Container escape detection method and system based on automatic machine learning model

Abstract

The invention discloses a container escape detection method and system based on an automatic machine learning model, and the method comprises the steps: collecting system call, network flow, configuration parameters and other multi-dimensional feature data in real time through a container cluster monitoring engine, and employing the combination of KMeans SMOTE and GANs to solve the problem of data imbalance. And multiple models such as XGBoost and random forest are trained in parallel, dynamic parameter adjustment is performed through Bayesian optimization, and finally a high-precision detection result is output based on model performance weighting integration. And the balance problem of multi-dimensional feature adaptation and detection efficiency in a complex container environment is effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of container security, and in particular to a container escape detection method and system based on an automatic machine learning model. Background Art

[0002] Containerization technologies (such as Docker / Kubernetes) have become the core support for cloud computing and microservices architectures, but their widespread adoption has also increased the risk of container escape attacks. Attackers may exploit vulnerabilities or configuration flaws to break through container isolation and access the host or other container resources, leading to security issues such as data leaks. Current mainstream detection technologies have significant limitations:

[0003] Relying on static configuration checks (such as privileged mode recognition) or dynamic log keyword matching, it is difficult to adapt to dynamic environments and cannot effectively detect complex evasion attacks; manual feature engineering and parameter tuning are required, and the ability to handle data imbalance and feature interaction is insufficient; for example, LSTM-based sequence analysis has poor scenario adaptability and lacks the ability to integrate multi-dimensional features.

[0004] As the scale of container clusters continues to expand, existing technologies face severe challenges in detection efficiency, accuracy, and adaptability to dynamic environments. There is an urgent need for innovative solutions that can automatically integrate multi-dimensional features and balance detection accuracy and false alarm rates.

[0005] Therefore, a container escape detection method based on automatic machine learning models is desired. Summary of the Invention

[0006] To address the above technical issues, the present application proposes an embodiment of a container escape detection method based on an automated machine learning model, which can automatically collect and obtain relevant data from a container cluster, identify whether there is container escape behavior in the current batch of data, and then generate an alarm response system.

[0007] According to one aspect of the present application, a container escape detection method based on an automatic machine learning model is provided, which includes: collecting multi-dimensional feature data of a container cluster through a container cluster monitoring engine; cleaning, standardizing and feature selecting the data, and solving the imbalance problem through data enhancement processing; training multiple base learners and optimizing hyperparameters, and selecting the optimal model for ensemble learning; adaptively tuning the threshold of the ensemble model to generate a container escape detection model; locating abnormal containers based on the detection results and sending alarm information.

[0008] Preferably, the data enhancement processing includes: oversampling minority class samples using the KMeansSMOTE method; generating synthetic data through GANs to balance the distribution of the data set.

[0009] Preferably, the hyperparameter optimization uses a Bayesian optimization algorithm to search for the optimal parameter combination in multiple hyperparameter spaces.

[0010] Preferably, the ensemble learning includes: selecting an adapted base learner according to the data modality of the container escape characteristics; and fusing the prediction results of the base learners by weighted voting or stacking method.

[0011] Preferably, the adaptive threshold tuning dynamically adjusts the model classification threshold to optimize detection performance based on the false alarm rate and missed alarm rate tolerance of the container environment.

[0012] According to one aspect of the present application, a container escape detection system based on an automatic machine learning model is also provided, including: a container cluster monitoring engine, which is used to collect system call logs, process behavior, system configuration, file call operations and network traffic data of the container cluster, and perform weighted screening based on container escape characteristics; an automatic machine learning model engine, including a data preprocessing module, a multi-model training module, a model integration learning module and a model evaluation and optimization module, which is used to clean, standardize, model train, integrate learning and threshold tune the filtered data to generate an escape detection model adapted to the container environment; an alarm response engine, which is used to locate abnormal containers and send alarm information to the operation and maintenance platform.

[0013] Preferably, the container cluster monitoring engine includes: a log collection module for collecting container runtime logs and cluster system logs; a configuration collection module for obtaining container and cluster configuration information through an API; and a behavior collection module for monitoring container system calls, file access, and process creation behaviors.

[0014] Preferably, the data preprocessing module uses KMeansSMOTE or GANs method to perform data enhancement on the container escape dataset to solve the data imbalance problem.

[0015] Preferably, the multi-model training module performs hyperparameter tuning on the base learner through random search or Bayesian optimization, and selects the optimal model to input into the model ensemble learning module.

