Container vulnerability scanning method for protecting cloud security and related device

Abstract

The invention provides a container vulnerability scanning method for protecting cloud security and a related device, and the method comprises the steps: responding to a detected file opening event in a host machine, and determining the container information of a target container generating the file opening event and a target file path associated with the file opening event; determining target vulnerability information of a target container mirror image from the host machine vulnerability information according to the container information of the target container; wherein the target container is generated by a target container mirror image, vulnerability information of at least one container mirror image associated with the host machine is stored in the host machine vulnerability information, and the vulnerability information of the at least one container mirror image comprises a mapping relation between vulnerabilities and paths where the vulnerabilities are located; and determining a target vulnerability corresponding to the target file path according to the target file path and a mapping relationship between vulnerabilities in the target vulnerability information and paths where the vulnerabilities are located. According to the method, static vulnerability scanning and dynamic vulnerability scanning are combined, and container load safety and cloud safety can be protected.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a container vulnerability scanning method, device, electronic device, computer-readable storage medium, and computer program product for protecting cloud security. Background Art

[0002] With the continuous development of computer technology, especially virtualization technology, containers have emerged. Containers are lightweight, portable software runtime environments that package applications and their dependencies together, allowing them to run in any container-supported environment. This allows applications to maintain a consistent operating state across different runtime environments.

[0003] In cloud-native security, container vulnerabilities are often the entry point for intrusion into virtualized environments. Therefore, scanning for container vulnerabilities can, to a certain extent, ensure container workload security and protect cloud security. However, in actual applications, each container may contain a large number of vulnerabilities, making it difficult for security operations personnel to quickly scan for vulnerabilities that have a significant impact on container security. Summary of the Invention

[0004] This application provides a container vulnerability scanning method for protecting cloud security. This method combines static vulnerability scanning with dynamic vulnerability scanning to achieve targeted, efficient, and real-time container vulnerability scanning. This application also provides a corresponding device, electronic device, computer-readable storage medium, and computer program product.

[0005] In a first aspect, the present application provides a container vulnerability scanning method for protecting cloud security, the method comprising:

[0006] In response to detecting a file open event in the host machine, determining container information of a target container generating the file open event and a target file path associated with the file open event;

[0007] Determining target vulnerability information of a target container image from host vulnerability information based on the container information of the target container; wherein the target container is generated by the target container image, the host vulnerability information stores vulnerability information of at least one container image associated with the host, and the vulnerability information of the at least one container image includes a mapping relationship between a vulnerability and a path where the vulnerability is located;

[0008] The target vulnerability corresponding to the target file path is determined according to the target file path and the mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located.

[0009] In a second aspect, the present application provides a container vulnerability scanning device for protecting cloud security, the device comprising:

[0010] a first determining module, configured to, in response to detecting a file open event in a host machine, determine container information of a target container generating the file open event and a target file path associated with the file open event;

[0011] a second determination module, configured to determine target vulnerability information of a target container image from host vulnerability information based on the container information of the target container; wherein the target container is generated by the target container image, the host vulnerability information stores vulnerability information of at least one container image associated with the host, and the vulnerability information of the at least one container image includes a mapping relationship between a vulnerability and a path where the vulnerability is located;

[0012] The third determining module is configured to determine a target vulnerability corresponding to the target file path according to the target file path and a mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located.

[0013] In a third aspect, the present application provides an electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is configured to execute instructions stored in the memory to cause the electronic device to perform the container vulnerability scanning method according to the first aspect or any implementation of the first aspect.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, wherein the instructions instruct an electronic device to execute the container vulnerability scanning method described in the first aspect or any implementation of the first aspect.

[0015] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the container vulnerability scanning method described in the first aspect or any one of the implementations of the first aspect.

[0016] Based on the implementation methods provided in the above aspects, this application can also be further combined to provide more implementation methods.

[0017] It can be seen from the above technical solutions that this application has the following advantages:

[0018] The present application provides a container vulnerability scanning method for protecting cloud security. In response to detecting a file open event in a host machine, the method determines the container information of a target container that generates the file open event and a target file path associated with the file open event. Then, based on the container information of the target container, target vulnerability information of a target container image is determined from host vulnerability information, wherein the target container is generated by a target container image, the host vulnerability information stores vulnerability information of at least one container image associated with the host machine, and the vulnerability information of at least one container image includes a mapping relationship between a vulnerability and a path where the vulnerability is located. Based on the target file path and the mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located, a target vulnerability corresponding to the target file path is determined.

