

[0082] Model construction: Since there is no behavioral model for this image ID in the model library, first use the Gaussian Mixture Model (GMM) to cluster the data to generate the target clustering model.

[0083] Clustering and labeling: Cluster the first target data set through the target clustering model to obtain multiple target clustering clusters. Assume that the clustering result divides the behavioral data into two clusters: normal behavior cluster and abnormal behavior cluster. The data in the normal behavior cluster will be marked as the first labeled data of normal behavior, and the data in the abnormal behavior cluster will be marked as the first labeled data of abnormal behavior.

[0084] Model ID generation: Assign a model ID to the generated target clustering model, such as GMM_987_001, and construct a key-value pair <GMM_987_001, 987> for management in the model library.

[0085] Supervised training: Use the first target data set labeled with the first labeled data as input, and train the behavioral model through supervised learning methods (such as GBDT or LSTM). The clustering result is used as a preliminary classification guide during the training process to gradually learn the features for distinguishing normal and abnormal behaviors.

[0086] Model status setting and storage: In the initial stage of training, the status of the behavioral model is set to "training" (the second preset status), and a key-value pair <987, training> is constructed to store the model in the behavioral model library. As more data is input and training progresses, the model status will be updated until the model training is completed.

[0087] Through the above embodiments, by automatically identifying and processing the abnormal detection requirements of the container environment with a new image ID, the detection gap for the new image ID in the model library is filled. Through semi-supervised learning of clustering and classification, it is possible to effectively process a large amount of unlabeled behavioral data and construct an accurate behavioral model, thereby improving the accuracy and efficiency of detection. The mechanism of dynamically generating and updating the model ensures the real-time nature of the model library, enabling the system to quickly adapt to changes in the container environment and reducing the detection difficulty and security risk of unknown threats.

[0088] In another embodiment, such as Figure 4As shown, containers X1, X2, and X3 are all created and run based on the mirror X as a template. Similarly, mirrors Y and Z are respectively used to create the corresponding containers Y1, Y2, and Y3, and Z1, Z2, and Z3, and then the running data of the containers is collected in real time to obtain the container environment behavior data. Furthermore, the container environment behavior data is integrated in units of mirrors to obtain the above-mentioned target set, and a mirror X (Y, Z) behavior model is obtained through model training based on the above-mentioned target set and stored in the container cluster behavior model library (preset behavior model library).

[0089] In order to further train the above-mentioned behavior model, in an optional implementation manner, as Figure 5 shown, after querying the preset behavior model library according to the mirror ID corresponding to the first target data, the above method further includes:

[0090] Step S401, when there is a behavior model corresponding to the mirror ID in the preset behavior model library and the model state of the behavior model is the second preset state, query the preset behavior model library according to the mirror ID to obtain the target clustering model corresponding to the mirror ID;

[0091] Specifically, if there is a behavior model corresponding to the mirror ID in the preset behavior model library and the state is "being trained", the behavior model is trained through forward update. First, query the preset behavior model library according to the mirror ID to obtain the target clustering model (initial model) corresponding to the mirror ID. The target clustering model is a model constructed during the construction of the above-mentioned behavior model and is used to classify a large amount of unlabeled behavior data.

[0092] Step S402, obtain the clustering center of the target clustering cluster with the first preset category in the target clustering model to obtain the first target center, and obtain the clustering center of the target clustering cluster with the second preset category in the target clustering model to obtain the second target center;

[0093] Specifically, from the target clustering model, extract the clustering center of the target clustering cluster with the first preset category, denoted as the first target center, that is, the center corresponding to normal behavior; at the same time, obtain the clustering center of the target clustering cluster with the second preset category, denoted as the second target center, that is, the center corresponding to abnormal behavior.

[0094] Step S403, calculate the distance between the first target data in the target set and the first target center to obtain the first target distance, and calculate the distance between the first target data in the target set and the second target center to obtain the second target distance;

[0095] Step S404: When the first target distance is less than the second target distance, divide the first target data into the target clustering cluster corresponding to the first preset category; when the first target distance is greater than the second target distance, divide the first target data into the target clustering cluster corresponding to the second preset category.

