Intrusion detection method for a container environment, intrusion detection device for a container environment, electronic equipment, computer-readable storage medium, and computer program

Abstract

An embodiment of the present disclosure provides a method, device, and storage medium for intrusion detection in a container environment, which invokes an event identification model corresponding to a target container to perform event identification on real-time system events, the event identification model being constructed based on the historical normal system events of the target container, and if it is determined that the real-time system events are not normal system events, invokes pre-configured intrusion detection rules to perform intrusion detection on the real-time system events and determine whether the real-time system events are intrusion events. Utilizing the unity and stability characteristics of the container, an event identification model corresponding to the target container is constructed based on the historical normal system events of the target container, and can accurately identify whether the real-time system events are normal system events based on the event identification model. Furthermore, real-time system events belonging to normal system events are filtered, and full intrusion detection is performed on the unfiltered real-time system events, thereby reducing the amount of intrusion detection data, reducing resource occupation, and improving intrusion detection performance and efficiency.

Description

Technical Field

[0001] This application claims the priority of a Chinese patent application titled "Method, Apparatus, and Storage Medium for Detecting Intrusion into a Container Environment", filed on June 30, 2023, with application number 2023107988073, and all the contents of this application are incorporated herein by reference.

[0002] Embodiments of the present disclosure relate to the technical fields of computers and network communication technologies, and in particular, to methods, apparatuses, and storage media for detecting intrusion into a container environment.

Background Art

[0003] In terminal security products, intrusion detection capabilities are an important core technology, and intrusion detection for container environments is equally important. It can timely detect and prevent malicious network intrusions and ensure the security of the container environment.

[0004] Conventional intrusion detection methods usually detect based on a detection rule set. As the number of detection rule sets increases, the intrusion detection process linearly increases the memory and CPU occupancy rates, reducing the intrusion detection performance and efficiency.

Summary of the Invention

Problems to be Solved by the Invention

[0005] Embodiments of the present disclosure provide a method, apparatus, and storage medium for detecting intrusion into a container environment to improve the performance and efficiency of intrusion detection in a container environment.

Means for Solving the Problems

[0006] According to a first aspect, an embodiment of the present disclosure provides a method for detecting intrusions in a container environment. The method includes calling an event identification model corresponding to a target container for a real-time system event of a target container, wherein the event identification model is a model constructed based on historical normal system events of the target container and is used to identify whether or not a real-time system event in the target container belongs to a normal system event; and, if it is determined that the real-time system event is not a normal system event, calling a pre-configured intrusion detection rule to perform intrusion detection on the real-time system event and determining whether or not the real-time system event is an intrusion event.

[0007] According to a second aspect, an embodiment of the present disclosure provides an intrusion detection device for a container environment. The device includes an identification unit that performs event identification on a real-time system event of a target container by calling an event identification model corresponding to the target container, wherein the event identification model is a model constructed based on the history of normal system events of the target container, and is used to identify whether or not a real-time system event in the target container belongs to a normal system event; and an intrusion detection unit that, if it is determined that the real-time system event is not a normal system event, calls a pre-configured intrusion detection rule to perform intrusion detection on the real-time system event and determines whether or not the real-time system event is an intrusion event.

[0008] According to a third aspect, an embodiment of the present disclosure provides an electronic device comprising at least one processor and memory, the memory storing computer execution commands, and the at least one processor causing the at least one processor to execute the intrusion detection method for a container environment described in the first aspect and various possible designs of the first aspect by executing the computer execution commands stored in the memory.

[0009] According to a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium in which computer execution instructions are stored, and when a processor executes the computer execution instructions, an intrusion detection method for a container environment described in the first aspect and various possible designs of the first aspect is realized.

[0010] According to a fifth aspect, embodiments of the present disclosure provide a computer program product including computer executable instructions, which, when a processor executes the computer executable instructions, realize an intrusion detection method for a container environment described in the first aspect and various possible designs of the first aspect. [Brief explanation of the drawing]

[0011] To more clearly illustrate the embodiments of this disclosure or the prior art, the following drawings, which may be used in the description of the embodiments or the prior art, are briefly introduced below. As will be apparent, the drawings in the following description are some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these without any creative effort.

