Method and device for detecting abnormal operation behavior of container arrangement system

Abstract

The invention discloses a container arrangement system abnormal operation behavior detection method and device, and relates to the technical field of network security. The method comprises the following steps: firstly, adding an original auditing hash field used for recording an operation behavior hash value and an original operation sequence field used for recording an operation behavior plaintext value into resource object metadata of a container arrangement system, then intercepting a resource operation request through an admission controller, and dynamically calculating the value of the auditing hash field according to a preset rule; and inputting the new audit hash value and the new operation sequence field into the resource object metadata, recalculating the hash chain when the operation behavior needs to be verified, and verifying whether the recalculated hash chain is abnormal or not. And the effect of accurately detecting and tracing the abnormal operation behavior is achieved. The operation record can be effectively prevented from being tampered or deleted, the safety and reliability of a container arrangement system are ensured, and a powerful guarantee is provided for stable operation of the system.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for detecting abnormal operation behavior of a container orchestration system. Background Art

[0002] In container orchestration systems, common methods for auditing operational behavior fall into several categories. The first is the native audit logs of the container orchestration system. Container orchestration systems provide an audit log by default, recording all requests to the API server (such as pod creation, configuration updates, and deletions). These logs include information such as the operation type, user identity, resource path, and timestamp. However, these logs are stored in plain text and are susceptible to tampering or deletion. Furthermore, they rely on system timestamps, which can disrupt the order of operations if node events are tampered with. The second approach is to rely on third-party audit tools. These tools capture container and cluster operational behavior through bypass monitoring or kernel modules, but they still rely on native audit logs, which carries the risk of log file tampering. Furthermore, their manipulation of kernel modules can affect cluster performance. The third approach is to store the container orchestration system's operational logs on a blockchain, leveraging the immutability of blockchain to achieve audit-level traceability. However, this approach is complex to deploy, requiring additional blockchain node maintenance, and cannot support the high-frequency operations of the container orchestration system, making it incompatible with cloud-native architectures.

[0003] In summary, in existing container orchestration systems, auditing operations has certain limitations in terms of security, reliability, and performance, making it difficult to meet the high requirements of container orchestration systems for auditing operations. Summary of the Invention

[0004] To address the above issues, this application provides a method and device for detecting abnormal operation behavior in a container orchestration system, including the following:

[0005] In a first aspect, the present application provides a method for detecting abnormal operation behavior of a container orchestration system, the method comprising:

[0006] Add an original audit hash field for recording the hash value of the operation behavior and an original operation sequence field for recording the plaintext value of the operation behavior to the resource object metadata of the container orchestration system;

[0007] The admission controller intercepts the resource operation request, dynamically calculates the value of the audit hash field according to the preset rules, and enters the new audit hash value and the new operation sequence field into the resource object metadata;

[0008] When the operation behavior needs to be verified, the hash chain is recalculated to verify whether the recalculated hash chain is abnormal.

[0009] Optionally, adding an original audit hash field for recording an operation behavior hash value and an original operation sequence field for recording an operation behavior plaintext value in the resource object metadata of the container orchestration system includes:

[0010] Add the audit-hash field to the metadata.annotations metadata of the resource object in the container orchestration system to record the hash value of the operation behavior, and add the audit-trail field to record the plaintext value of the operation behavior.

[0011] Optionally, intercepting the resource operation request by the admission controller, dynamically calculating the value of the audit hash field according to a preset rule, and inserting the new audit hash value and the new operation sequence field into the resource object metadata includes:

[0012] The API Server of the container orchestration system calls the Mutating Webhook to intercept the request, reads the current audit hash value and operation sequence field value of the resource, and according to the preset rules, concatenates the old audit hash value, operation data, user identity, operation type and timestamp into a string and performs a SHA256 operation to obtain a new audit hash value. The new audit hash value and the new operation sequence field are then inserted into the resource object metadata.

[0013] Optionally, the method further includes:

[0014] The audit hash field and operation sequence field in the resource object metadata are encrypted, and the encrypted data is stored in the distributed key-value storage component.

[0015] Optionally, verifying whether the recalculated hash chain is abnormal includes:

[0016] Obtain the current configuration information and historical change records of the resource object, and calculate the hash chain according to the preset rules;

[0017] If the recalculated hash chain is consistent with the audit hash field stored in the resource object metadata, a verification pass is returned;

[0018] If there is any inconsistency, the first mismatched location is output based on the historical change records, and the operation records are sorted by timestamp to trace the operating user.