[0096] Specifically, calculate the distance between the first target data in the target set and the first target center to obtain the first target distance (dist1); calculate the distance between the first target data and the second target center to obtain the second target distance (dist2). According to the magnitudes of the first target distance and the second target distance, divide the first target data into the clustering cluster corresponding to the first preset category (normal behavior) or the second preset category (abnormal behavior).

[0097] Step S405: Update the corresponding clustering center according to the updated target clustering cluster.

[0098] Specifically, recalculate the clustering center according to the updated target clustering cluster. This step ensures that the model can be adjusted according to the latest behavior data.

[0099] In a specific embodiment, as Figure 5 shown, calculate the mean of the feature vectors of the sample points in each adjusted target clustering cluster as the new clustering center.

[0100] Step S406: Determine the target set as the second input data, determine the updated clustering center as the second label data, and perform supervised training on the behavior model according to the second input data and the second label data.

[0101] Specifically, use the updated target clustering cluster as the second input data and the updated clustering center as the second label data to perform supervised training on the behavior model. By adding the classification information of the new data, further optimize the parameters of the behavior model and enhance its detection performance.

[0102] Step S407: Update the preset behavior model library according to the updated target clustering model and the behavior model.

[0103] Specifically, update the preset behavior model library according to the updated target clustering model and the behavior model to ensure that the models in the model library are the latest and most suitable for the current container environment state.

[0104] Through the above embodiments, the behavior model is updated positively using the new data to make it more adaptable to the dynamic changes of the container environment, thereby improving the real-time performance and detection accuracy of the model and reducing false alarms and missed detections caused by the obsolescence of the model.

[0105] In a specific embodiment, assume that there are multiple containers using the same image ID (e.g., ID is 1234) in the Kubernetes cluster. There is already a behavior model corresponding to this image ID in the behavior model library, but the status is "under training". Then the forward update steps of the model are as follows:

[0106] Query and acquisition: Query the model library according to the image ID 1234 to obtain the corresponding target clustering model, which contains the clustering centers of two target clustering clusters for normal behavior (the first preset category) and abnormal behavior (the second preset category).

[0107] Distance calculation and classification: For the newly collected behavior data, calculate the distances between each data point and the clustering centers of normal behavior and abnormal behavior. If the distance between the data point and the clustering center of normal behavior is closer, it is classified as normal behavior; otherwise, it is classified as abnormal behavior.

[0108] Clustering center update: Based on the newly classified results, adjust the clustering centers of normal behavior and abnormal behavior. For example, assume that among the newly collected data, most data points are classified as normal behavior, and the clustering center will move towards the mean position of these data points to more accurately represent normal behavior.

[0109] Supervised training: Use the updated clustering clusters as input data and the updated clustering centers as labels to perform supervised training on the behavior model. The model adjusts its parameters by learning the classification information of new data to improve the detection accuracy of new data.

[0110] Model library update: Store the optimized target clustering model and behavior model in the behavior model library to overwrite the original model, ensuring that the latest model can be used for the next detection.

[0111] In order to update the above-mentioned preset behavior model library, in an alternative embodiment, the above step S407 includes:

[0112] Step S4071, obtain preset verification data, input the preset verification data into the updated target model, and obtain the test anomaly detection result;

[0113] Specifically, when the behavior model is updated forward or backward, in order to ensure that the updated model can achieve the expected performance improvement, this application sets to obtain a set of preset verification data, which contains known normal behavior samples and abnormal behavior samples. Then input the verification data into the above-mentioned target model to obtain the above-mentioned anomaly detection result.

[0114] Step S4072, calculate the loss function value of the updated target model according to the test anomaly detection result;

[0115] Specifically, based on the test anomaly detection results, calculate the loss function value of the updated target model (such as mean squared error (MSE), cross-entropy loss, etc.).