[0012] [Figure 1] This is a flowchart of an intrusion detection method for a container environment according to one embodiment of the present disclosure. [Figure 2] This is a flowchart of an intrusion detection method for a container environment according to another embodiment of the present disclosure. [Figure 3] This is a flowchart of an intrusion detection method for a container environment according to another embodiment of the present disclosure. [Figure 4]This is a flowchart of the feature extraction process according to another embodiment of the present disclosure. [Figure 5] This is a flowchart of an intrusion detection method for a container environment according to another embodiment of the present disclosure. [Figure 6] This is a flowchart of the training process relating to another embodiment of the present disclosure. [Figure 7] This is a structural block diagram of an intrusion detection device for a container environment according to one embodiment of the present disclosure. [Figure 8] This is a schematic diagram of the hardware structure of an electronic device according to one embodiment of the present disclosure. [Modes for carrying out the invention]

[0013] To further clarify the purpose, technical concepts, and advantages of the embodiments of this disclosure, the technical concepts of the embodiments of this disclosure will be clearly and completely described below with reference to the drawings of the embodiments of this disclosure. Clearly, the embodiments described are some embodiments of this disclosure, not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained without creative work by those skilled in the art also fall within the scope of this disclosure.

[0014] First, we will explain the technical terms related to this disclosure.

[0015] Containers: Containers are operating system layer virtualization technologies that use a lightweight kernel to create isolated operating system spaces that run specific services.

[0016] System behavior events: In terminal security products, these are system behavior events collected by security probe technology, such as process execution events, file read / write events, and network connection events.

[0017] Intrusion detection: Detects whether an application service is being hacked by a hacker while it is running.

[0018] ML algorithm: Abbreviation of Machine Learning, which is a machine learning algorithm.

[0019] Isolation Forest algorithm: Isolation Forest is a fast outlier detection method with linear time complexity and high accuracy, and is used in attack detection in network security, financial transaction fraud detection, disease detection, noise data filtering, etc.

[0020] Conventional intrusion detection methods usually detect based on a detection rule set. As the detection rule set increases, the intrusion detection process linearly increases the memory and CPU occupancy, reducing the intrusion detection performance and efficiency. Therefore, on the premise that the intrusion detection effect (false positive rate and false negative rate) is not lost, how to improve the intrusion detection performance and efficiency and reduce the dependence on system resource usage is a very important indicator in the item of intrusion detection engine capabilities.

[0021] To accelerate intrusion detection and improve detection efficiency, 1) It is possible to use a small number of strong rule sets partially, perform intrusion detection based on the strong rule set, and if there is no match, directly determine it as a normal event without executing all the rules. However, the disadvantages of such a method are relatively many. (2) It is possible to enhance the computing performance of the detection engine. Generally, such a method is realized by the hard-coding method or increasing the system resource allocation ratio of the detection engine. The disadvantages are that the program scalability is not good and the resource occupancy is high. (3) It is to reduce the number of collected events and process them in the way of event compression. The disadvantage of such a method is that the data may be distorted, causing false negatives and false positives.

[0022] Therefore, the above method mainly performs improvement and optimization processing on the problem itself, but at the same time introduces some new problems and does not solve the calculation efficiency problem from the root source. In actual applications, the probability of intrusion events occurring is relatively low, and the proportion of the flow rate of normal events in the system is generally above 99.99%. All of these normal events need to detect a complete intrusion detection rule set, which is very performance-consuming and may also bring pressure to safe operation due to false judgments. Therefore, when ensuring safety effects, it is a high-efficiency and safe solution concept to solve the above problems by means of lightweight methods.

