Container safe operation method, device, equipment and product

Abstract

The invention provides a method, a device, equipment and a product for safe operation of a container, and relates to the technical field of cloud computing. The method comprises the steps that an entity container and a mirroring container obtained by mirroring the entity container are operated at the same time, and under the condition that a monitoring model monitors an abnormal state, an abnormal state score is obtained according to the operation state of the mirroring container through an abnormal detection model obtained through pre-training; according to the abnormal state score, matching a corresponding coping strategy in a pre-made strategy library; and synchronously executing a coping strategy on the entity container and the mirror image container. Container behaviors are monitored and abnormal behaviors are detected by combining a monitoring model and an abnormal detection model with mirroring, the accuracy and reliability of detection are improved, a flexible strategy library is constructed, dynamic updating and expansion are supported, and self-adaptive optimization and continuous improvement are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing, in particular to a container safe running method, device, equipment and product. BACKGROUND

[0002] Cloud native platform is a technology platform based on cloud computing architecture, emphasizing features such as elastic expansion and automated management, aiming to achieve an efficient and reliable application running environment. With the development of cloud computing and container technology, cloud native platform provides flexible and efficient application delivery and operation solutions for enterprises. Its characteristics include containerized deployment, microservice architecture, automated management, etc., and is widely used in various fields, promoting digital transformation and innovation. In the future, cloud native platform will continue to develop and integrate with edge computing, artificial intelligence and other technologies, providing more possibilities for application deployment and management.

[0003] In the cloud native platform, container-based arrangements are needed to provide powerful computing capabilities for cloud computing. Therefore, in the cloud native platform, the safe running of containers cannot be ignored. In order to ensure the security of images and containers, various container security technologies are widely used. For example, Docker introduces the Docker Content Trust (DCT) mechanism, which uses public key encryption algorithms to sign images to ensure that the source of the image is trustworthy. In addition, there are some open source tools and frameworks such as Notary (a notarization framework), Cosign (a container signing tool), etc., which provide more flexible and scalable container image signing and verification solutions. In addition, there are some container security enhancement solutions, such as integrity checking of containers, image vulnerability scanning, etc., which aim to protect the security of container images and prevent unauthorized access and malicious behavior of applications and data in the container running environment, in order to improve the overall security of the container environment. However, the existing technology still has problems such as insufficient security supervision and poor security response capability in container security supervision. SUMMARY

[0004] The purpose of the present application is to provide a container safe running method, device, equipment and product, which solves the problem of insufficient security supervision and poor security response capability in the existing technology.

[0005] To achieve the above-mentioned purpose, the embodiments of the present application provide a container safe running method, which is executed by a cloud native platform and includes:

[0006] The entity container and the image container are simultaneously run, and in a case where the monitoring model monitors that a running state of the image container is an abnormal state, an abnormal state score is obtained according to the running state of the image container by using an abnormality detection model obtained by pre-training; wherein the image container is obtained by mirroring the entity container;

[0007] According to the abnormal state score, a corresponding coping strategy is matched in a pre-prepared strategy library;

[0008] The coping strategy is synchronously executed on the entity container and the image container.

[0009] Optionally, the method further comprises:

[0010] After obtaining the image container, the image content of the image container is scanned and analyzed by using an image scanning tool to obtain abnormal information of the image content;

[0011] A scanning report is generated according to the abnormal information;

[0012] In a case where there is a security risk in the image container, the image container is repaired.

[0013] Optionally, the method, wherein the entity container and the image container are simultaneously run, and in a case where the monitoring model monitors that a running state of the image container is an abnormal state, an abnormal state score is obtained according to the running state of the image container by using an abnormality detection model obtained by pre-training, comprises:

[0014] The first data of the entity container is imported into the image container, so that the image container runs according to the first data; wherein the first data comprises real-time running state data and / or real-time network traffic data of the entity container;

[0015] Feature extraction is performed on second data of the image container to obtain abnormality detection features; wherein the second data comprises real-time running state data and / or real-time network traffic data of the image container;

[0016] The monitoring model is used to determine whether the image container is in an abnormal state according to the abnormality detection features;

[0017] In a case where the image container is in an abnormal state, the abnormality detection features are input into the abnormality detection model to obtain the abnormal state score.

[0018] Optionally, the abnormal state score comprises at least one of a system call frequency abnormality index score, a traffic pattern similarity score, and a resource usage abnormality score.

[0019] In a case where the system call frequency anomaly index score exceeds a first preset threshold range, the coping strategy comprises determining a dangerous call source of system call frequency anomaly and limiting dangerous call behavior of the dangerous call source.

[0020] In a case where the traffic pattern similarity score exceeds a second preset threshold range, the coping strategy comprises adjusting network configuration of the entity container and the mirror container.