[0116] Step S4073, when the loss function value is less than or equal to the first threshold, update the corresponding behavior model in the preset behavior model library according to the behavior model, and update the second preset state in the first key-value pair corresponding to the behavior model to the first preset state;

[0117] Specifically, compare the calculated loss function value with the preset first threshold. If the loss function value is less than or equal to the first threshold, it indicates that the performance of the model after update reaches or exceeds the predetermined standard. At this time, store the updated model in the preset behavior model library, replace the original model, and update the model status to "trained" (the first preset state).

[0118] Step S4074, when the loss function value is greater than the first threshold, only update the corresponding behavior model in the preset behavior model library according to the behavior model.

[0119] Specifically, if the loss function value is greater than the first threshold, it indicates that the performance of the updated model does not meet the expected standard. At this time, although the model has been updated, its status is not changed to "trained", which means that the model is still in the "training" (the second preset state) state.

[0120] Through the above embodiments, by introducing the preset verification data and loss function evaluation mechanism, the present invention can ensure that the decision of model update is based on the actual performance improvement rather than blindly updating. This not only improves the overall quality of the models in the model library, but also avoids the waste of resources caused by ineffective updates, ensuring the efficiency and accuracy of the container environment anomaly detection system.

[0121] In order to update the model through backpropagation, in an alternative embodiment, the above step S204 includes:

[0122] Step S2041, add the inconsistent container anomaly detection results to the negative sample set;

[0123] Specifically, when it is detected that the container anomaly detection results are inconsistent with the actual running state, that is, there are false alarms or missed alarms, in order to correct the model to improve the performance of the model, this application sets to add the inconsistent container anomaly detection results, that is, the container behavior data where the model predicts an anomaly but is actually normal, or the model predicts normal but is actually abnormal, to the negative sample set.

[0124] Step S2042, calculate the accuracy, precision, and recall rate of the target model according to the container anomaly detection results;

[0125] Specifically, based on the container anomaly detection results, calculate the accuracy, precision, and recall rate of the target model. The accuracy is the overall proportion of correct model predictions; the precision reflects the accuracy of the model in predicting anomalies, that is, the proportion of actual anomalies among the containers predicted as anomalies; the recall rate reflects the proportion of all actual anomaly containers detected by the model.

[0126] Step S2043, calculate a comprehensive performance index based on the accuracy, precision, and recall rate. In the case where the comprehensive performance index is less than the previously calculated comprehensive performance index and the difference between the comprehensive performance index and the previously calculated comprehensive performance index is greater than the second threshold;

[0127] Specifically, combine the accuracy, precision, and recall rate to calculate a comprehensive performance index, which can be a weighted average or other combined index defined according to actual needs. Then compare the current comprehensive performance index with the result calculated last time. If the current comprehensive performance index is less than the previous one and the difference is greater than the preset second threshold, it indicates that the model performance has significantly declined and backpropagation training is required to optimize the model.

[0128] Step S2044, traverse the negative sample set, and perform backpropagation training on the target model in turn according to the sample data in the negative sample set using the gradient descent method.

[0129] Specifically, traverse the sample data in the negative sample set and perform backpropagation training on the target model using the gradient descent method. This process adjusts the parameters of the model according to the error between the sample data and the model prediction to reduce the value of the loss function, thereby improving the prediction performance of the model.

[0130] Through the above embodiments, it is possible to effectively utilize the anomaly detection results in the container environment, especially inconsistent detection results, to automatically optimize and update the target model. This method not only improves the adaptability and robustness of the model, but also can dynamically respond to changes in the container environment, reduce false alarms and missed detections caused by outdated or biased models, and improve the accuracy of the entire detection system. Using negative samples for optimization can specifically correct the prediction errors of the model in specific scenarios, avoid blind adjustment of the model, and ensure the effect and efficiency of model update.

[0131] To ensure the accuracy of the model, in an alternative embodiment, the above step S205 includes:

[0132] Step S2051, update the corresponding behavior model in the preset behavior model library according to the target model after backpropagation training, and update the first preset state in the first key-value pair corresponding to the behavior model to the second preset state.