[0023] In terms of container load, a single container is generally a single microservice, and therefore possesses only one service capability. As such, containers exhibit characteristics such as unity, stability, and resistance to deformation. The behavior of a running container's processes, files, and network is relatively uniform and simultaneously exhibits certain regularity. For example, a MySQL container, under normal system behavior, typically reads and writes data files to a specific directory and accesses port 3306 opened by a specific application IP. An Nginx container, under normal system behavior, accesses ports 80 or 443 by an external IP and performs proxy forwarding of network traffic. Generally, it does not perform operations such as executing system commands or writing files. An authorization / authentication service container, generally, does not have an API interface to access the database and specific subsystem modules, and does not perform operations such as executing system commands or accessing external blacklisted IPs. Therefore, in container application scenarios, containerized services have superior data purity of system events generated by containers compared to services deployed on virtual machines. This difference is brought about by the unity and stability characteristics of containers. This disclosure allows us to know that, based on the unity and stability characteristics of containers, the parameter length and characteristic information of normal system events of containers have a certain regularity, so that a target container can be identified by constructing an event identification model corresponding to the target container based on its history of normal system events. Furthermore, based on this event identification model, it is possible to accurately identify whether a real-time system event is a normal system event or not, and by filtering real-time system events that belong to normal system events and performing full intrusion detection on unfiltered real-time system events, the amount of data for intrusion detection is reduced, resource occupation is reduced, intrusion detection performance and efficiency are improved, and intrusion detection is accelerated.

[0024] Specifically, as shown in Figure 1, in this disclosure, feature extraction is performed on the real-time system events of the target container to obtain target feature information, detection is performed based on the event identification model, it is determined whether the parameter length and target feature information of the real-time system event deviate from that of a normal system event, and based on the determination result, it is determined whether the real-time system event is a suspicious event. If it is determined that the real-time system event is a normal system event, there is no need to perform subsequent intrusion detection, and if it is determined that the real-time system event is a suspicious event, a preset intrusion detection rule is called to perform intrusion detection on the real-time system event and it is determined whether the real-time system event is an intrusion event.

[0025] Here, selectively, the event identification model includes a first event identification model and a second event identification model. The first event identification model is a model constructed based on the parameter length of historical normal system events in the target container, and the second event identification model is a model constructed based on the feature information of historical normal system events in the target container. Therefore, using the first and second event identification models, respectively, it is possible to determine whether the parameter length and target feature information of a real-time system event deviate from that of a normal system event. Furthermore, real-time system events belonging to normal system events filtered by the model detection process, and real-time system events that are not intrusion events determined by the intrusion detection process, can be added to the historical normal system events. By iteratively training the first and second event identification models, the models achieve self-adaptation, improving the robustness of the system.

[0026] The intrusion detection method for a container environment according to this disclosure will be described in detail below with reference to specific examples.

[0027] Referring to Figure 2, Figure 2 is a flowchart of an intrusion detection method for a container environment according to one embodiment of the present disclosure. The method of this embodiment can be applied to a terminal device or a server, and the intrusion detection method for the container environment includes the following:

[0028] S201, with respect to the real-time system events of the target container, the event identification model corresponding to the target container is invoked to perform event identification on the real-time system events. The event identification model is a model constructed based on the historical normal system events of the target container and is used to identify whether or not the real-time system events in the target container belong to normal system events.

[0029] In this embodiment, by utilizing the unity and stability characteristics of the container, the normal system events of the target container follow certain rules, and therefore, an event identification model can be constructed in advance based on the historical normal system events of the target container. The event identification model may also be used to identify whether any of the system events of the target container belong to the normal system events, and in this embodiment, the model adopted by the normal system event matching model event identification model is not limited to, for example, any machine learning model capable of realizing the above functions.

[0030] In practical applications, it is possible to acquire real-time system events from a target container in real time, call an event identification model corresponding to the target container to perform event identification on the real-time system events, and determine whether the real-time system events are normal system events or not.

[0031] S202, If it is determined that the real-time system event is not a normal system event, the pre-configured intrusion detection rule is invoked to perform intrusion detection on the real-time system event and determine whether or not the real-time system event is an intrusion event.