[0019] In this method, static vulnerability scanning is combined with dynamic vulnerability scanning. In static vulnerability scanning, the container image associated with the host (for example, the container image that exists or is downloaded on the host) is statically scanned to generate host vulnerability information. In dynamic vulnerability scanning, the target file path opened in the target container is determined by detecting the file opening event in the host, and then the target vulnerability actually running due to the file opening event is filtered out from the host vulnerability information. In this way, the full amount of vulnerability information is obtained through static vulnerability scanning, and the vulnerabilities that have a greater impact on the safe operation of the container are obtained from the full amount of vulnerability information through dynamic vulnerability scanning, thereby achieving targeted and efficient real-time container vulnerability scanning, thereby protecting the container load security and cloud security. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical methods of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments.

[0021] Figure 1 A schematic diagram of the architecture of a container vulnerability scanning system provided in an embodiment of the present application;

[0022] Figure 2 A flowchart of a container vulnerability scanning method for protecting cloud security provided by an embodiment of the present application;

[0023] Figure 3 A schematic diagram of the structure of a container vulnerability scanning device for protecting cloud security provided by an embodiment of the present application;

[0024] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The terms "first" and "second" in the embodiments of this application are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Therefore, features specified as "first" or "second" may explicitly or implicitly include one or more of the features.

[0026] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0027] With the continuous development of computer technology, especially virtualization technology, containers have emerged. Containers are lightweight, portable software runtime environments that package applications and their dependencies together, allowing them to run in any container-supported environment. This allows applications to maintain a consistent operating state across different runtime environments.

[0028] At the same time, with the continuous development of cloud computing technology, more and more users (such as organizations and enterprises) are adopting the microservices architecture to deploy business applications. In the microservices architecture, business applications are broken down into multiple small, independent services, each of which implements a specific business function.

[0029] Combining a microservices architecture with container technology enables flexible application deployment, scaling, and management. Specifically, each service within a business application can be packaged into separate containers, each containing the dependencies and configuration required to run each service. Containerization provides isolation, ensuring environmental consistency across services, and ultimately improving the maintainability, scalability, and reliability of business applications.

[0030] During the operation of business applications, vulnerabilities in containers can lead to intrusion or penetration attacks in the virtualized environment, affecting the security of business applications and cloud security. Therefore, scanning for container vulnerabilities is particularly important.

[0031] In actual applications, a container may have a large number of vulnerabilities (for example, hundreds or thousands). It is difficult for security operations personnel to quickly scan out the vulnerabilities in the container that have a greater impact on the safe operation of the container. As a result, security operations personnel are unable to efficiently repair a large number of vulnerabilities.

[0032] In view of this, the present application provides a container vulnerability scanning method for protecting cloud security. The method determines, in response to detecting a file opening event in a host machine, the container information of the target container that generates the file opening event and the target file path associated with the file opening event. Then, based on the container information of the target container, the target vulnerability information of the target container image is determined from the host machine vulnerability information, wherein the target container is generated by the target container image, the host machine vulnerability information stores the vulnerability information of at least one container image associated with the host machine, and the vulnerability information of at least one container image includes a mapping relationship between the vulnerability and the path where the vulnerability is located. Based on the target file path and the mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located, the target vulnerability corresponding to the target file path is determined.

[0033] In this method, static vulnerability scanning is combined with dynamic vulnerability scanning. In static vulnerability scanning, the container image associated with the host (for example, the container image that exists or is downloaded on the host) is statically scanned to generate host vulnerability information. In dynamic vulnerability scanning, the target file path opened in the target container is determined by detecting the file opening event in the host, and then the target vulnerability actually running due to the file opening event is filtered out from the host vulnerability information. In this way, the full amount of vulnerability information is obtained through static vulnerability scanning, and the vulnerabilities that have a greater impact on the safe operation of the container are obtained from the full amount of vulnerability information through dynamic vulnerability scanning, thereby achieving targeted and efficient real-time container vulnerability scanning, thereby protecting the container load security and cloud security.

[0034] To facilitate understanding of the technical solutions provided in the embodiments of the present application, the following description will be made with reference to the accompanying drawings. Figure 1 The following is a schematic diagram of the architecture of a container vulnerability scanning system. The container vulnerability scanning system includes a static vulnerability scanner, a dynamic vulnerability scanner, and a vulnerability identifier, which are introduced below.

[0035] The static vulnerability scanner is used to perform a comprehensive static vulnerability scan on the host machine. Specifically, the static vulnerability scanner obtains the image layer path for each container image running on the host machine, determines the vulnerability information of each container image, and integrates the vulnerability information of each container image to form the host machine vulnerability information. In this way, the static vulnerability scanner performs a comprehensive static check on each container image on the host machine.