[0133] Specifically, after completing the backpropagation training, update the corresponding target model state in the preset behavior model library from "trained" (the first preset state) to "being trained" (the second preset state), indicating that the model is undergoing further optimization and correction. Store the model after backpropagation training and optimization in the preset behavior model library to replace the original model, ensuring that the model in the library is in the latest and optimized state.

[0134] Through the above embodiments, by dynamically adjusting the model state, it is possible to ensure that the model can still maintain a high detection effect when the container running environment changes, improving the adaptability and robustness of the system. In the field of container security monitoring, this method can effectively process container behavior data, improve the detection efficiency, reduce false positives and false negatives, and provide strong technical support for container security protection.

[0135] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0136] The embodiment of the present application also provides a container anomaly detection device based on dynamically updated behavior models. It should be noted that the container anomaly detection device based on dynamically updated behavior models in the embodiment of the present application can be used to execute the container anomaly detection method based on dynamically updated behavior models provided in the embodiment of the present application. This device is used to implement the above embodiments and preferred implementation manners, and those that have been described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that can achieve a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0137] The following introduces the container anomaly detection device based on dynamically updated behavior models provided in the embodiment of the present application.

[0138] Figure 6 is a structural block diagram of a container anomaly detection device based on dynamically updated behavior models according to an embodiment of the present application. As Figure 6 shown, the device includes:

[0139] A first acquisition unit 10, configured to acquire behavior data of a container to obtain a plurality of first target data, and query a preset behavior model library according to the mirror ID corresponding to the first target data. The container includes software and a running environment, and the mirror ID is used to uniquely identify the mirror that is the template of the container;

[0140] The first determination unit 20 is configured to determine the behavior model as the target model when there is a behavior model corresponding to the mirror ID in the preset behavior model library and the model state of the behavior model is the first preset state;

[0141] The first detection unit 30 is configured to perform abnormal behavior detection according to the first target data and the target model to obtain a container abnormal detection result;

[0142] The first training unit 40 is configured to, when the container abnormal detection result is inconsistent with the actual running state of the container, perform backpropagation training on the target model according to the inconsistent container abnormal detection result to update the target model;

[0143] The first update unit 50 is configured to update the preset behavior model library according to the updated target model to perform abnormal behavior detection on the first target data obtained next time.

[0144] In this embodiment, the first acquisition unit acquires the behavior data of the container to obtain a plurality of first target data, queries the preset behavior model library according to the mirror ID corresponding to the first target data. The container includes software and a running environment, and the mirror ID is used to uniquely identify the mirror that is the template of the container. The first determination unit determines the behavior model as the target model when there is a behavior model corresponding to the mirror ID in the preset behavior model library and the model state of the behavior model is the first preset state. The first detection unit performs abnormal behavior detection according to the first target data and the target model to obtain a container abnormal detection result. The first training unit performs backpropagation training on the target model according to the inconsistent container abnormal detection result to update the target model when the container abnormal detection result is inconsistent with the actual running state of the container. The first update unit updates the preset behavior model library according to the updated target model to perform the abnormal behavior detection on the first target data obtained next time. In this application, a corresponding behavior model is constructed for each template of the container for container environment abnormal detection, ensuring that the model is fully matched with the container. In addition, this application also sets to dynamically update the behavior model according to the actual running state of the container uploaded by the staff during the abnormal behavior correction process when the behavior model performs container environment abnormal detection, so as to cope with the characteristics of short life cycle and fast change of the container, and solves the problem that the existing container unknown abnormal detection method cannot be adjusted according to the real-time changes of the container, resulting in a decrease in the accuracy of container abnormal detection during use.