[0016] Preferably, the model ensemble learning module performs weighted fusion on multiple base learners based on the prediction result index to generate a fusion model, and optimizes the false alarm rate and the missed alarm rate through adaptive threshold tuning.

[0017] Current container escape detection methods are incapable of adapting to multi-dimensional feature data and require additional adaptation methods to specifically process datasets. Furthermore, traditional machine learning detection methods rely on a single model, requiring an automated machine learning engine to train and integrate models for optimal results and robust environmental adaptability.

[0018] The container escape detection method designed in the present invention mainly consists of the continuous steps of the automatic machine learning (AutoML) model engine. It obtains multi-dimensional feature data through the container cluster monitoring engine, preprocesses it using the data preprocessing module, and screens, encodes and standardizes high-weight features. The multi-model training module sends the data set to the model in the model library for training and tuning, and then performs model evaluation to select the dominant model. The model ensemble learning module analyzes the results and integrates multiple base learners according to the indicators to generate a fusion model. The model evaluation and optimization module adjusts the fusion model threshold for further optimization, and finally performs model evaluation again based on the container escape environment.

[0019] Container escape detection methods require a combination of input and output components to adapt to diverse environments and needs. This system automatically collects relevant data from container clusters, identifies whether container escape behavior exists in the current batch of data, and then generates alerts and responds. This system primarily consists of a container cluster monitoring engine, an automated machine learning (AutoML) model engine, and an alert response engine. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above and other purposes, features, and advantages of the present application will become more apparent through a more detailed description of the embodiments of the present application in conjunction with the accompanying drawings. The accompanying drawings are intended to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the drawings, the same reference numerals generally represent the same components or steps.

[0021] Figure 1 This is an architecture diagram of a container escape detection system based on an automatic machine learning model according to an embodiment of the present application.

[0022] Figure 2 The present invention provides a flowchart of a container escape detection method based on an automatic machine learning model according to an embodiment of the present application.

[0023] Figure 3 This is a scenario diagram of a container escape detection method and system based on an automatic machine learning model according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] Various exemplary embodiments, features, and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise indicated.

[0025] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0026] In addition, numerous specific details are provided in the following detailed description to better illustrate the present application. Those skilled in the art will appreciate that the present application can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art are not described in detail in order to highlight the main purpose of the present application.

[0027] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. Throughout the description of this application, "plurality" means two or more, unless otherwise specifically defined.

[0028] With the development of society, containerization technologies (such as Docker and Kubernetes) have been widely used in modern cloud computing and microservices architectures due to their efficient application management and deployment capabilities. However, with the prevalence of containerized environments, container escape has become an increasingly serious problem, becoming a major challenge in container security. Malicious users can exploit vulnerabilities or improper configurations to break through container isolation and access resources on the host or other containers, leading to data leaks, service interruptions, and even system attacks.

[0029] Therefore, ensuring the normal operation and security of container clusters has become a key issue for cloud environments and container application services. Among the many challenges in container security, efficient and accurate targeted detection of container environments, identifying abnormal behavior or malicious operations, and flexibly preventing container escapes are particularly important. To address this, traditional container security measures typically rely on static configuration checks, manual log analysis, and rule-based detection systems. While these approaches are effective in certain scenarios, they also have significant limitations. Especially with large-scale container clusters and dynamically changing container configurations, manual intervention is cumbersome and difficult to guarantee effectiveness. This is primarily due to the widespread use of container environments, which has led to the rapid expansion of container clusters. According to statistics, the global cloud container market is expected to reach US$330 billion in 2024. As container clusters expand in size and their applications become more complex, traditional detection methods often struggle to cope, resulting in significant workload and low accuracy.

[0030] Currently, solutions to container escapes mainly focus on the following technical paths:

[0031] 1. Static or dynamic analysis of configuration, logs, traffic, and other information in the container environment based on preset rules. Static analysis detects potential risks by checking whether the container is running in privileged mode and whether unnecessary ports or permissions are open. However, this method relies on fixed rules and cannot adapt to the dynamically changing container environment. It also has difficulty detecting complex container escape attack behaviors. Dynamic log analysis monitors the container's operation logs to identify potential threats such as abnormal operations or illegal processes. However, due to its reliance on manual rules or set keywords, it is often difficult to detect container escape behaviors efficiently and comprehensively. In addition, the large amount of logs affects the detection effect.