[0036] The dynamic vulnerability scanner is used to detect file open events in containers. Specifically, the dynamic vulnerability scanner detects file open events in each container on the host machine. In response to detecting a file open event, the dynamic vulnerability scanner determines the container information of the target container that generated the file open event and the target file path associated with the file open event. In this way, the dynamic detection of file open events in each container is carried out in real time.

[0037] The vulnerability identifier is used to identify real-time running vulnerabilities in containers. Specifically, the vulnerability identifier combines the target container's container information to determine the container image that starts the target container. Furthermore, combined with the host machine's vulnerability information, the vulnerability identifier determines the vulnerability corresponding to the container image that starts the target container. Next, the vulnerability identifier combines the vulnerability information corresponding to the container image that starts the target container with the target file path associated with the file open event to determine the vulnerability corresponding to the target file path. In this way, the vulnerability identifier can identify actual running target vulnerabilities that pose a significant security threat to the host machine from a large number of vulnerabilities on the host machine.

[0038] In the embodiment of the present application, the single immutability of the container image and the real-time loading characteristics of the business process of the container payload are utilized to achieve static comprehensive identification and actual dynamic identification of container payload vulnerabilities, thereby improving the targeted efficiency of container vulnerability identification.

[0039] Based on the aforementioned container vulnerability scanning system, this application also provides a container vulnerability scanning method for protecting cloud security, which can be executed by the container vulnerability scanning system. Figure 2 The flowchart of a container vulnerability scanning method for protecting cloud security is shown in FIG. The method specifically includes the following steps:

[0040] S201: In response to detecting a file open event in a host machine, determining container information of a target container generating the file open event and a target file path associated with the file open event.

[0041] In an embodiment of the present application, a file open event is detected for at least one container running on a host machine (e.g., a container requiring a container vulnerability scan), to detect whether the at least one container running on the host machine generates a file open event. A file open event can be understood as an event in which a file is opened in a container on the host machine.

[0042] In some embodiments, a first program for detecting file open events is loaded into the kernel space of the host machine. For example, the first program can be a program implemented based on the extended Berkeley Packet Filter (eBPF) technology. Specifically, an eBPF program for detecting file open events is written in the user state of the host machine, the eBPF program is loaded, and the eBPF program is connected to the sys_read or sys_open function of the host machine. The eBPF program is used to detect file open events in the target container. In this way, the system event collection capability of eBPF is utilized to detect file open events.

[0043] In other embodiments, considering that eBPF technology often requires an advanced kernel version and kernel configuration, which involves a host machine restart, file open events can be detected based on fanotify technology. In specific implementations, the target container's namespace is switched and a file open notification group is configured in the target container's namespace. The file open notification group is used to detect file open events.

[0044] By switching the namespace to the target container, using the PID of the target container's main process, and configuring the file open notification group, file open events generated in the target container can be detected. This allows us to leverage fanotify's ability to detect file system changes without requiring an advanced kernel version or a host reboot.

[0045] In an embodiment of the present application, the file set actually loaded and run in the target container is detected through Hook technologies such as eBPF technology or fanotify technology, which solves the adaptability problem from the underlying technology and has unified compatibility. There is no need to implement them one by one for different development language packages, which greatly improves the compatibility of container vulnerability scanning.

[0046] In an embodiment of the present application, when a file open event is detected in the host machine, on the one hand, the container information of the target container generating the file open event is determined, and on the other hand, the target file path associated with the file open event is determined.

[0047] The target container can be understood as the container in the host machine that generates or triggers a file open event, and the target container's container information can be understood as attribute information related to the target container. For example, the target container's container information can include the target container's container name, the target container's container ID, the container image name of the target container image that generates the target container, the container image ID of the target container image that generates the target container, etc. A file open event can be understood as an event generated in the target container that opens a target file, and the target file path associated with the file open event can be understood as the file path of the target file in the target container.

[0048] In this way, by detecting file opening events in the host machine, the files involved in the processes actually running in the host machine are determined, and then the target vulnerabilities actually running in the host machine that have an impact on the security of the virtualization environment are determined.

[0049] In some possible implementations, a first program for detecting a file open event is loaded into the kernel space of the host machine, the first program is executed, process information of a main process in a target container and process information of a child process in the target container are determined, and in response to detecting a file open event in the host machine, container information of a target container generating the file open event is determined based on the process information of the main process in the target container and the process information of the child process in the target container, and a target file path associated with the file open event is determined.