[0145] In order to determine whether there is a corresponding behavior model for the first target data in the preset behavior model library, in an alternative embodiment, the above-mentioned first acquisition unit includes:

[0146] The first determination module is configured to determine the images corresponding to each container, obtain the target images, add the behavior data corresponding to the same target image to the same set, and obtain at least one target set;

[0147] The second determination module is configured to determine the image ID of the target image as the image ID corresponding to the first target data in the target set;

[0148] The third determination module is configured to traverse the first key-value pairs of the behavior models in the preset behavior model library according to the image ID to determine whether there is a behavior model corresponding to the image ID in the preset behavior model library, and the first key-value pair includes at least the image ID and the model status.

[0149] In an optional implementation manner, in order to construct a behavior model corresponding to the above first target data, the above device further includes:

[0150] The construction unit is configured to, after querying the preset behavior model library according to the image ID corresponding to the first target data, in the case that there is no behavior model corresponding to the image ID in the preset behavior model library, construct a model according to the preset clustering algorithm to obtain a target clustering model, and perform clustering on the target set through the target clustering model to obtain a plurality of target clustering clusters;

[0151] The first processing unit is configured to add a model ID to the target clustering model and construct a second key-value pair according to the model ID and the image ID;

[0152] The second training unit is configured to determine the target set as the first input data, determine the category of the target clustering cluster as the first label data, and perform supervised training according to the first input data and the first label data to obtain a behavior model;

[0153] The second determination unit is configured to determine the model status of the behavior model as the second preset status and construct a first key-value pair according to the model status and the image ID;

[0154] The first storage unit is configured to store the target clustering model and the behavior model into the preset behavior model library according to the first key-value pair and the second key-value pair.

[0155] In an optional implementation manner, in order to further train the above behavior model, the above device further includes:

[0156] The second acquisition unit is configured to, after querying the preset behavior model library according to the image ID corresponding to the first target data, in the case that there is a behavior model corresponding to the image ID in the preset behavior model library and the model status of the behavior model is the second preset status, query the preset behavior model library according to the image ID to obtain the target clustering model corresponding to the image ID;

[0157] A third acquisition unit, configured to acquire the cluster center of a target cluster with a first preset category in the target clustering model to obtain a first target center, and acquire the cluster center of a target cluster with a second preset category in the target clustering model to obtain a second target center;

[0158] A calculation unit, configured to calculate the distance between a first target data in the target set and the first target center to obtain a first target distance, and calculate the distance between the first target data in the target set and the second target center to obtain a second target distance;

[0159] A second processing unit, configured to divide the first target data into the target cluster corresponding to the first preset category when the first target distance is less than the second target distance, and divide the first target data into the target cluster corresponding to the second preset category when the first target distance is greater than the second target distance;

[0160] A second update unit, configured to update the corresponding cluster center according to the updated target cluster;

[0161] A third training unit, configured to determine the target set as the second input data, determine the updated cluster center as the second label data, and perform supervised training on the behavior model according to the second input data and the second label data;

[0162] A third update unit, configured to update the preset behavior model library according to the updated target clustering model and the behavior model.

[0163] In an optional implementation manner for updating the above-mentioned preset behavior model library, the above-mentioned third update unit includes:

[0164] An acquisition module, configured to acquire preset verification data, input the preset verification data into the updated target model, and obtain a test anomaly detection result;

[0165] A first calculation module, configured to calculate the loss function value of the updated target model according to the test anomaly detection result;

[0166] A first update module, configured to, when the loss function value is less than or equal to a first threshold, update the corresponding behavior model in the preset behavior model library according to the behavior model, and update the second preset state in the first key-value pair corresponding to the behavior model to a first preset state;

[0167] A second update module, configured to, when the loss function value is greater than the first threshold, only update the corresponding behavior model in the preset behavior model library according to the behavior model.

[0168] In an optional implementation manner for updating the model through backpropagation, the above-mentioned first training unit includes:

[0169] The first processing module is used to add inconsistent container anomaly detection results to the negative sample set;

[0170] The second calculation module is used to calculate the accuracy, precision, and recall rate of the target model according to the container anomaly detection results;

[0171] The third calculation module is used to calculate the comprehensive performance index according to the accuracy, precision, and recall rate. When the comprehensive performance index is less than the previously calculated comprehensive performance index and the difference between the comprehensive performance index and the previously calculated comprehensive performance index is greater than the second threshold, traverse the negative sample set, and sequentially perform backpropagation training on the target model according to the sample data in the negative sample set by the gradient descent method.