[0032] 2. Traditional machine learning-based container escape detection methods automatically detect container escape behavior by training classification models. Methods such as decision trees and random forests can process large amounts of feature data to capture potential attack behaviors and patterns. However, these methods often require manual tuning of features and model hyperparameters, making them difficult to handle data imbalance and complex feature interactions. Furthermore, they lack optimization specifically for container escapes. Therefore, existing traditional methods struggle to achieve efficient and accurate detection in container environments.

[0033] To address these issues, some researchers have proposed developing container monitoring modules that detect anomalies by monitoring metrics like system calls and file changes. However, the data is often cluttered, making it difficult to identify effective escape indicators and patterns. Other researchers have used neural network methods for anomaly detection, specifically using LSTM to analyze feature vector sequence data. However, these methods are targeted at specific scenarios, lack flexibility and broad adaptability, and cannot meet the comprehensive needs of container environments.

[0034] In general, existing technologies present the following challenges: First, container environment detection methods based on traditional detection technologies fail to fully adapt to the multi-dimensional characteristics of container environments or lack optimization adjustments for specific container environments, resulting in poor performance in practical applications. Second, traditional machine learning models or neural network methods often fail to achieve efficient feature processing and accurate model selection when handling container escape detection due to the complexity and diversity of feature data. Therefore, existing technologies present significant limitations in container escape detection, necessitating the need for more innovative and optimized technical solutions.

[0035] Therefore, the present invention proposes a container escape detection method and system based on an automated machine learning model. The present invention is further described in detail below with reference to the accompanying drawings and specific implementation methods:

[0036] In the technical solution of the present application, a container escape detection method based on an automatic machine learning model is proposed, including the following steps: collecting multi-dimensional feature data of a container cluster through a container cluster monitoring engine; cleaning, standardizing and feature selecting the data, and solving the imbalance problem through data enhancement processing; training multiple base learners and performing hyperparameter optimization, and selecting the optimal model for ensemble learning; adaptively tuning the threshold of the ensemble model to generate a container escape detection model; locating abnormal containers based on the detection results and sending alarm information.

[0037] It's understandable that the multi-dimensional feature data of a container cluster covers all aspects of container runtime, such as system call logs, process behavior, system configuration, file call operations, and network traffic data. This data comprehensively reflects the operating status and behavioral patterns of the containers, providing a rich information foundation for subsequent analysis and detection. Different container escape attacks may manifest anomalies along different dimensions. For example, some attacks may involve a large number of system calls, while others may primarily manifest through unusual changes in network traffic. By collecting multi-dimensional data, we can more accurately capture characteristics related to container escapes, improving the comprehensiveness and accuracy of detection.

[0038] Raw data may contain noise, missing values, and outliers, all of which can affect model training performance. Data cleaning can remove or correct this invalid or erroneous data, improving data purity and reliability. Data with different features may have different dimensions and numerical ranges. Directly using this data for model training may result in some features having an overly or underlying influence on the model. Normalizing the data to a consistent scale helps improve model stability and convergence speed. Feature selection can identify the most valuable features for container escape detection and remove redundant or irrelevant features, thereby reducing model complexity and improving model training efficiency and generalization. In container escape detection, data on normal container behavior often far outnumbers data on escape behavior, resulting in an imbalanced data distribution. Oversampling minority class samples using the KMeansSMOTE method or generating synthetic data using GANs can increase the number of minority class samples and balance the dataset distribution, enabling the model to fully learn the characteristics of escape behavior during training and improving its detection capabilities.

[0039] Different base learners have different algorithmic principles and characteristics, and their data fit and generalization capabilities vary. Training multiple base learners can fully leverage their diversity, modeling and analyzing container escape behavior from different perspectives, and improving the overall model performance. Hyperparameters have a significant impact on model performance. Hyperparameter optimization methods such as Bayesian optimization can search for optimal parameter combinations across multiple hyperparameter spaces, allowing each base learner to be trained with its optimal hyperparameter configuration and fully realize its performance potential. Ensemble learning, by fusing the prediction results of multiple base learners, can effectively reduce model variance and bias, improving model stability and accuracy. For example, fusing the prediction results of base learners through weighted voting or stacking methods can comprehensively consider the opinions of each model and make more reliable decisions.

[0040] Different container environments may have different tolerances for false positives and false negatives. Adaptive threshold tuning dynamically adjusts the model's classification threshold based on the specific needs of the container environment, optimizing the model's detection performance in that environment. Adaptive threshold tuning reduces false positives while minimizing the number of missed detections of true escape attempts, thereby increasing the model's practical application value.