[0021] In a case where the resource usage anomaly score exceeds a third preset threshold range, the coping strategy comprises adjusting resource quota.

[0022] Optionally, the method further comprises:

[0023] obtaining first training data and second training data; wherein the first training data is running state anomaly data and / or network traffic anomaly data of the entity container for training, and the second training data is the anomaly state score calculated according to the first training data;

[0024] inputting the first training data into a to-be-trained anomaly detection model, and training the to-be-trained anomaly detection model by using a learning algorithm to obtain an output result;

[0025] optimizing the to-be-trained anomaly detection model according to a comparison result of comparing the output result with the second training data, to obtain the trained anomaly detection model.

[0026] Optionally, the method, wherein inputting the first training data into a to-be-trained anomaly detection model, and training the to-be-trained anomaly detection model by using a learning algorithm to obtain an output result, comprises:

[0027] inputting the first training data into a system call frequency anomaly index function in the to-be-trained anomaly detection model to calculate a system call frequency anomaly index score of the mirror container; wherein the first training data comprises one or more of system call frequency, system call average frequency and system call type quantity of the mirror container; the output result comprises the system call frequency anomaly index score; and / or

[0028] inputting the first training data into a traffic pattern similarity function in the to-be-trained anomaly detection model to calculate a traffic pattern similarity score of the mirror container; wherein the first training data comprises one or more of network traffic pattern similarity and network traffic value of the mirror container; the output result comprises the traffic pattern similarity score; and / or

[0029] Inputting the first training data into a resource usage anomaly scoring function in the anomaly detection model to be trained for calculation to obtain a resource usage anomaly score for the image container; wherein the first training data includes one or more of the resource usage, resource baseline usage, and resource usage standard deviation of the image container; and the output result includes the resource usage anomaly score.

[0030] Optionally, the method further includes:

[0031] Get multiple first strategies;

[0032] Partitioning and storing the first strategy according to multiple strategy types and multiple risk levels to form the response strategy;

[0033] The strategy library is obtained according to the response strategy.

[0034] Optionally, the method further includes:

[0035] Obtaining response effects of the physical container and the image container after executing the response strategy;

[0036] The anomaly detection model is optimized according to the response effect and the anomaly status score.

[0037] To achieve the above objectives, an embodiment of the present invention further provides a device for securely operating a container, which is executed by a cloud native platform and includes:

[0038] A first acquisition module is configured to simultaneously run a physical container and an image container, and when a monitoring model detects that the operating state of the image container is abnormal, obtain an abnormality score based on the operating state of the image container using a pre-trained anomaly detection model; wherein the image container is obtained by mirroring the physical container;

[0039] A first matching module is used to match a corresponding response strategy in a pre-established strategy library according to the abnormal state score;

[0040] The first processing module is configured to synchronously execute the response strategy on the physical container and the mirror container.

[0041] To achieve the above-mentioned objectives, an embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, a transceiver, and a program or instruction stored in the memory and executable on the processor; wherein, when the processor executes the program or instruction, the method for secure operation of a container as described above is implemented; and the transceiver is configured to receive and send data under the control of the processor.

[0042] To achieve the above object, the embodiment of the present application further provides a readable storage medium, which has a program or instructions stored thereon, wherein the program or instructions are executed by a processor to realize the steps in the method for safe running of a container.

[0043] To achieve the above object, the embodiment of the present application further provides a computer program product, which comprises computer instructions, wherein the computer instructions are executed by a processor to realize the steps in the method for safe running of a container.

[0044] The beneficial effects of the above technical solution of the present application are as follows:

[0045] In the embodiment of the present application, the mirror image container for mirror image acquisition of the entity container and the entity container are simultaneously run, in the case that the monitoring model monitors an abnormal state, the abnormal state score is obtained according to the running state of the mirror image container by using the abnormality detection model, the coping strategy of the abnormal state is matched in the strategy library according to the abnormal state score, and the coping strategy is synchronously executed on the entity container and the mirror image container. The container behavior is monitored by combining the monitoring model and the abnormality detection model with the mirror image, the abnormal behavior is detected, the accuracy and reliability of the detection are improved, the flexible strategy library is constructed and dynamic updating and expansion are supported, and adaptive optimization and continuous improvement are realized. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 A schematic diagram of the method for safe running of a container according to the embodiment of the present application is shown in the figure.

[0047] Figure 2 A schematic diagram of the device for safe running of a container according to the embodiment of the present application is shown in the figure.

[0048] Figure 3 A schematic diagram of the electronic device according to the embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0049] To make the technical problems, technical solutions and advantages of the present application clearer, the following will be described in detail with reference to the accompanying drawings and specific embodiments.