[0019] In a second aspect, the present application provides a device for detecting abnormal operation behavior of a container orchestration system, the device comprising:

[0020] A resource metadata enhancement unit, configured to add an original audit hash field for recording the hash value of the operation behavior and an original operation sequence field for recording the plaintext value of the operation behavior to the resource object metadata of the container orchestration system;

[0021] An admission controller processing unit, configured to intercept resource operation requests through an admission controller, dynamically calculate a value of an audit hash field according to preset rules, and insert a new audit hash value and a new operation sequence field into the resource object metadata;

[0022] The verification and tracing unit is used to recalculate the hash chain when the operation behavior needs to be verified, and verify whether the recalculated hash chain is abnormal.

[0023] Optionally, the resource metadata enhancement unit is specifically configured to add an audit-hash field to the metadata.annotations metadata of the resource object of the container orchestration system to record a hash value of the operation behavior, and to add an audit-trail field to record a plaintext value of the operation behavior.

[0024] Optionally, the admission controller processing unit intercepts the resource operation request through the admission controller, dynamically calculates the value of the audit hash field according to a preset rule, and inserts the new audit hash value and the new operation sequence field into the resource object metadata, including:

[0025] The API Server of the container orchestration system calls the Mutating Webhook to intercept the request, reads the current audit hash value and operation sequence field value of the resource, and according to the preset rules, concatenates the old audit hash value, operation data, user identity, operation type and timestamp into a string and performs a SHA256 operation to obtain a new audit hash value. The new audit hash value and the new operation sequence field are then inserted into the resource object metadata.

[0026] Optionally, the device further includes an encryption storage unit for encrypting the audit hash field and the operation sequence field in the resource object metadata, and storing the encrypted data in the distributed key-value storage component.

[0027] Optionally, the verification and tracing unit verifies whether the recalculated hash chain is abnormal, including obtaining current configuration information and historical change records of the resource object, and calculating the hash chain according to preset rules;

[0028] If the recalculated hash chain is consistent with the audit hash field stored in the resource object metadata, a verification pass is returned;

[0029] If there is any inconsistency, the first mismatched location is output based on the historical change records, and the operation records are sorted by timestamp to trace the operating user.

[0030] In a third aspect, the present application provides a device comprising a memory and a processor, wherein the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device performs the method for detecting abnormal operation behavior of a container orchestration system introduced in any implementation of the first aspect.

[0031] In a fourth aspect, the present application provides a computer-readable storage medium storing code. When the code is executed, the device executing the code implements the method for detecting abnormal operation behavior of a container orchestration system as described in any implementation of the first aspect.

[0032] The present application provides a method for detecting abnormal operation behavior in a container orchestration system. When executing the method, the original audit hash field for recording the hash value of the operation behavior and the original operation sequence field for recording the plaintext value of the operation behavior are first added to the resource object metadata of the container orchestration system, and then the resource operation request is intercepted by the access controller, and the value of the audit hash field is dynamically calculated according to the preset rules, and the new audit hash value and the new operation sequence field are entered into the resource object metadata. Finally, when the operation behavior needs to be verified, the hash chain is recalculated to verify whether the recalculated hash chain is abnormal. In this way, by dynamically recording and updating the audit hash value and operation sequence in the resource object metadata, the integrity and consistency of the operation behavior can be monitored and verified in real time, achieving the effect of accurately detecting and tracing abnormal operation behavior. In this way, the operation records can be effectively prevented from being tampered with or deleted, ensuring the security and reliability of the container orchestration system, and providing a strong guarantee for the stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the following briefly introduces the drawings required for use in the embodiment or the prior art description. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0034] Figure 1 A flowchart of a method for detecting abnormal operation behavior in a container orchestration system provided in an embodiment of the present application;

[0035] Figure 2 A schematic diagram of the structure of a device for detecting abnormal operation behavior in a container orchestration system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0038] Figure 1 This is a flow chart of a method for detecting abnormal operation behavior of a container orchestration system provided in an embodiment of the present application. Figure 1 As shown, the method for detecting abnormal operation behavior of a container orchestration system provided in an embodiment of the present application may include:

[0039] S101. Add an original audit hash field for recording an operation behavior hash value and an original operation sequence field for recording an operation behavior plaintext value to the resource object metadata of the container orchestration system.