[0041] Once a container escape is detected, the anomalous container is promptly located and alerts are sent to operations personnel, enabling them to quickly take action, such as isolating the anomalous container, conducting security inspections, and remediating it. This effectively prevents the further spread of the attack and reduces security risks. Integration with the operations platform enables automated container security management, improves operations efficiency, reduces manual intervention costs, and ensures the stable operation of container clusters.

[0042] In an embodiment of the present application, the data enhancement processing step includes: oversampling minority class samples using the KMeansSMOTE method; generating synthetic data through GANs to balance the distribution of the data set. The hyperparameter optimization uses a Bayesian optimization algorithm to search for the optimal parameter combination in multiple hyperparameter spaces. The ensemble learning includes: selecting an adapted base learner based on the data modality of the container escape characteristics; fusing the prediction results of the base learner through weighted voting or stacking methods. The adaptive threshold tuning dynamically adjusts the model classification threshold to optimize detection performance based on the false alarm rate and false negative rate tolerance of the container environment.

[0043] Furthermore, a container escape detection method and system architecture based on automatic machine learning model is shown in the following figure: Figure 1 As shown in the figure, the system consists of a container cluster, a container cluster monitoring engine, an automatic machine learning model engine, etc.

[0044] The container cluster monitoring engine collects all data through the container cluster monitoring engine, which collects system call logs, process behavior, system configuration, file call operations, and network traffic behavior in the container cluster through its submodules. The collected data is weighted based on its importance and impact in the context of a container escape, based on known normal container behavior and escape behavior patterns, with a focus on events or indicators that signal a container escape. The specific components of the engine are as follows:

[0045] Log collection module: Responsible for collecting container runtime logs, including the container's standard output and standard error, and the system logs of the cluster environment. This is particularly important when targeting cross-container attacks. For the Kubernetes container management platform, its log management mechanism is used for centralized collection.

[0046] Configuration Collection Module: This module collects container and cluster configuration data and identifies potential risks, such as privileged modes, sensitive port information, and container permission configuration. Configuration files for the Kubernetes container management platform can be collected through the client-go API.

[0047] Behavior collection module: This module monitors the behavior of containers in the cluster, including system calls, file access, process creation interactions, and other activities. For example, calls to networks, files, and processes can be collected using sysdig and auditd.

[0048] The automatic machine learning model engine focuses on machine learning automation. It detects abnormal escape behaviors in container environments by strengthening machine learning model selection, training, integration, and optimization in container environments. At the same time, it connects to the container cluster monitoring engine and the alarm response engine to perform feature engineering on batches of container cluster logs, extract features for container escapes, and preprocess data. It uses KMeansSMOTE and GANs methods to enhance data for the imbalanced features of container escape datasets.

[0049] Then, multiple models are trained and learned separately, and automatic hyperparameter tuning is performed for each model. Search is performed in multiple hyperparameter spaces, and random search or Bayesian optimization is considered to adjust appropriate hyperparameters.

[0050] Evaluate model training results and select a model optimized for container escapes based on the characteristics of container environment data. Classify the selected base learners based on their prediction performance. Use different base learners for features of different data modalities, such as logs and system calls. Through weighted fusion of models, perform ensemble learning to form a detection model more suitable for container environments. Use the evaluation and optimization module to further optimize adaptive thresholds, focusing on the tolerance for false positives and false negatives in the container environment. The engine's detailed structure is as follows:

[0051] Data preprocessing module: Selects appropriate features from the cluster container environment and performs operations such as data cleaning, standardization, and feature selection. It also filters and combines features with container escape characteristics, such as those that occur across namespaces.

[0052] Multi-model training module: This module trains multiple machine learning models to observe the advantages and disadvantages of different algorithms for container escape behavior data, and selects the appropriate model to improve overall prediction results.

[0053] Model ensemble learning module: The core goal is to screen the prediction results of multiple base learners, combine them with ensemble learning algorithms to fuse models, generate more accurate prediction models, and improve recognition accuracy and model robustness.

[0054] Model evaluation and optimization module: It consists of two parts. One part is responsible for evaluating and tuning the model results of the multi-model training module, and the other part is responsible for automatic threshold tuning of the integrated learning model.

[0055] The alarm response engine, after detecting an anomaly in a container cluster using the container escape detection method, needs to reverse locate the anomaly entry and deliver the alarm message. This engine consists of an anomaly location module and a message delivery module. The engine's specific components are as follows:

[0056] Anomaly Location Module: This module performs reverse location operations on abnormal data items detected by the automatic machine learning model engine, determines the namespace and path source corresponding to the abnormal data items, and reversely locates the location of the abnormal container.