[0050] For example, for a detected file open event, the target container that generated the file open event in the host machine is determined by using the namespace information associated with the file open event and the information from the control group (cgroup), combined with the process information of the main process in the target container and the process information of the child process in the target container, and then the container information of the target container is determined.

[0051] Take two examples as examples for illustration. The target container A1 is running in the host machine. The target container A starts the main process B1. The process information of the main process B1 is detected and recorded through the first program (for example, the eBPF program). The main process B1 triggers a file open event. After the file open event is detected, the namespace information and cgroup information associated with the file open event are used to determine that the file open event is triggered by the main process B1 of the target container A.

[0052] The target container A2 runs in the host machine, and the target container A2 starts the main process B2. The process information of the main process B2 is detected and recorded through the first program (for example, the eBPF program). The main process B2 starts the first child process B3, and the process information of the first child process B3 is detected and recorded through the first program. The first child process B3 triggers a file open event. After the file open event is detected, it is determined that the file open event is triggered by the first child process B3 of the target container A through the namespace information and cgroup information associated with the file open event.

[0053] In this way, by loading a first program for detecting file opening events in the kernel space of the host machine, and using the first program to detect file opening events triggered by the main process and child processes of the container in the host machine, comprehensive detection of file opening events for each process in the host machine is achieved.

[0054] In some embodiments, considering the need to identify vulnerabilities in the container load, in response to detecting a file open event in the host machine, the event type of the file open event can also be determined. In response to the event type of the file open event characterizing that the file open event is an external container event, the file open event is discarded.

[0055] That is to say, since the embodiment of the present application identifies and manages vulnerabilities in the container load of the host machine, by determining whether the file opening event belongs to an internal container event, the file opening events that do not belong to internal container events (i.e., external container events) are discarded, and the file opening events that belong to internal container events are retained. The file opening events are filtered, and unnecessary file opening events are filtered in a timely manner, thereby reducing the computing resources consumed by container vulnerability scanning.

[0056] S202: Determine target vulnerability information of the target container image from the host vulnerability information according to the container information of the target container.

[0057] The target container is generated by the target container image. That is, the target container image is a container image running in the host machine, and the target container is a container instance running in the target container image.

[0058] Host vulnerability information stores vulnerability information for at least one container image associated with the host. In other words, host vulnerability information can be understood as known vulnerability information for each container image associated with the host. For example, a container image associated with the host can be a container image that exists on or has been downloaded from the host. By performing a static vulnerability scan on the host using container images as a dimension, vulnerability information for each container image is generated, thereby forming host vulnerability information. This prevents confusion in vulnerability information caused by the same file paths for different container images on the host.

[0059] In an embodiment of the present application, the vulnerability information of at least one container image includes a mapping relationship between the vulnerability and the path where the vulnerability is located. The path where the vulnerability is located can be understood as the file path where the vulnerability is located.

[0060] In this way, by performing static vulnerability scanning on a container image basis, the vulnerability information of each container image in the host is stored in the host vulnerability information. By establishing a mapping relationship between the vulnerability and the path where the vulnerability is located, the vulnerability and the path where the vulnerability is located are associated in the host vulnerability information to form a vulnerability-path mapping table.

[0061] The following describes a process of generating vulnerability information of a first container image by taking an example in which a container image associated with a host machine includes a first container image.

[0062] The vulnerability information of the first container image in the host vulnerability information can be determined by the following steps: in response to detecting that the first container image is started in the host, obtaining the image layer path of the first container image, and then, for each image layer path, performing the following steps: parsing the image layer path, determining the first file corresponding to the image layer path, obtaining a known vulnerability associated with the first file, using the known vulnerability associated with the first file as the vulnerability, and establishing a mapping relationship between the vulnerability and the vulnerability path using the image layer path as the vulnerability path. Then, based on the mapping relationship between the vulnerability in each image layer path and the vulnerability path, the vulnerability information of the first container image is determined.

[0063] Among them, the image layer path can be understood as the storage location of the image layer file (for example, the aforementioned first file) in the first container image. For example, when the first container image is a Docker image, the image layer path can be in the / var / lib / docker / directory.

[0064] When the first container image is started, the image layer path of the first container image is obtained, and then vulnerability scanning is performed on each image layer path respectively to achieve comprehensive static vulnerability scanning.

[0065] By parsing each image layer path, the first file stored in the image layer path is determined. Typically, the provider of the first file (e.g., a software provider) publishes a known vulnerability database. In this case, based on the file information of the first file, such as version information, a vulnerability matching the first file is found in the known vulnerability database and is used as the known vulnerability associated with the first file.