[0050] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily mean the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner.

[0051] In various embodiments of the present invention, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0052] Additionally, the terms "system" and "network" are often used interchangeably herein.

[0053] In the embodiments provided herein, it should be understood that "B corresponding to A" means that B is associated with A and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B based solely on A; B can also be determined based on A and / or other information.

[0054] For ease of understanding, some contents involved in the embodiments of the present invention are described below:

[0055] like Figure 1 As shown, a method for securely running a container according to an embodiment of the present invention, which is executed by a cloud native platform, includes:

[0056] S10: Running a physical container and an image container simultaneously, and if the monitoring model detects that the operating state of the image container is abnormal, obtaining an abnormal state score based on the operating state of the image container using a pre-trained anomaly detection model; wherein the image container is obtained by mirroring the physical container;

[0057] It should be noted that each physical container on the cloud native platform is mirrored to obtain a corresponding mirror container, and the monitoring model is set in the mirror container to monitor the running status of the mirror container. When the running status of the mirror container is abnormal, the running status of the mirror container is scored by the anomaly detection model. When the anomaly detection model monitors that any one of the system call frequency anomaly index, network traffic pattern similarity and resource usage anomaly score exceeds the preset corresponding anomaly judgment threshold, abnormal behavior is detected, an alarm is triggered, and the abnormal status score is output.

[0058] S20, matching a corresponding response strategy in a pre-established strategy library according to the abnormal state score;

[0059] It should be noted that the type of abnormal behavior of the mirror container can be determined based on the abnormal state score, and the corresponding coping strategy is matched in the preset policy library, wherein, in the case that the system call frequency abnormality index score in the abnormal state score exceeds the first preset threshold range, it is determined that the type of abnormal behavior of the mirror container is system call frequency abnormality; in the case that the flow pattern similarity score in the abnormal state score exceeds the second preset threshold range, it is determined that the type of abnormal behavior of the mirror container is flow behavior abnormality; in the case that the resource usage abnormality score in the abnormal state score exceeds the third preset threshold range, it is determined that the type of abnormal behavior of the mirror container is resource usage behavior abnormality.

[0060] S30, the coping strategy is synchronously executed on the entity container and the mirror container;

[0061] It should be noted that the coping strategy is synchronously executed in the entity container and the mirror container, wherein the execution in the entity container aims to solve the problems (such as vulnerabilities, power upgrades) caused by abnormal behavior, and the execution in the mirror container aims to determine the execution effect of the coping strategy and synchronize the dynamic changes of the entity container and the mirror container and timely discover the possible policy invalidation.

[0062] In this embodiment, the mirror container for mirroring the entity container and the entity container are simultaneously run, in the case that the monitoring model monitors the abnormal state, the abnormal state score is obtained according to the running state of the mirror container by using the abnormal detection model, the coping strategy of the abnormal state is matched in the policy library according to the abnormal state score, and the coping strategy is synchronously executed on the entity container and the mirror container. By combining the monitoring model and the abnormal detection model with the mirroring of the container behavior, the abnormal behavior is detected, the accuracy and reliability of the detection are improved, a flexible policy library is constructed and dynamic updating and expansion are supported, adaptive optimization and continuous improvement are realized.

[0063] Optionally, the method further comprises:

[0064] After obtaining the mirror container, the mirror scanning tool is used to scan and analyze the mirror content of the mirror container, and the abnormal information of the mirror content is obtained;

[0065] A scanning report is generated according to the abnormal information;

[0066] According to the scanning report, in the case that the mirror container has a security risk, the mirror container is repaired.

[0067] In this embodiment, after the mirror container is built, a scanning task is triggered to analyze the mirror content of the mirror container using a scanning tool to detect known vulnerabilities, malware, etc., wherein the scanning tool can use Clair (bright), Anchore (anchor), etc. to perform deep security scanning on the mirror container. The scanning report is generated based on the abnormal information obtained after scanning, including known vulnerability details, risk level and repair suggestions for the abnormal information. The abnormal information includes vulnerability details and security risk information, etc. Based on the scanning report, the mirror container with vulnerabilities is repaired, and based on the vulnerability index tree and version dependency relationship, all vulnerabilities are searched upwards to obtain a full- compatibility security patch package which is punched into the mirror content of the mirror container, ensuring that the mirror container itself retained on the cloud native platform does not contain known vulnerabilities, malware and other security risks.