[0057] Message transmission module: This module is mainly responsible for logging and storing abnormal data items, processing abnormal messages into common formats, connecting to cluster monitoring components or other container cluster integrated operation and maintenance management platforms, and sending alarm information.

[0058] The process of the container escape detection method based on automatic machine learning model designed by the present invention is as follows: Figure 2As shown, the specific steps are as follows: S201: Container escape detection system is deployed, the user sends a request, and the process starts; S202: The container cluster monitoring engine receives the request sent by the user; S203: The container cluster monitoring engine determines the collection object according to the container environment and calls the collection module; S204: The log, configuration, and behavior collection modules make collection requests for corresponding content according to the container objects selected by the engine; S205: The container cluster monitoring engine performs feature screening on the collected data set according to the weighted selection results and sends the data set to the automatic machine learning model engine; S206: The data preprocessing module performs data cleaning, standardization, feature selection and other operations and then sends it to the multi-model training module; S207: The multi-model training module forms multiple training results through multi-model training and integrates the results The model is sent to the model evaluation and optimization module; S208: the model evaluation and optimization module performs evaluation and hyperparameter optimization, and then sends it to the multi-model training module for optimization, and sends the optimized multiple base learners to the model ensemble learning module; S209: the model ensemble learning module selects a suitable base learner according to the ensemble learning algorithm to perform ensemble learning training model and sends the ensemble model prediction result to the model evaluation and optimization module; S210: the model evaluation and optimization module performs evaluation and automatic threshold tuning, and then sends it to the model ensemble learning module for optimization, and encapsulates the optimized ensemble model for output; S211: the alarm response engine calls the anomaly location module to locate the original container position of the anomaly entry; S212: the alarm response engine records the anomaly and runs the message passing module for alarm processing.

[0059] This method uses automated machine learning models to detect escapes in container environments, integrating the automated training processes of multiple models. Through multi-model evaluation of training results, high-quality models are selected for further integrated learning to enhance container escape detection capabilities, thereby achieving automated model training, integration, and tuning. Furthermore, targeted adaptation is performed based on multimodal container cluster feature data, adjusting for data imbalance and model weighting during model training and integration, thus implementing an automated machine learning model engine for container cluster environments.

[0060] In summary, the present invention provides a container escape detection system that integrates an automatic machine learning model method. Generally speaking, the multidimensionality of data features in a container cluster environment increases the difficulty of container escape detection. The solution optimizes the multidimensional data features in the escape detection means and the container characteristics of the machine learning process, generates an automated machine learning model engine, and implements an overall container escape detection system, achieving multidimensional feature adaptation and optimization as well as automated model integration learning. Container escape detection can be performed automatically, quickly, and universally without developer participation. Compared with similar research, this method is more adaptable and comprehensive, makes more full use of the multidimensional features of container clusters, and is more suitable for container escape detection environments.

[0061] Through the present invention, operation and maintenance personnel do not need to redesign or change the container environment and cluster log collector. They only need to deploy the container escape detection system in the container environment that needs to be detected, saving human resource costs. There is no need for developers to manually process data sets or run multiple models separately for training and comparison. They only need to set the required data set features and input them into the automatic machine learning model engine, reducing the developer's model training costs and time. This solution analyzes the features in the container escape environment, optimizes the automatic machine learning model engine's weights for the multi-dimensional features of the container environment, and reduces the adaptation time cost. This solution is developed for common container platforms (such as Docker, Kubernetes), is not limited to cluster size, and only requires the corresponding container cluster to be connected to work. It is suitable for most container escape detection scenarios and has stronger universality than previous methods.

[0062] Further, if Figure 3 The figure below illustrates a specific implementation scenario for a container escape detection method and system based on an automated machine learning model. The container escape detection system connects container clusters A, B, and C with an operations and maintenance alert response platform. The operations and maintenance alert response platform can be a monitoring component of the container cluster itself or a comprehensive alert platform for the entire system or cluster. The interactive process for detecting container escape behavior is as follows:

[0063] 1) Container clusters A, B, and C are operating normally and contain multiple container applications. The container cluster monitoring engine of the container escape detection system calls three internal collection modules to request data from the three container clusters.