[0066] In this way, by traversing the image layer path, each first file in the first container image is found, and then the known vulnerability database of each first file is used to match the vulnerability, the known vulnerabilities associated with the first file are divided into the image layer path, and a mapping relationship between the vulnerability and the path where the vulnerability is located is established. By merging the vulnerability information, the mapping relationship between the vulnerability in each image layer path and the path where the vulnerability is located constitutes the vulnerability information of the first container image, and the static scanning of the vulnerability information of the first container image is completed. Then, the vulnerability information of the first container image is added to the host vulnerability information, and the vulnerability information of the first container image is newly added to the host vulnerability information.

[0067] In some embodiments, the first file may include a software installation file and a software dependency library file, wherein the software installation file can be understood as a software package, such as an rpm, dpkg, or jar software package, and the software dependency library file can be understood as a dynamic library file that the running software depends on.

[0068] That is to say, unlike traditional static scanning that only obtains software package assets, in the embodiment of the present application, the file paths of loadable modules such as dependent libraries can also be obtained. In this way, the types of vulnerability information are enriched, the comprehensiveness of static scanning is improved, and the comprehensiveness of vulnerability identification is improved.

[0069] Specifically, the image layer path is parsed to determine the software installation file corresponding to the image layer path, and the executable file is determined from the software installation file according to the type of the software installation file, and the field of the executable file is parsed to determine the software dependency library file.

[0070] Since the software installation file can be directly obtained by parsing the image layer path, first determine the software installation file corresponding to the image layer path, then filter out the executable file from the software installation file, and obtain the file path of the software dependency library file by parsing the fields of the executable file (such as header, segment).

[0071] Similarly, the provider of the software dependency library file (such as the dependency library provider) may also publish a known vulnerability database. In this case, based on the file information of the software dependency library file, such as version information, etc., the vulnerability that matches the software dependency library file is found from the known vulnerability database as the known vulnerability associated with the software dependency library file.

[0072] In this way, known vulnerabilities associated with software dependency library files are identified as vulnerabilities, and the file paths of the software dependency library files are identified as vulnerability paths. A mapping relationship is established between vulnerabilities and vulnerability paths. During the static scan of the first container image, vulnerability information related to the software dependency library files is also generated, enabling comprehensive static vulnerability scanning.

[0073] Since the host vulnerability information is established in advance and the host vulnerability information is stored in the dimension of the container image, when a file opening event in the target container is detected, the target vulnerability information of the target container image can be determined from the host vulnerability information through the container information of the target container.

[0074] Specifically, according to the container information of the target container, the identifier of the target container image is determined, and the identifier of the target container image is used as an index to query the host vulnerability information to determine the target container vulnerability information of the target container image.

[0075] For example, the main process B of the target container A triggers a file open event, and the file open event is to open a dynamic library file path C, that is, the target file path is file path C. The container information of the target container A may include the container image ID of the target container image that generates the target container. For example, the identifier of the target container image is container image D. In this case, by searching the host vulnerability information with container image D as the index, the target vulnerability information whose key is container image D in the host vulnerability information is filtered out, that is, the vulnerability information of the target container image is found from the host vulnerability information, and the first screening is completed.

[0076] S203: Determine the target vulnerability corresponding to the target file path according to the target file path and the mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located.

[0077] Through the first screening, the target vulnerability information of the target container image is obtained from the host vulnerability information. Then, the mapping relationship between the target file path and the vulnerability in the target vulnerability information and the path where the vulnerability is located is matched, and a second screening is performed to finally determine the target vulnerability actually running in the host.

[0078] Specifically, in the mapping relationship between the vulnerability of the target container vulnerability information and the path where the vulnerability is located, the target file path is used as an index to perform a query to determine the target vulnerability corresponding to the target file path.

[0079] For example, the main process B of the target container A triggers a file open event, and the file open event is to open a dynamic library file path C, that is, the target file path is file path C. The container information of the target container A may include the container image ID of the target container image that generates the target container. For example, the identifier of the target container image is container image D. Through the first screening, the target vulnerability information of the container image D is obtained, and then the file path C is used as the index to search in the target vulnerability information, and the target vulnerability corresponding to the key (key) of the target vulnerability information and the file path C is screened out, that is, the target vulnerability corresponding to the target file path is found from the target vulnerability information, and the second screening is completed.