[0068] Optionally, the method, wherein the step S10 comprises:

[0069] The first data of the entity container is imported into the mirror container, so that the mirror container runs according to the first data; wherein the first data includes real-time running state data and / or real-time network traffic data of the entity container;

[0070] Feature extraction is performed on the second data of the mirror container to obtain abnormal detection features; wherein the second data includes real-time running state data and / or real-time network traffic data of the mirror container;

[0071] The monitoring model is used to determine whether the mirror container is in an abnormal state according to the abnormal detection features;

[0072] In the case where the mirror container is in an abnormal state, the abnormal detection features are input into the abnormal detection model to obtain the abnormal state score.

[0073] In this embodiment, a monitoring agent is deployed in the entity container: a monitoring agent is deployed in the container host or inside the container to collect real-time running state data of the entity container, including system calls, file system activities, network communication records, resource usage, etc. At the same time, eBPF (Extended Berkeley Packet Filter) data is collected in the entity container: using eBPF technology, network traffic data is collected at the Linux kernel level, including container privileges, privileged port mapping, sensitive file mapping, reverse shell (script), local privilege escalation, escape, to achieve deep monitoring. By collecting real-time running state data and / or real-time network traffic data of the entity container, the first data is obtained, and the first data is imported into the image container, so that the image container is run in the image mode. The second data is obtained from the image container, that is, the real-time running state data and / or real-time network traffic data of the image container are collected, and then are cleaned and formatted to eliminate noise and redundant information. The features related to anomaly detection (i.e., anomaly detection features) are extracted from the processed second data, wherein the anomaly detection features include system call frequency, network traffic pattern, etc. The monitoring model is used to determine whether the image container is in an abnormal state according to the anomaly detection features. In the case where the image container is in an abnormal state, the anomaly detection features are input into the anomaly detection model to obtain the abnormal state score.

[0074] It should be noted that the monitoring model is a model generated using a supervised machine learning algorithm. The processes started by a single container, the files read and written, and the network connections established are all regular, so all actions that deviate from the container behavior are removed from the monitoring model.

[0075] Optionally, the method, wherein the abnormal state score includes at least one of a system call frequency anomaly index score, a traffic pattern similarity score, and a resource usage anomaly score.

[0076] In the case where the system call frequency anomaly index score exceeds a first preset threshold range, the coping strategy includes determining a dangerous call source of system call frequency anomaly and limiting the dangerous call behavior of the dangerous call source.

[0077] In the case where the traffic pattern similarity score exceeds a second preset threshold range, the coping strategy includes adjusting the network configuration of the entity container and the image container.

[0078] In the case where the resource usage anomaly score exceeds a third preset threshold range, the coping strategy includes adjusting the resource quota.

[0079] In the embodiment, when the system call frequency anomaly index score of the mirror container exceeds a first preset threshold range, i.e., the system call frequency is abnormal, the coping strategy is to locate the high-frequency call source (i.e., the dangerous call source) through real-time monitoring, limit dangerous call behavior, optimize application code to reduce redundant requests, and dynamically adjust container resource quota to balance performance and isolation;

[0080] When the traffic pattern similarity score exceeds a second preset threshold range, i.e., the absolute difference of network traffic between the current mirror container and another container on the same platform is too large, the coping strategy is to uniformly schedule the strategy through traffic shaping (Traffic Shaping) or dynamically adjust the container network QoS configuration based on service profiling (Service Profiling) to force alignment of key traffic characteristics (such as bandwidth / delay sensitivity).

[0081] When the resource usage anomaly score exceeds a third preset threshold range, i.e., the resource usage is abnormal, the coping strategy is to quickly respond to abnormalities through dynamic resource quota adjustment (such as CPU / memory limitation), real-time monitoring and alarm (Prometheus+Granfa), and automatic scaling (HPA / K8s), and to precisely suppress resource leakage through cgroup (control groups) isolation and process-level optimization (such as OOM Killer strategy).

[0082] Optionally, the method further comprises:

[0083] obtaining first training data and second training data; wherein the first training data is running state anomaly data and / or network traffic anomaly data of the entity container used for training, and the second training data is the anomaly state score calculated according to the first training data;

[0084] inputting the first training data into a to-be-trained anomaly detection model, and training the to-be-trained anomaly detection model by using a learning algorithm to obtain an output result;

[0085] According to a comparison result of comparing the output result with the second training data, the to-be-trained anomaly detection model is optimized to obtain the trained anomaly detection model.

[0086] In the embodiment, the abnormal data artificially constructed or in the historical data during the running of the entity container is used, the Q-Learning and the Temporal difference learning algorithm are used to train the to-be-trained anomaly detection model, the output result is compared with the abnormal state score calculated according to the first training data, the output result is at least one of the system call frequency anomaly index score, the traffic pattern similarity score and the resource use anomaly score output by the to-be-trained anomaly detection model after the first training data is input, the second training data is at least one of the system call frequency anomaly index score, the traffic pattern similarity score and the resource use anomaly score calculated according to the first training data, the output result and the corresponding data in the second training data are compared one by one to obtain the comparison result. In the case that the corresponding data is different, the to-be-trained anomaly detection model is adjusted until the corresponding data in the comparison result is consistent, the to-be-trained anomaly detection model is optimized, the model parameters and structure are optimized to improve the detection accuracy, and the trained anomaly detection model is obtained.