[0040] In a container orchestration system, to accurately record and trace operational behaviors, specific fields must be added to the resource object metadata. These fields include the original audit hash field for recording the hash value of the operational behavior and the original operation sequence field for recording the plaintext value of the operational behavior.

[0041] In practice, resource objects in a container orchestration system contain a variety of metadata information, among which metadata.annotations is the metadata portion used to store additional information. This embodiment chooses to add two fields to the metadata.annotations metadata of the resource object to complete the above-mentioned recording function.

[0042] The first field is the audit-hash field, which is specifically used to record the hash value of the operation behavior. The hash value is a unique identification value obtained by performing a hash operation on the data related to the operation behavior. It can reflect the key characteristics of the operation behavior in a concise and fixed form, facilitating the subsequent rapid verification of the consistency and integrity of the operation behavior. For example, when performing a configuration modification operation on a resource object, the configuration information before and after the modification, the operation time, the operation user and other related data are combined according to specific rules, and then calculated using a hash algorithm such as SHA-256 to obtain a unique hash value, which is then stored in the audit-hash field. The following is an example:

[0043] metadata:

[0044] annotations:

[0045] audit-hash:"a1b2c3..."#Secure hash value (SHA-256);

[0046] In the above example, "a1b2c3..." is the hash value calculated using the SHA-256 algorithm. It represents the result of the hash operation on the data related to a specific operation behavior.

[0047] The second field is the audit-trail field, which is used to record the plaintext value of the operation behavior. The plaintext value can intuitively display the specific content of the operation behavior, making it convenient for operation and maintenance personnel or system administrators to directly view and understand the operation details when needed, and conduct problem troubleshooting and auditing. For example, if a container is created on a resource object, the audit-trail field can record detailed information such as the name of the created container, the image used, the allocated resources, the operating user, the operation type, and the operation time. The following is an example:

[0048] metadata:

[0049] annotations:

[0050] audit-trail: "userA / yaml content / CREATE / 2023-10-01T12:00:00Z";

[0051] In the preceding example, "userA" indicates the user who performed the operation, "yaml content" can be the specific configuration file content used to create the container (this is a simplified illustration), "CREATE" indicates the operation type is create, and "2023-10-01T12:00:00Z" is the specific time when the operation occurred.

[0052] By adding the audit-hash and audit-trail fields to the metadata.annotations metadata of the resource objects in the container orchestration system, the hash value and plaintext value of the operation behavior are recorded respectively, providing strong data support for the subsequent audit, tracing, and verification of the operation behavior.

[0053] S102: intercepting resource operation requests through an admission controller, dynamically calculating the value of an audit hash field according to preset rules, and entering a new audit hash value and a new operation sequence field into the resource object metadata.

[0054] To ensure effective auditing and tracing of resource operations, it is necessary to determine the hash chain generation rules. The new audit-hash value is calculated according to the following formula:

[0055] The new audit-hash = SHA256(old audit-hash||operation data||user identity||operation type||timestamp), where "||" represents a string concatenation operation. The parameters are described as follows:

[0056] Old audit-hash: The audit hash value currently stored in the resource object. The initial value is an empty string.

[0057] The operation data is the entire YAML content involved in the resource operation, which includes detailed configuration information of the resource object. The user identity is user.username and user.groups extracted from the audit log of the container orchestration system. The format is username:group1,group2, which is used to clarify the operation subject. The operation type is the API verb of the container orchestration system, such as CREATE, UPDATE, DELETE, etc., which identifies the specific behavior of the resource operation. The timestamp refers to the nanosecond time obtained from the API Server, which can prevent client forgery and ensure the accuracy and authenticity of the time information. Each time a resource operation is performed, the admission controller will generate a new hash value based on this formula to form a continuous hash chain for subsequent verification of the integrity and consistency of the operation behavior.

[0058] Admission control plays a key role in the security audit and operation traceability mechanisms of container orchestration systems. It performs pre-checks and processing of resource operation requests. The container orchestration system's API server calls the MutatingWebhook to intercept resource operation requests. When a resource operation request arrives, the MutatingWebhook receives the request and performs the following operations:

[0059] Read the current field values, specifically the current audit-hash and audit-trail field values, from the resource object's metadata. Following the hash chain generation rules specified above, concatenate the old audit-hash, operation data, user identity, operation type, and timestamp, and then perform a SHA256 operation to generate a new audit-hash value. Add the relevant information about the operation, including the operating user, operation data, operation type, and timestamp, to the audit-trail field to form a new operation sequence record. The newly generated audit-hash value and updated audit-trail field are then injected into the resource object's metadata.