[0064] 2) Container clusters A, B, and C receive the request and obtain the system call logs, process behavior, system configuration, file call operations, and network traffic of the cluster containers based on the corresponding API call content;

[0065] 3) Based on the collection module's request, the container returns relevant data, and the container cluster monitoring engine performs multi-dimensional feature selection on the raw data, such as CNS counts of event occurrences or cross-namespace events filtered by rules;

[0066] 4) The container cluster monitoring engine sends the filtered multi-dimensional features to the data preprocessing module of the automated machine learning model engine for data cleaning, missing value processing, encoding, and standardization. The processed dataset is then augmented using KMeans SMOTE or GANs to reduce the impact of data imbalance. The dataset is then fed into the multi-model training module.

[0067] 5) The multi-model training module uses multiple base learners in the model library to train the data set separately, and sends the training results to the model evaluation and optimization module for evaluation and hyperparameter optimization. It then trains again and transmits the final multiple optimal base learners to the model ensemble learning module;

[0068] 6) The model ensemble learning module receives multiple base learners and their prediction result indicators from the multi-model training module, calls the ensemble learning algorithm to perform targeted ensemble learning based on the container environment, generates a fusion model and prediction results, and sends them to the model evaluation and optimization module for automatic threshold tuning to select appropriate ensemble model parameters;

[0069] 7) After receiving the tuned ensemble model parameters, the model ensemble learning module trains the ensemble model again and generates prediction results;

[0070] 8) The alarm response engine receives the prediction results of the model integration learning module, extracts the abnormal items in the data set and locates the cluster containers involved, and connects to the operation and maintenance alarm response platform for alarm processing.

[0071] While various embodiments of the present disclosure have been described above, the above descriptions are illustrative, non-exhaustive, and not intended to be limiting of the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to existing technologies, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A container escape detection method based on an automatic machine learning model, characterized in that: include: Collect multi-dimensional feature data of the container cluster through the container cluster monitoring engine; Clean, standardize and select features of data, and solve the imbalance problem through data enhancement; Train multiple base learners and perform hyperparameter optimization, then select the optimal model for ensemble learning; Adaptively tune the threshold of the integrated model to generate a container escape detection model; Based on the detection results, the abnormal container is located and an alarm message is sent.

2. The container escape detection method based on the automatic machine learning model according to claim 1 is characterized in that: The data enhancement processing includes: Use KMeansSMOTE method to oversample minority class samples; Generate synthetic data through GANs to balance the dataset distribution.

3. The container escape detection method based on the automatic machine learning model according to claim 2 is characterized in that: The hyperparameter optimization uses a Bayesian optimization algorithm to search for the optimal parameter combination in multiple hyperparameter spaces.

4. The container escape detection method based on the automatic machine learning model according to claim 3 is characterized in that: The ensemble learning includes: Select an adaptive base learner based on the data modality of the container escape characteristics; The prediction results of the base learners are fused through weighted voting or stacking methods.

5. The container escape detection method based on the automatic machine learning model according to claim 4 is characterized in that: The adaptive threshold tuning dynamically adjusts the model classification threshold to optimize detection performance based on the false alarm rate and false negative rate tolerance of the container environment.

6. A container escape detection system based on an automatic machine learning model, characterized in that: include: The container cluster monitoring engine collects system call logs, process behavior, system configuration, file call operations, and network traffic data of the container cluster, and performs weighted screening based on container escape characteristics. The automated machine learning model engine, which includes a data preprocessing module, a multi-model training module, a model ensemble learning module, and a model evaluation and optimization module, is used to clean, standardize, train models, perform ensemble learning, and optimize thresholds on filtered data to generate an escape detection model adapted to the container environment. The alarm response engine is used to locate abnormal containers and send alarm information to the operation and maintenance platform.

7. The container escape detection system based on the automatic machine learning model according to claim 6 is characterized in that: The container cluster monitoring engine includes: Log collection module, used to collect container runtime logs and cluster system logs; Configuration collection module, used to obtain container and cluster configuration information through API; The behavior collection module is used to monitor the system calls, file access, and process creation behaviors of the container.

8. The container escape detection system based on the automatic machine learning model according to claim 7 is characterized in that: The data preprocessing module uses KMeansSMOTE or GANs method to perform data enhancement on the container escape dataset to solve the data imbalance problem.

9. The container escape detection system based on the automatic machine learning model according to claim 8 is characterized in that: The multi-model training module performs hyperparameter tuning on the base learner through random search or Bayesian optimization, and selects the optimal model to be input into the model ensemble learning module.

10. The container escape detection system based on the automatic machine learning model according to claim 9 is characterized in that: The model ensemble learning module performs weighted fusion on multiple base learners based on the prediction result index to generate a fusion model, and optimizes the false alarm rate and the missed alarm rate through adaptive threshold tuning.

Images