[0087] Optionally, the method, wherein the first training data is input into the to-be-trained anomaly detection model, and a learning algorithm is used to train the to-be-trained anomaly detection model to obtain an output result, comprising:

[0088] The first training data is input into the system call frequency anomaly index function in the to-be-trained anomaly detection model to calculate the system call frequency anomaly index score of the mirror image container; wherein the first training data includes one or more of the system call frequency, the system call average frequency and the system call type number of the mirror image container; the output result includes the system call frequency anomaly index score; and / or

[0089] The first training data is input into the traffic pattern similarity function in the to-be-trained anomaly detection model to calculate the traffic pattern similarity score of the mirror image container; wherein the first training data includes one or more of the network traffic pattern similarity and the network traffic value of the mirror image container; the output result includes the traffic pattern similarity score; and / or

[0090] The first training data is input into the resource use anomaly score function in the to-be-trained anomaly detection model to calculate the resource use anomaly score of the mirror image container; wherein the first training data includes one or more of the resource use amount, the resource baseline use amount and the resource use amount standard deviation of the mirror image container; the output result includes the resource use anomaly score.

[0091] In this embodiment, the system call frequency anomaly index function is:

[0092]

[0093] where SCFI i is the system call frequency anomaly index score of the ith container, freq ij is the frequency of the jth system call in the ith container, mean j is the average frequency of the jth system call across all containers on the same cloud-native platform, and n is the number of system calls. The system call frequency anomaly index function calculates the deviation of each system call frequency from the average frequency and considers the degree of dispersion of the deviation to evaluate the abnormality of the system call pattern of the image container.

[0094] The traffic pattern similarity function is:

[0095]

[0096] where NTPS ik is the network traffic pattern similarity score of the ith container and the kth container within a period of time T, flow it is the network traffic of the ith container at time t, flow kt is the network traffic of the kth container at time t. The traffic pattern similarity function calculates the absolute difference in network traffic at the same time point between the two containers and normalizes it relative to their maximum value to evaluate the traffic pattern similarity score.

[0097] The resource usage anomaly score function is:

[0098]

[0099] where RUAS i is the resource usage anomaly score of the ith container, usage ir is the usage of the ith container on resource r, baseline ir is the baseline usage of resource r, which can be the historical average or a value calculated according to a specific strategy, and stddev ir is the standard deviation of the usage of resource r, which is used to measure the degree of fluctuation. r ∈ {DATA CPU , DATA Memory} is a set notation method used to specify the two possible values that variable r can take: DATA CPU and DATA Memory , where the set DATA CPU and DATA Memoryrespectively represent the usage of central processing unit (CPU) and memory. The resource usage anomaly score function calculates the anomaly degree of the usage of each resource by traversing different resource types (e.g., CPU and memory) and calculating the anomaly degree of the usage of each resource respectively. Specifically, for each resource type r (e.g., CPU or Memory), the deviation of the usage of the resource usage usage ir from its baseline usage baseline ir is normalized by its standard deviation stddev ir , and the square of the normalized deviation is accumulated to obtain the resource usage anomaly score RUAS i of the container i.

[0100] Optionally, the method further comprises:

[0101] obtaining a plurality of first strategies;

[0102] storing the first strategies according to a plurality of strategy types and a plurality of risk levels to form the coping strategies;

[0103] obtaining the strategy library according to the coping strategies.

[0104] In this embodiment, obtaining a plurality of first strategies for specific security threats or risks includes: a vulnerability repair strategy: a repair scheme for a specific vulnerability; an isolation strategy: isolating or limiting the container when an abnormal behavior is found; and a response strategy: performing different emergency response measures for different types of attacks. After collecting and sorting various security strategies and customizing and modifying them according to actual conditions to form a plurality of first strategies, the plurality of first strategies are stored in a plurality of partitions according to a plurality of strategy types and a plurality of risk levels, respectively, to form the strategy library of the coping strategies, facilitating quick retrieval and execution of the coping strategies.

[0105] Optionally, the method further comprises:

[0106] obtaining the response effect of the entity container and the mirror container after executing the coping strategies;

[0107] optimizing the anomaly detection model according to the response effect and the anomaly state score.

[0108] In this embodiment, after the entity container and the mirror container execute the coping strategies, the running state of the mirror container is continuously monitored to ensure that new abnormal behaviors are found in time, and the anomaly detection model is fed back and optimized according to the response effect and the anomaly state score, improving the adaptability and accuracy of detection.