[0172] To ensure the accuracy of the model, in an optional implementation manner, the above first update unit includes:

[0173] The second processing module is used to update the corresponding behavior model in the preset behavior model library according to the target model after backpropagation training, and update the first preset state in the first key-value pair corresponding to the behavior model to the second preset state.

[0174] The above container anomaly detection device based on dynamically updating the behavior model includes a processor and a memory. The above first acquisition unit, first determination unit, first detection unit, first training unit, and first update unit are all stored in the memory as program units, and the processor executes the above program units stored in the memory to implement corresponding functions. The above modules are all located in the same processor; or, the above modules are respectively located in different processors in any combination form.

[0175] The processor contains a kernel, and the kernel retrieves the corresponding program unit from the memory. One or more kernels can be set, and the accuracy of container anomaly behavior detection can be improved by adjusting the kernel parameters.

[0176] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM), and the memory includes at least one storage chip.

[0177] An embodiment of the present invention provides a computer-readable storage medium. The above computer-readable storage medium includes a stored program, wherein when the above program runs, it controls the device where the above computer-readable storage medium is located to execute the above container anomaly detection method based on dynamically updating the behavior model.

[0178] An embodiment of the present invention provides a processor. The above processor is used to run a program, wherein when the above program runs, it executes the above container anomaly detection method based on dynamically updating the behavior model.

[0179] An embodiment of the present invention provides a container monitoring system. The container monitoring system includes a processor, a memory, and a program stored on the memory and executable on the processor. When the processor executes the program, it implements at least the steps of the above-mentioned container anomaly detection method based on the dynamically updated behavior model.

[0180] This application also provides a computer program product. When executed on a data processing device, it is adapted to execute a program initialized with at least the steps of the above-mentioned container anomaly detection method based on the dynamically updated behavior model.

[0181] Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present invention can be implemented by a general-purpose computing device. They can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. They can be implemented by program codes executable by the computing device. Thus, they can be stored in a storage device and executed by the computing device. And in some cases, the steps shown or described here can be executed in a different order, or they can be separately made into individual integrated circuit modules, or multiple modules or steps among them can be made into a single integrated circuit module to implement. In this way, the present invention is not limited to any specific combination of hardware and software.

[0182] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memories, CD-ROMs, optical memories, etc.) containing computer-usable program codes.

[0183] This application is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for realizing the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0184] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means that implement the functions specified in the process(es) Figure 1 one or more processes and / or block(s) Figure 1 specified in one or more block(s) or block(s).

[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in the process(es) Figure 1 one or more processes and / or block(s) Figure 1 specified in one or more block(s) or block(s).

[0186] In a typical configuration, a computing device includes one or more processors (CPUs), an input / output interface, a network interface, and memory.

[0187] The memory may include non-permanent memory in the form of computer-readable media, random access memory (RAM) and / or non-volatile memory such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.

[0188] Computer-readable media includes both permanent and non-permanent, removable and non-removable media implemented by any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile discs (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0189] It should also be noted that the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or apparatus comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or apparatus. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising the element.

[0190] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0191] 1), The container anomaly detection method based on the dynamically updated behavior model of the present application. First, obtain the behavior data of the container to obtain a plurality of first target data, and query the preset behavior model library according to the image ID corresponding to the first target data. The container includes software and a running environment, and the image ID is used to uniquely identify the image that is the template of the container; then, in the case where there is a behavior model corresponding to the image ID in the preset behavior model library and the model state of the behavior model is the first preset state, determine the behavior model as the target model; after that, perform anomaly behavior detection according to the first target data and the target model to obtain a container anomaly detection result; after that, in the case where the container anomaly detection result is inconsistent with the actual running state of the container, perform backpropagation training on the target model according to the inconsistent container anomaly detection result to update the target model; finally, update the preset behavior model library according to the updated target model to perform the anomaly behavior detection on the first target data obtained next time. The present application constructs a corresponding behavior model for each template of the container for container environment anomaly detection, ensuring that the model is fully matched with the container. In addition, the present application also sets to dynamically update the behavior model according to the actual running state of the container uploaded by the staff when correcting the anomaly behavior during the process of the behavior model performing container environment anomaly detection, so as to cope with the characteristics of short life cycle and fast change of the container, and solves the problem that the existing container unknown anomaly detection method cannot be adjusted according to the real-time changes of the container, resulting in a decrease in the accuracy of container anomaly detection during use.