[0060] The following example shows the contents of the audit-hash and audit-trail fields in the resource object metadata after multiple operations:

[0061] metadata:

[0062] annotations:

[0063] audit-hash: "a1b2c3...;d12132....." #Secure hash value (SHA-256);

[0064] audit-trail: "userA / yaml content / CREATE / 2023-10-01T12:00:00Z; userB / yaml content / DELETE / 2024-10-01T12:00:00Z" # Operation sequence plain text;

[0065] In the preceding example, "a1b2c3..." and "d12132..." are hash values ​​calculated using the SHA256 algorithm, representing the hashing results of different operations. "userA / yaml content / CREATE / 2023-10-01T12:00:00Z" and "userB / yaml content / DELETE / 2024-10-01T12:00:00Z" are plaintext records of the operation sequence, clearly displaying information such as the operating user, operation data, operation type, and operation time.

[0066] Through the above steps, we can intercept resource operation requests in the container orchestration system, dynamically calculate the audit hash field value, and add relevant fields to the resource object metadata, providing reliable data support for subsequent resource operation auditing and tracing.

[0067] S103: recalculate the hash chain when verification of the operation behavior is required, and verify whether the recalculated hash chain is abnormal.

[0068] To verify the operation of a resource object, perform the following steps:

[0069] Obtain the current configuration information and historical change records of resource objects. This information can be obtained from the storage system of the container orchestration system (such as etcd). The historical change records contain the status of resource objects at different time points and related operation information.

[0070] Calculating a hash chain follows the same pre-defined rules as calculating a hash value. The specific rules are: new audit-hash = SHA256(old audit-hash || operation data || user identity || operation type || timestamp), where the parameters have the same meanings as described above. Starting from the resource object's initial state, the audit-hash value corresponding to each operation is calculated sequentially based on the operation information in the historical change log to form a complete hash chain.

[0071] The recalculated hash chain is compared with the audit-hash field stored in the resource object metadata. If the recalculated hash chain matches the audit-hash field stored in the resource object metadata, the resource object's operation behavior has not been tampered with, and a verification result is returned. If they do not match, there may be an anomaly in the resource object's operation behavior, and the tracing process begins.

[0072] When tracing an exception, the first mismatched location is output based on historical change records. This location is the operation node where tampering may have occurred. Operation records are sorted by timestamp and the user identity information in the operation records is analyzed to trace the operating user.

[0073] To better understand the above verification and tracing process, a specific example is provided below:

[0074] User A deleted the primary MySQL database Pod in the production environment at some point using the `kubectldeletepodmysql-primary` command. Furthermore, to avoid responsibility, user A obtained write permissions to the log storage system through some means and deleted the original log entry for the `mysql-primary` event, thus tampering with the audit log and obscuring the record of their deletion.

[0075] The auditor queried the operation records through the audit interface of the container orchestration system and found no kubectl delete events (because the original logs were deleted).

[0076] The auditor finds the audit-hash and audit-trail fields of the resource and first verifies the integrity of the audit-trail. If the audit-trail matches completely, meaning all operation records are chronologically coherent and complete, then the auditor can directly identify user A who performed the operation from the audit-trail.

[0077] If user A also deletes or tampers with the audit-hash and audit-trail for this action on the resource, the audit-hash will inevitably become corrupted. In this case, sorting by time allows you to directly locate the time range of the operation. Then, using backup storage or bypass logs, focus on investigating the behavior within that time range to identify the specific abnormal operation and the user who performed it.

[0078] The above steps and case studies demonstrate how to verify operational behaviors and trace related operations in a container orchestration system. This approach can effectively detect and address potential operational tampering, ensuring system security and reliability.

[0079] Through the above-mentioned method, this application proposes an algorithm based on a secure hash algorithm and employing iterative encryption technology to dynamically record user operations on resource objects in a container orchestration system. The design concept is to define an audit hash field (audit-hash) and an operation sequence field (audit-trail) in the metadata of resource objects in the container orchestration system. The admission controller intercepts resource operation requests, dynamically calculates and updates the audit hash value, and then stores the audit hash value in its distributed key-value storage component, leveraging its multi-version concurrency control features to preserve the operation history.