[0109] AsFigure 2 To achieve the above object, the embodiment of the present application also provides a device for safe operation of a container, wherein the device is executed by a cloud native platform and comprises the following steps of:

[0110] The first obtaining module 201 is configured to run an entity container and an image container simultaneously, and obtain an abnormal state score according to a running state of the image container by using an abnormality detection model trained in advance in a case where the monitoring model monitors that the running state of the image container is an abnormal state; wherein the image container is obtained by mirroring the entity container;

[0111] The first matching module 202 is configured to match a corresponding coping strategy in a pre-prepared strategy library according to the abnormal state score.

[0112] The first processing module 203 is configured to synchronously execute the coping strategy on the entity container and the image container.

[0113] Optionally, the device further comprises:

[0114] The second obtaining module is configured to scan and analyze image content of the image container by using an image scanning tool after obtaining the image container, and obtain abnormal information of the image content.

[0115] The first generating module is configured to generate a scanning report according to the abnormal information.

[0116] The second processing module is configured to repair the image container in a case where the image container has a security risk according to the scanning report.

[0117] Optionally, the device, wherein the first obtaining module 201 comprises:

[0118] The first processing unit is configured to import first data of the entity container into the image container, so that the image container runs according to the first data; wherein the first data comprises real-time running state data and / or real-time network flow data of the entity container.

[0119] The first obtaining unit is configured to extract features of second data of the image container, and obtain abnormality detection features; wherein the second data comprises real-time running state data and / or real-time network flow data of the image container.

[0120] The first judging unit is configured to judge whether the image container is in an abnormal state according to the abnormality detection features by using the monitoring model.

[0121] The second obtaining unit is configured to input the anomaly detection feature into the anomaly detection model when the mirror container is in an abnormal state, and obtain the abnormal state score.

[0122] Optionally, the apparatus, wherein the abnormal state score comprises at least one of a system call frequency anomaly index score, a traffic pattern similarity score, and a resource usage anomaly score.

[0123] When the system call frequency anomaly index score exceeds a first preset threshold range, the coping strategy comprises determining a dangerous call source of system call frequency anomaly and limiting dangerous call behavior of the dangerous call source.

[0124] When the traffic pattern similarity score exceeds a second preset threshold range, the coping strategy comprises adjusting network configurations of the entity container and the mirror container.

[0125] When the resource usage anomaly score exceeds a third preset threshold range, the coping strategy comprises adjusting resource quota.

[0126] Optionally, the apparatus further comprises:

[0127] The third obtaining module is configured to obtain first training data and second training data; wherein the first training data is running state anomaly data and / or network traffic anomaly data of the entity container for training, and the second training data is the abnormal state score calculated according to the first training data.

[0128] The fourth obtaining module is configured to input the first training data into a to-be-trained anomaly detection model, and train the to-be-trained anomaly detection model by using a learning algorithm to obtain an output result.

[0129] The fifth obtaining module is configured to optimize the to-be-trained anomaly detection model according to a comparison result of comparing the output result with the second training data, and obtain the trained anomaly detection model.

[0130] Optionally, the apparatus, wherein the fourth obtaining module comprises:

[0131] The third obtaining unit is configured to input the first training data into a system call frequency anomaly index function in the to-be-trained anomaly detection model to calculate a system call frequency anomaly index score of the mirror container; wherein the first training data comprises one or more of system call frequency, system call average frequency, and system call type quantity of the mirror container; and the output result comprises the system call frequency anomaly index score; and / or

[0132] The fourth obtaining unit is configured to input the first training data into a traffic pattern similarity function in the to-be-trained anomaly detection model to perform calculation, and obtain a traffic pattern similarity score of the mirror container; wherein the first training data comprises one or more of a network traffic pattern similarity and a network traffic value of the mirror container; and the output result comprises the traffic pattern similarity score; and / or

[0133] The fifth obtaining unit is configured to input the first training data into a resource usage anomaly scoring function in the to-be-trained anomaly detection model to perform calculation, and obtain a resource usage anomaly score of the mirror container; wherein the first training data comprises one or more of a resource usage amount, a resource baseline usage amount and a resource usage amount standard deviation of the mirror container; and the output result comprises the resource usage anomaly score.

[0134] Optionally, the apparatus further comprises:

[0135] The sixth obtaining module is configured to obtain a plurality of first strategies.

[0136] The third processing module is configured to store the first strategies according to a plurality of strategy types and a plurality of risk levels to form the coping strategies.

[0137] The seventh obtaining module is configured to obtain the strategy library according to the coping strategies.