[0080] Since multiple container images can be run in a host machine, and multiple known vulnerabilities can exist in each container image, the host machine vulnerability information may include a mapping relationship between a large number of vulnerabilities and the paths where the vulnerabilities are located. It is usually difficult for security operators to efficiently repair a large number of vulnerabilities. Therefore, in an embodiment of the present application, by pre-establishing host machine vulnerability information, all the vulnerabilities existing in the host machine are found, and then by detecting file opening events, the target vulnerabilities actually running in the host machine are determined. Since the target vulnerabilities actually running in the host machine have a more serious impact on the operational security of the host machine, the target vulnerabilities actually running in the host machine need to be processed first. By executing the container vulnerability scanning method provided in the embodiment of the present application, target vulnerabilities with greater impact are identified from the large number of vulnerabilities in the host machine, and security operators perform targeted vulnerability management on the target vulnerabilities, thereby improving the efficiency of vulnerability management.

[0081] In some possible implementations, the vulnerability information of at least one container image may further include vulnerability priorities. According to the vulnerability priorities in the host vulnerability information, the target vulnerabilities are sorted to determine the priority order of the target vulnerabilities, and the priority order of the target vulnerabilities is determined as the governance order of the target vulnerabilities.

[0082] Among them, vulnerability priority can be understood as an indicator for measuring the severity of a vulnerability. In some embodiments, vulnerability priority can be configured by security operations personnel. For example, in the process of establishing host vulnerability information, security operations personnel can configure vulnerability priority for each container image in the host based on information such as vulnerability type, so that the vulnerability information includes vulnerability priority. In other embodiments, vulnerability priority can also be configured in the known vulnerability database published by the software provider or the dependency library provider, that is, the software provider or the dependency library provider configures vulnerability priority for each vulnerability based on the severity of each vulnerability, and the vulnerability priority in the known vulnerability database can be used in the host vulnerability information.

[0083] In this way, for the target vulnerabilities actually loaded and running in the host machine, the governance order is determined according to the vulnerability priority. The vulnerability priority represents the target vulnerability with high severity, and the governance order is determined at the front. The vulnerability priority represents the target vulnerability with low severity, and the governance order is determined at the back. The security operation personnel repair and manage the target vulnerabilities according to the governance order, making the vulnerability management more organized. At the same time, the target vulnerabilities with high severity are managed first to reduce the negative impact of the target vulnerabilities on the host machine operation and ensure the safe operation of the host machine.

[0084] In this method, static vulnerability scanning is combined with dynamic vulnerability scanning. In static vulnerability scanning, the container image associated with the host (for example, the container image that exists or is downloaded on the host) is statically scanned to generate host vulnerability information. In dynamic vulnerability scanning, the target file path opened in the target container is determined by detecting the file opening event in the host, and then the target vulnerability actually running due to the file opening event is filtered out from the host vulnerability information. In this way, the full amount of vulnerability information is obtained through static vulnerability scanning, and the vulnerabilities that have a greater impact on the safe operation of the container are obtained from the full amount of vulnerability information through dynamic vulnerability scanning, thereby achieving targeted and efficient real-time container vulnerability scanning, thereby protecting the container load security and cloud security.

[0085] Combined with the above Figures 1 to 2 The container vulnerability scanning method for protecting cloud security provided by the embodiment of the present application is introduced in detail. The following will introduce the apparatus and equipment provided by the embodiment of the present application in conjunction with the accompanying drawings.

[0086] See also Figure 3 The schematic diagram of the structure of the container vulnerability scanning device for protecting cloud security is shown, and the device 30 includes:

[0087] A first determining module 301 is configured to, in response to detecting a file open event in a host machine, determine container information of a target container generating the file open event and a target file path associated with the file open event;

[0088] A second determination module 302 is configured to determine target vulnerability information of a target container image from host vulnerability information based on the container information of the target container; wherein the target container is generated by the target container image, the host vulnerability information stores vulnerability information of at least one container image associated with the host, and the vulnerability information of the at least one container image includes a mapping relationship between a vulnerability and a path where the vulnerability is located;

[0089] The third determining module 303 is configured to determine a target vulnerability corresponding to the target file path according to the target file path and a mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located.

[0090] In some possible implementations, the vulnerability information of the at least one container image further includes a vulnerability priority, and the apparatus 30 further includes a sorting module, wherein the sorting module is configured to:

[0091] Sorting the target vulnerabilities according to the vulnerability priorities in the host vulnerability information to determine the priority order of the target vulnerabilities;

[0092] The priority order of the target vulnerabilities is determined as the governance order of the target vulnerabilities.