[0080] In one implementation method of an embodiment of the present application, in order to further improve the security of resource operation audit information and prevent the leakage of audit information due to illegal access to distributed key-value storage components (such as etcd), it is also necessary to encrypt the audit hash field and operation sequence field in the resource object metadata and store the encrypted data in the distributed key-value storage component.

[0081] The etcd encrypted storage unit is a functional module responsible for performing encrypted storage operations. Encryption of the audit-hash and audit-trail fields is enabled through the container orchestration system's encryption configuration. The specific implementation steps are as follows: In the container orchestration system's configuration file, locate the encryption-related configuration items and enable encryption for the audit-hash and audit-trail fields. This configuration typically includes parameters such as encryption algorithm selection and key management. Select an appropriate encryption algorithm to encrypt the fields. Common encryption algorithms, such as AES (Advanced Encryption Standard), offer high security and performance, effectively protecting data from unauthorized access. Ensure the secure storage and management of encryption keys. Keys can be stored in a secure key management system, accessible only to authorized personnel or services. Keys should be regularly rotated to enhance security. When the audit-hash and audit-trail fields in resource object metadata need to be stored in etcd, the etcd encrypted storage unit retrieves the values ​​of these two fields and encrypts them using the configured encryption algorithm and key to generate encrypted data. The encrypted data is then stored in the corresponding location in etcd. Because the data is encrypted, even if etcd is illegally accessed, the attacker cannot directly obtain the original audit information.

[0082] By encrypting and storing the audit-hash and audit-trail fields, the security of resource operation audit information can be effectively improved. Even if distributed key-value storage components (such as etcd) face security threats, encrypted data can prevent the leakage of sensitive information and ensure the security and compliance of the system. At the same time, encrypted storage does not affect subsequent verification and tracing operations. When verifying operation behavior, simply obtain the encrypted data from etcd and decrypt it using the corresponding decryption algorithm and key to restore the original audit information. Then, follow the verification and tracing process described above. Through the above steps, the audit hash field and operation sequence field in the resource object metadata are encrypted and stored in the container orchestration system, providing more reliable data protection for the system's security audit and operation tracing.

[0083] The above are some specific implementations of a method for detecting abnormal operation behavior in a container orchestration system provided in an embodiment of the present application. Based on this, the present application also provides a corresponding device. The device provided in the embodiment of the present application will be introduced from the perspective of functional modularization.

[0084] Figure 2 This is a schematic diagram of the structure of a device for detecting abnormal operation behavior of a container orchestration system provided in an embodiment of the present application. Figure 2 As shown, the container orchestration system abnormal operation behavior detection device 200 provided in the embodiment of the present application includes:

[0085] The resource metadata enhancement unit 210 is configured to add an original audit hash field for recording an operation behavior hash value and an original operation sequence field for recording an operation behavior plain text value to the resource object metadata of the container orchestration system;

[0086] The admission controller processing unit 220 is configured to intercept resource operation requests through the admission controller, dynamically calculate the value of the audit hash field according to preset rules, and enter the new audit hash value and the new operation sequence field into the resource object metadata;

[0087] The verification and tracing unit 230 is used to recalculate the hash chain when verification of an operation behavior is required, and to verify whether the recalculated hash chain is abnormal.

[0088] In one implementation of an embodiment of the present application, the resource metadata enhancement unit is specifically configured to add an audit-hash field to the metadata.annotations metadata of the resource object of the container orchestration system to record the hash value of the operation behavior and to add an audit-trail field to record the plaintext value of the operation behavior.

[0089] In one implementation of the embodiment of the present application, the admission controller processing unit intercepts the resource operation request through the admission controller, dynamically calculates the value of the audit hash field according to a preset rule, and inserts the new audit hash value and the new operation sequence field into the resource object metadata, including:

[0090] The API Server of the container orchestration system calls the Mutating Webhook to intercept the request, reads the current audit hash value and operation sequence field value of the resource, and according to the preset rules, concatenates the old audit hash value, operation data, user identity, operation type and timestamp into a string and performs a SHA256 operation to obtain a new audit hash value. The new audit hash value and the new operation sequence field are then inserted into the resource object metadata.

[0091] In one implementation of the embodiment of the present application, the device further includes an encryption storage unit for encrypting the audit hash field and the operation sequence field in the resource object metadata, and storing the encrypted data in a distributed key-value storage component.