[0138] Optionally, the apparatus further comprises:

[0139] The eighth obtaining module is configured to obtain a response effect of the entity container and the mirror container after executing the coping strategies.

[0140] The fourth processing module is configured to optimize the anomaly detection model according to the response effect and the anomaly state score.

[0141] It should be noted that the apparatus provided by the embodiments of the present application can realize all the method steps achieved by the method embodiments and achieve the same technical effects, and thus the same parts and beneficial effects of the method embodiments will not be described in detail herein.

[0142] As Figure 3As shown, in order to achieve the above object, the embodiment of the present application further provides an electronic device, comprising: a processor 301, a memory 302, a transceiver 303 and a program or instruction stored on the memory 302 and executable on the processor 301; wherein the transceiver 303 is used to receive and send data under the control of the processor 301; the processor 301 implements each process of the method embodiment of the safe running of the container as described above when executing the program or instruction, and can achieve the same technical effects, to avoid repetition, which will not be described here.

[0143] In the above method embodiment, the bus architecture can include any number of interconnected buses and bridges, and various circuits of the processor 301 representing one or more processors and the memory 302 representing the memory are linked together. The bus architecture can also link various other circuits such as peripheral devices, voltage stabilizers and power management circuits, which are well known in the art, and thus, further description thereof will not be made herein. The bus interface provides an interface. The transceiver 303 can be a plurality of elements, i.e. including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The user interface 304 can also be an interface capable of connecting the required device externally or internally, including but not limited to a keypad, a display, a speaker, a microphone, a joystick, etc. Figure 3

[0144] The processor 301 is responsible for managing the bus architecture and general processing, and the memory 302 can store data used by the processor 301 when performing operations.

[0145] In order to achieve the above object, the embodiment of the present application further provides a readable storage medium having a program or instruction stored thereon, wherein the program or instruction is executed by a processor to implement the steps in the method of safe running of the container as described above.

[0146] In order to achieve the above object, the embodiment of the present application further provides a computer program product, comprising computer instructions, wherein the computer instructions are executed by a processor to implement the steps of the method of safe running of the container as described above.

[0147] It should be further noted that the terminal described in the specification includes but is not limited to a smart phone, a tablet computer and the like, and many functional components described are referred to as modules in order to more particularly emphasize the independence of their implementation.

[0148] ​In the embodiments of the invention, modules can be implemented in software for execution by various types of processors. An identified module of executable code may, for instance, comprise one or more physical or logical blocks of computer instructions. These can be organized as an object, procedure, or function. Nevertheless, the executables of an identified module need not be physically located together, but can comprise disparate instructions stored in different locations which, when joined logically together, comprise the module and achieve the stated purpose for the module.

[0149] Indeed, a module of executable code can be a single instruction, or many instructions, and can even be distributed over several different code segments, among different programs, and across several memory devices. Also, operational data can be identified within the modules and can be

[0150] When a module is implemented in software, the module can be stored in any suitable memory medium as a plurality of instructions for a processor to read and execute. Possible realizations of a module can include circuitry designed to implement the present invention on a hardware level and software code designed to implement the present invention on a software level. Memory medium can include a floppy disk, CD-ROM, DVD, RAM, hard-disk, or any other suitable type of memory medium. The instructions can be arranged, for instance, in object code or in some other format. The software code can be implemented in any desired language, such as Java, C++, or C-Sharp, for instance. The software code can be executed by a processor, such as a microprocessor, a microcontroller, a digital signal processor, or any other suitable processor.

[0151] The foregoing exemplary embodiments are described with reference made to the drawings which are provided for the purpose of explanation and illustration. They are not intended to limit the scope of the invention. Rather, these exemplary embodiments are described in order to enable others skilled in the art to embody the application. As will be understood by those familiar with the art, the application can be embodied in many different forms and should not be limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be complete and fully convey the scope of the application to those skilled in the art. In the drawings, the size and relative sizes of components can be exaggerated for clarity. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular articles "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. Unless otherwise indicated, a value range includes the upper and lower limits of the range and any sub-ranges therebetween.

[0152] The above description is that of the preferred embodiments of the application. Various modifications and changes can be made thereto without departing from the spirit and scope of the application, which is to be understood. The scope of the application is indicated only by the subjoined claims.

Claims

1. A method for secure operation of a container, characterized in that: Executed by cloud-native platforms, including: Running a physical container and a mirror container simultaneously, and if the monitoring model detects that the running state of the mirror container is abnormal, using a pre-trained anomaly detection model to obtain an abnormal state score based on the running state of the mirror container; wherein the mirror container is obtained by mirroring the physical container; According to the abnormal state score, a corresponding response strategy is matched in a pre-established strategy library; The response strategy is synchronously executed on the physical container and the mirror container.