[0093] In some possible implementations, the container image associated with the host machine includes a first container image, and the apparatus 30 further includes a generation module configured to:

[0094] In response to detecting that the first container image is started in the host machine, obtaining an image layer path of the first container image;

[0095] For each of the image layer paths, performing the following steps: parsing the image layer path to determine a first file corresponding to the image layer path; obtaining a known vulnerability associated with the first file; using the known vulnerability associated with the first file as a vulnerability, and using the image layer path as a vulnerability path to establish a mapping relationship between the vulnerability and the vulnerability path;

[0096] Vulnerability information of the first container image is determined according to a mapping relationship between a vulnerability in each of the image layer paths and a path where the vulnerability is located.

[0097] In some possible implementations, the first file includes a software installation file and a software dependency library file, and the generation module is specifically configured to:

[0098] Parse the image layer path and determine the software installation file corresponding to the image layer path;

[0099] Determining an executable file from the software installation file according to the type of the software installation file;

[0100] Parsing the fields of the executable file to determine the software dependent library file and the file path of the software dependent library file;

[0101] The generation module is specifically used for:

[0102] The known vulnerability associated with the software dependency library file is regarded as a vulnerability, and the file path of the software dependency library file is regarded as a vulnerability location path, and a mapping relationship between the vulnerability and the vulnerability location path is established.

[0103] In some possible implementations, a first program for detecting a file opening event is loaded into the kernel space of the host machine, and the first determining module 301 is specifically configured to:

[0104] Executing the first program to determine process information of a main process in the target container and process information of a child process in the target container;

[0105] In response to detecting a file open event in a host machine, container information of a target container generating the file open event is determined based on process information of a main process in the target container and process information of a child process in the target container, and a target file path associated with the file open event is determined.

[0106] In some possible implementations, in response to detecting a file opening event in the host machine, the first determining module 301 is further configured to:

[0107] Determine the event type of the file open event;

[0108] In response to the event type of the file open event indicating that the file open event is an external container event, the file open event is discarded.

[0109] In some possible implementations, the second determining module 302 is specifically configured to:

[0110] Determine the identifier of the target container image according to the container information of the target container;

[0111] In the host vulnerability information, the identifier of the target container image is used as an index to perform a query to determine the target container vulnerability information of the target image.

[0112] In some possible implementations, the third determining module 303 is specifically configured to:

[0113] In the mapping relationship between the vulnerability of the target container vulnerability information and the path where the vulnerability is located, the target file path is used as an index to perform a query to determine the target vulnerability corresponding to the target file path.

[0114] The container vulnerability scanning device 30 according to the embodiment of the present application may correspond to executing the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the container vulnerability scanning device 30 are respectively to achieve Figure 2 For the sake of brevity, the corresponding processes of the various methods in the illustrated embodiments are not described here in detail.

[0115] The embodiment of the present application also provides an electronic device. The electronic device is specifically used to implement Figure 3 Functions of the container vulnerability scanning device 30 in the illustrated embodiment.

[0116] Figure 4 A structural diagram of an electronic device 400 is provided. Figure 4 As shown, electronic device 400 includes bus 401, processor 402, communication interface 403 and memory 404. Processor 402, memory 404 and communication interface 403 communicate with each other via bus 401.

[0117] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0118] The processor 402 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0119] The communication interface 403 is used for communicating with the outside, for example, the communication interface 403 can be used for communicating with a terminal.

[0120] The memory 404 may include volatile memory, such as random access memory (RAM), or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0121] The memory 404 stores executable code, and the processor 402 executes the executable code to perform the aforementioned container vulnerability scanning method.

[0122] Specifically, in the implementation Figure 3 In the case of the embodiment shown, and Figure 3 When each module or unit of the container vulnerability scanning device 30 described in the embodiment is implemented by software, the execution Figure 3 The software or program code required for the functions of each module / unit in the container may be partially or completely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the aforementioned container vulnerability scanning method.

[0123] Embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the container vulnerability scanning method applied to the container vulnerability scanning apparatus 30.

[0124] The present application also provides a computer program product comprising one or more computer instructions that, when loaded and executed on a computing device, fully or partially generate the process or function described in the present application.

[0125] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0126] When the computer program product is executed by a computer, the computer performs any of the aforementioned container vulnerability scanning methods. The computer program product may be a software installation package. When any of the aforementioned container vulnerability scanning methods is required, the computer program product may be downloaded and executed on the computer.

[0127] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to the various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the prescribed logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the prescribed function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0128] The units involved in the embodiments described in this application may be implemented in software or hardware, wherein the name of a unit / module does not, in some cases, constitute a limitation on the unit itself.