[0092] In one implementation of the embodiment of the present application, the verification and tracing unit verifies whether the recalculated hash chain is abnormal, including obtaining current configuration information and historical change records of the resource object, and calculating the hash chain according to preset rules;

[0093] If the recalculated hash chain is consistent with the audit hash field stored in the resource object metadata, a verification pass is returned;

[0094] If there is any inconsistency, the first mismatched location is output based on the historical change records, and the operation records are sorted by timestamp to trace the operating user.

[0095] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

[0096] The device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in any embodiment of the present application.

[0097] The computer storage medium stores code, and when the code is executed, the device executing the code implements the method described in any embodiment of the present application.

[0098] Through the description of the above embodiments, it can be seen that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment methods can be implemented by means of software plus a general hardware platform. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in various embodiments or certain parts of the embodiments of the present application.

[0099] It is understandable that in the specific implementation of this application, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved, when the above embodiments of this application are applied to specific products or technologies, need to obtain user permission or consent, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions.

[0100] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0101] It should also be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and apparatus embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and apparatus embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0102] The above is merely one specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for detecting abnormal operation behavior of a container orchestration system, characterized in that: The method comprises: Add an original audit hash field for recording the hash value of the operation behavior and an original operation sequence field for recording the plaintext value of the operation behavior to the resource object metadata of the container orchestration system; The admission controller intercepts the resource operation request, dynamically calculates the value of the audit hash field according to the preset rules, and enters the new audit hash value and the new operation sequence field into the resource object metadata; When the operation behavior needs to be verified, the hash chain is recalculated to verify whether the recalculated hash chain is abnormal.

2. The method according to claim 1, characterized in that The adding of the original audit hash field for recording the hash value of the operation behavior and the original operation sequence field for recording the plain text value of the operation behavior in the resource object metadata of the container orchestration system includes: Add the audit-hash field to the metadata.annotations metadata of the resource object in the container orchestration system to record the hash value of the operation behavior, and add the audit-trail field to record the plaintext value of the operation behavior.

3. The method according to claim 1, characterized in that The method of intercepting the resource operation request by the admission controller, dynamically calculating the value of the audit hash field according to a preset rule, and inserting the new audit hash value and the new operation sequence field into the resource object metadata includes: The API Server of the container orchestration system calls the Mutating Webhook to intercept the request, reads the current audit hash value and operation sequence field value of the resource, and according to the preset rules, concatenates the old audit hash value, operation data, user identity, operation type and timestamp into a string and performs a SHA256 operation to obtain a new audit hash value. The new audit hash value and the new operation sequence field are then inserted into the resource object metadata.

4. The method according to claim 1, wherein The method further comprises: The audit hash field and operation sequence field in the resource object metadata are encrypted, and the encrypted data is stored in the distributed key-value storage component.

5. The method according to claim 1, wherein The verifying whether the recalculated hash chain is abnormal includes: Obtain the current configuration information and historical change records of the resource object, and calculate the hash chain according to the preset rules; If the recalculated hash chain is consistent with the audit hash field stored in the resource object metadata, a verification pass is returned; If there is any inconsistency, the first mismatched location is output based on the historical change records, and the operation records are sorted by timestamp to trace the operating user.

6. A device for detecting abnormal operation behavior of a container orchestration system, characterized in that: The device comprises: A resource metadata enhancement unit, configured to add an original audit hash field for recording the hash value of the operation behavior and an original operation sequence field for recording the plaintext value of the operation behavior to the resource object metadata of the container orchestration system; An admission controller processing unit, configured to intercept resource operation requests through an admission controller, dynamically calculate a value of an audit hash field according to preset rules, and insert a new audit hash value and a new operation sequence field into the resource object metadata; The verification and tracing unit is used to recalculate the hash chain when the operation behavior needs to be verified, and verify whether the recalculated hash chain is abnormal.

7. The device according to claim 6, characterized in that The resource metadata enhancement unit is specifically configured to add an audit-hash field to the metadata.annotations metadata of the resource object of the container orchestration system to record the hash value of the operation behavior and to add an audit-trail field to record the plaintext value of the operation behavior.

8. The device according to claim 6, characterized in that The device also includes an encryption storage unit, which is used to encrypt the audit hash field and the operation sequence field in the resource object metadata, and store the encrypted data in the distributed key-value storage component.

9. A computing device, characterized in that The computing device includes: a memory and a processor; The memory is used to store computer programs; The processor is configured to implement the method according to any one of claims 1 to 5 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images