[0192] 2) The container anomaly detection device based on the dynamically updated behavior model of the present application. The first acquisition unit acquires the behavior data of the container to obtain a plurality of first target data, and queries the preset behavior model library according to the image ID corresponding to the first target data. The container includes software and a running environment, and the image ID is used to uniquely identify the image that is the template of the container. The first determination unit determines the behavior model as the target model when there is a behavior model corresponding to the image ID in the preset behavior model library and the model state of the behavior model is the first preset state. The first detection unit performs anomaly behavior detection according to the first target data and the target model to obtain a container anomaly detection result. The first training unit, when the container anomaly detection result is inconsistent with the actual running state of the container, performs backpropagation training on the target model according to the inconsistent container anomaly detection result to update the target model. The first update unit updates the preset behavior model library according to the updated target model to perform the anomaly behavior detection on the first target data obtained next time. The present application constructs corresponding behavior models for each template of the container respectively for container environment anomaly detection, ensuring that the model is fully matched with the container. In addition, the present application also sets to dynamically update the behavior model according to the actual running state of the container uploaded by the staff during the process of anomaly behavior correction when the behavior model performs container environment anomaly detection, so as to cope with the characteristics of short life cycle and fast change of the container, and solves the problem that the existing container unknown anomaly detection method cannot be adjusted according to the real-time changes of the container, resulting in the decline of the container anomaly detection accuracy during use.

[0193] The foregoing are only the preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application.

Claims

1. A container anomaly detection method based on a dynamically updated behavior model, characterized in that, Including: Obtain the behavior data of the container to obtain a plurality of first target data, query a preset behavior model library according to the image ID corresponding to the first target data, where the container includes software and a running environment, and the image ID is used to uniquely identify the image that is the template of the container; When there is a behavior model corresponding to the image ID in the preset behavior model library and the model state of the behavior model is the first preset state, determine the behavior model as the target model; Perform abnormal behavior detection according to the first target data and the target model to obtain a container abnormal detection result; When the container abnormal detection result is inconsistent with the actual running state of the container, perform backpropagation training on the target model according to the inconsistent container abnormal detection result to update the target model; Update the preset behavior model library according to the updated target model to perform the abnormal behavior detection on the first target data obtained next time.

2. The method according to claim 1, characterized in that, Querying the preset behavior model library according to the image ID corresponding to the first target data includes: Determine the images corresponding to the containers to obtain target images, add the behavior data corresponding to the same target image to the same set to obtain at least one target set; Determine the image ID of the target image as the image ID corresponding to the first target data in the target set; Traverse the first key-value pairs of the behavior models in the preset behavior model library according to the image ID to determine whether there is a behavior model corresponding to the image ID in the preset behavior model library, and the first key-value pair at least includes the image ID and the model state.

3. The method according to claim 2, characterized in that After querying the preset behavior model library according to the image ID corresponding to the first target data, the method further includes: When there is no behavior model corresponding to the image ID in the preset behavior model library, construct a model according to a preset clustering algorithm to obtain a target clustering model, and perform clustering on the target set through the target clustering model to obtain a plurality of target clustering clusters; Add a model ID to the target clustering model, and construct a second key-value pair according to the model ID and the image ID; Determine the target set as the first input data, determine the category of the target clustering cluster as the first label data, and perform supervised training according to the first input data and the first label data to obtain the behavior model; Determine the model state of the behavior model as the second preset state, and construct the first key-value pair according to the model state and the image ID; Store the target clustering model and the behavior model in the preset behavior model library according to the first key-value pair and the second key-value pair.