2. The method according to claim 1, characterized in that The method further comprises: After obtaining the image container, use an image scanning tool to scan and analyze the image content of the image container to obtain abnormal information of the image content; Generate a scan report based on the abnormal information; According to the scanning report, if there is a security risk in the image container, the image container is repaired.

3. The method according to claim 1, characterized in that When the physical container and the image container are running simultaneously and the monitoring model detects that the running status of the image container is abnormal, the pre-trained anomaly detection model is used to obtain an abnormal status score based on the running status of the image container, including: Importing first data of the physical container into the mirror container, so that the mirror container runs according to the first data; wherein the first data includes real-time running status data and / or real-time network traffic data of the physical container; Performing feature extraction on the second data of the image container to obtain anomaly detection features; wherein the second data includes real-time operating status data and / or real-time network traffic data of the image container; Using the monitoring model to determine whether the image container is in an abnormal state according to the abnormality detection feature; When the image container is in an abnormal state, the abnormality detection feature is input into the abnormality detection model to obtain the abnormal state score.

4. The method according to claim 1, wherein The abnormal status score includes at least one of a system call frequency abnormality index score, a traffic pattern similarity score, and a resource usage abnormality score; When the system call frequency anomaly index score exceeds a first preset threshold range, the response strategy includes determining a dangerous call source of the system call frequency anomaly and limiting dangerous call behaviors of the dangerous call source; When the traffic pattern similarity score exceeds a second preset threshold range, the response strategy includes adjusting the network configuration of the physical container and the image container; When the resource usage anomaly score exceeds a third preset threshold range, the response strategy includes adjusting the resource quota.

5. The method according to claim 1, wherein The method further comprises: Obtaining first training data and second training data; wherein the first training data is abnormal operation state data and / or abnormal network traffic data of the physical container used for training, and the second training data is the abnormal state score calculated based on the first training data; Inputting the first training data into the anomaly detection model to be trained, and training the anomaly detection model to be trained using a learning algorithm to obtain an output result; According to a comparison result between the output result and the second training data, the anomaly detection model to be trained is optimized to obtain the trained anomaly detection model.

6. The method according to claim 5, characterized in that Inputting the first training data into the anomaly detection model to be trained, and using a learning algorithm to train the anomaly detection model to be trained to obtain an output result, including: Inputting the first training data into the system call frequency anomaly index function in the anomaly detection model to be trained for calculation to obtain a system call frequency anomaly index score for the image container; wherein the first training data includes one or more of the system call frequency, average system call frequency, and number of system call types of the image container; and the output result includes the system call frequency anomaly index score; and / or Inputting the first training data into the traffic pattern similarity function of the anomaly detection model to be trained for calculation to obtain a traffic pattern similarity score of the image container; wherein the first training data includes one or more of the network traffic pattern similarity and the network traffic value of the image container; the output result includes the traffic pattern similarity score; and / or Inputting the first training data into a resource usage anomaly scoring function in the anomaly detection model to be trained for calculation to obtain a resource usage anomaly score for the image container; wherein the first training data includes one or more of the resource usage, resource baseline usage, and resource usage standard deviation of the image container; and the output result includes the resource usage anomaly score.

7. The method according to claim 1, characterized in that The method further comprises: Get multiple first strategies; Partitioning and storing the first strategy according to multiple strategy types and multiple risk levels to form the response strategy; The strategy library is obtained according to the response strategy.

8. The method according to claim 1, characterized in that The method further comprises: Obtaining response effects of the physical container and the image container after executing the response strategy; The anomaly detection model is optimized according to the response effect and the anomaly status score.

9. A device for safe operation of a container, characterized in that: Executed by cloud-native platforms, including: A first acquisition module is configured to simultaneously run a physical container and an image container, and when a monitoring model detects that the operating state of the image container is abnormal, obtain an abnormality score based on the operating state of the image container using a pre-trained anomaly detection model; wherein the image container is obtained by mirroring the physical container; A first matching module is used to match a corresponding response strategy in a pre-established strategy library according to the abnormal state score; The first processing module is configured to synchronously execute the response strategy on the physical container and the mirror container.

10. An electronic device comprising: A processor, a memory, a transceiver, and a program or instruction stored in the memory and executable on the processor; wherein the processor implements the method for secure operation of a container according to any one of claims 1 to 8 when executing the program or instruction; and the transceiver is configured to receive and send data under the control of the processor.

11. A readable storage medium having a program or instruction stored thereon, characterized in that: When the program or instruction is executed by a processor, the steps in the method for secure operation of a container according to any one of claims 1 to 8 are implemented.

12. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the method for secure operation of a container according to any one of claims 1 to 8.

Images