[0129] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0130] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems or devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0132] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0133] It should also be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0134] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0135] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A container vulnerability scanning method for protecting cloud security, characterized in that: The method comprises: In response to detecting a file open event in the host machine, determining container information of a target container generating the file open event and a target file path associated with the file open event; Determining target vulnerability information of a target container image from host vulnerability information based on the container information of the target container; wherein the target container is generated by the target container image, the host vulnerability information stores vulnerability information of at least one container image associated with the host, and the vulnerability information of the at least one container image includes a mapping relationship between a vulnerability and a path where the vulnerability is located; The target vulnerability corresponding to the target file path is determined according to the target file path and the mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located.

2. The method according to claim 1, characterized in that The vulnerability information of the at least one container image further includes a vulnerability priority, and the method further includes: Sorting the target vulnerabilities according to the vulnerability priorities in the host vulnerability information to determine the priority order of the target vulnerabilities; The priority order of the target vulnerabilities is determined as the governance order of the target vulnerabilities.

3. The method according to claim 1, characterized in that The container image associated with the host machine includes a first container image, and vulnerability information of the first container image in the host machine vulnerability information is determined by the following steps: In response to detecting that the first container image is started in the host machine, obtaining an image layer path of the first container image; For each of the image layer paths, performing the following steps: parsing the image layer path to determine a first file corresponding to the image layer path; obtaining a known vulnerability associated with the first file; using the known vulnerability associated with the first file as a vulnerability, and using the image layer path as a vulnerability path to establish a mapping relationship between the vulnerability and the vulnerability path; Vulnerability information of the first container image is determined according to a mapping relationship between a vulnerability in each of the image layer paths and a path where the vulnerability is located.

4. The method according to claim 3, characterized in that The first file includes a software installation file and a software dependency library file, and the parsing of the image layer path to determine the first file corresponding to the image layer path includes: Parse the image layer path and determine the software installation file corresponding to the image layer path; Determining an executable file from the software installation file according to the type of the software installation file; Parsing the fields of the executable file to determine a software dependent library file and a file path of the software dependent library file; The method of using the known vulnerability associated with the first file as a vulnerability and the image layer path as a vulnerability path to establish a mapping relationship between the vulnerability and the vulnerability path includes: The known vulnerability associated with the software dependency library file is regarded as a vulnerability, and the file path of the software dependency library file is regarded as a vulnerability location path, and a mapping relationship between the vulnerability and the vulnerability location path is established.

5. The method according to claim 1, wherein The kernel space of the host machine is loaded with a first program for detecting a file open event. In response to detecting the file open event in the host machine, determining container information of a target container generating the file open event and a target file path associated with the file open event includes: Executing the first program to determine process information of a main process in the target container and process information of a child process in the target container; In response to detecting a file open event in a host machine, container information of a target container generating the file open event is determined based on process information of a main process in the target container and process information of a child process in the target container, and a target file path associated with the file open event is determined.

6. The method according to claim 1, characterized in that In response to detecting a file open event in the host machine, the method further includes: Determine the event type of the file open event; In response to the event type of the file open event indicating that the file open event is an external container event, the file open event is discarded.

7. The method according to claim 1, characterized in that The determining target vulnerability information of the target container image from the host vulnerability information according to the container information of the target container includes: Determine the identifier of the target container image according to the container information of the target container; In the host vulnerability information, the identifier of the target container image is used as an index to perform a query to determine the target container vulnerability information of the target container image.

8. The method according to any one of claims 1 to 7, characterized in that Determining a target vulnerability corresponding to the target file path according to the target file path and a mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located includes: In the mapping relationship between the vulnerability of the target container vulnerability information and the path where the vulnerability is located, the target file path is used as an index to perform a query to determine the target vulnerability corresponding to the target file path.

9. A container vulnerability scanning device for protecting cloud security, characterized in that: The device comprises: a first determining module, configured to, in response to detecting a file open event in a host machine, determine container information of a target container generating the file open event and a target file path associated with the file open event; a second determination module, configured to determine target vulnerability information of a target container image from host vulnerability information based on the container information of the target container; wherein the target container is generated by the target container image, the host vulnerability information stores vulnerability information of at least one container image associated with the host, and the vulnerability information of the at least one container image includes a mapping relationship between a vulnerability and a path where the vulnerability is located; The third determining module is configured to determine a target vulnerability corresponding to the target file path according to the target file path and a mapping relationship between the vulnerability in the target vulnerability information and the path where the vulnerability is located.

10. An electronic device, characterized in that: The electronic device includes a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The method comprises instructions for instructing an electronic device to execute the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product comprises computer-readable instructions for implementing the method according to any one of claims 1 to 8.

Images