4. The method according to claim 3, characterized in that, After querying the preset behavior model library according to the image ID corresponding to the first target data, the method further includes: When there is the behavior model corresponding to the mirror ID in the preset behavior model library and the model state of the behavior model is the second preset state, query the preset behavior model library according to the mirror ID to obtain the target clustering model corresponding to the mirror ID; Obtain the clustering center of the target clustering cluster with the first preset category in the target clustering model to obtain a first target center, and obtain the clustering center of the target clustering cluster with the second preset category in the target clustering model to obtain a second target center; Calculate the distance between the first target data in the target set and the first target center to obtain a first target distance, and calculate the distance between the first target data in the target set and the second target center to obtain a second target distance; When the first target distance is less than the second target distance, divide the first target data into the target clustering cluster corresponding to the first preset category, and when the first target distance is greater than the second target distance, divide the first target data into the target clustering cluster corresponding to the second preset category; Update the corresponding clustering center according to the updated target clustering cluster; Determine the target set as the second input data, determine the updated clustering center as the second label data, and perform supervised training on the behavior model according to the second input data and the second label data; Update the preset behavior model library according to the updated target clustering model and the behavior model.

5. The method according to claim 4, characterized in that, Updating the preset behavior model library according to the behavior model includes: Obtain preset verification data, input the preset verification data into the updated target model, and obtain a test anomaly detection result; Calculate the loss function value of the updated target model according to the test anomaly detection result; When the loss function value is less than or equal to the first threshold, update the corresponding behavior model in the preset behavior model library according to the behavior model, and update the second preset state in the first key-value pair corresponding to the behavior model to the first preset state; When the loss function value is greater than the first threshold, only update the corresponding behavior model in the preset behavior model library according to the behavior model.

6. The method according to claim 1, characterized in that Perform backpropagation training on the target model according to the inconsistent container anomaly detection results to update the target model, including: Add the inconsistent container anomaly detection results to the negative sample set; Calculate the accuracy, precision, and recall rate of the target model according to the container anomaly detection results; Calculate a comprehensive performance index according to the accuracy, the precision, and the recall rate. When the comprehensive performance index is less than the previously calculated comprehensive performance index and the difference between the comprehensive performance index and the previously calculated comprehensive performance index is greater than the second threshold; Traverse the negative sample set, and perform backpropagation training on the target model in turn according to the sample data in the negative sample set by the gradient descent method.

7. The method according to any one of claims 4, characterized in that, Updating the preset behavior model library according to the updated target model, including: Updating the corresponding behavior model in the preset behavior model library according to the target model after backpropagation training, and updating the first preset state in the first key-value pair corresponding to the behavior model to the second preset state.

8. An abnormal container detection device based on a behavior model, characterized in that The device includes: A first acquisition unit, configured to acquire behavior data of a container to obtain a plurality of first target data, query a preset behavior model library according to the image ID corresponding to the first target data, where the container includes software and a running environment, and the image ID is used to uniquely identify an image that is a template of the container; A first determination unit, configured to determine the behavior model as a target model when there is a behavior model corresponding to the image ID in the preset behavior model library and the model state of the behavior model is the first preset state; A first detection unit, configured to perform abnormal behavior detection according to the first target data and the target model to obtain a container abnormal detection result; A first training unit, configured to, when the container abnormal detection result is inconsistent with the actual running state of the container, perform backpropagation training on the target model according to the inconsistent container abnormal detection result to update the target model; A first update unit, configured to update the preset behavior model library according to the updated target model to perform the abnormal behavior detection on the first target data acquired next time.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein when the program runs, it controls the device where the computer-readable storage medium is located to execute the method according to any one of claims 1 to 7.

10. A container monitoring system, characterized in that, Including: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include instructions for executing the method according to any one of claims 1 to 7.

Images