[0032] In this embodiment, after event identification is performed on real-time system events using an event identification model, if the real-time system event is determined to be a normal system event, a pre-configured intrusion detection rule is invoked to perform intrusion detection on the real-time system event, thereby achieving the objective of filtering the real-time system event. If the real-time system event cannot be determined to be a normal system event, and the real-time system event is deemed suspicious, a pre-configured intrusion detection rule is invoked to perform intrusion detection on the real-time system event, thereby more accurately determining whether the real-time system event is an intrusion event. By filtering normal system events, resource occupation is reduced, intrusion detection performance and efficiency are improved, and intrusion detection is accelerated. Normally, the probability of an intrusion event occurring is relatively low, and through the above process, 99.99% of normal system events can be filtered from real-time system events, and intrusion detection can be performed on the remaining 0.01% of suspicious events using all pre-configured intrusion detection rules, solving the problem of detection efficiency from the data source header and achieving accelerated intrusion detection.

[0033] Furthermore, if a real-time system event is determined to be an intrusion event, an alarm can be triggered.

[0034] The intrusion detection method for a container environment according to this embodiment calls an event identification model corresponding to the target container for real-time system events of the target container and performs event identification on the real-time system events. The event identification model is a model constructed based on the historical normal system events of the target container and is used to identify whether or not a real-time system event in the target container belongs to a normal system event. If it is determined that the real-time system event is not a normal system event, a pre-configured intrusion detection rule is called to perform intrusion detection on the real-time system event and determine whether or not the real-time system event is an intrusion event. The embodiment of this disclosure utilizes the unity and stability characteristics of containers to construct an event identification model corresponding to the target container based on the historical normal system events of the target container, and further accurately identifies whether or not a real-time system event is a normal system event based on the event identification model. Furthermore, by filtering real-time system events belonging to normal system events and performing full intrusion detection on real-time system events that are not filtered, the amount of data for intrusion detection is reduced, resource occupation is reduced, intrusion detection performance and efficiency are improved, and intrusion detection is accelerated.

[0035] Referring to Figure 3, Figure 3 is a flowchart of an intrusion detection method for a container environment according to one embodiment of the present disclosure. Based on the above embodiment, the intrusion detection method for the container environment includes the following:

[0036] S301 performs feature extraction on real-time system events of the target container to obtain target feature information.

[0037] In this embodiment, multiple different types of system events can be collected in the target container, including, but not limited to, process execution events, file read / write events, network access events, and system capability call events. Under normal circumstances, in a single container, these events exhibit unity and periodicity in the time axis. Real-time collection can be performed for any of these types of system events, and these can be considered real-time system events in this embodiment.

[0038] Selectively, in actual applications, process execution events are the most important system events, and other events, such as file read / write events and network access events, are triggered by process execution events. Therefore, generally, if a process execution event is determined to be a normal system event, other system call events triggered by it, such as file read / write events and network access events, are also likely to be normal system events. Accordingly, in this embodiment, it is preferable that the real-time system event is a process execution event, although it goes without saying that other system events may also be selected.

[0039] Real-time system event data can be collected in the target container execution process, specifically using security probe technology on the server. The process execution event data mainly consists of the following: Process name: curl Process bin (binary file): / bin / curl Parent process name: java Parent process bin: for example / bin / java Command line: curl http: / / aaaa.bbb.ccc Process parameters: http: / / dddd.eee.fff

[0040] Furthermore, feature extraction can be performed on real-time system events to obtain target feature information. Here, the target feature information may be attribute information of the real-time system event. For example, for a process execution event, the target feature information may include, but is not limited to, attribute information such as the process name, parent process name, standard input type, standard output type, parameter type, and parameter format included in the data.

[0041] Selectively, based on the characteristics of the attribute information, the attribute information contained in real-time system event data can be divided into two types: Type 1 attribute information and Type 2 attribute information.

[0042] Here, the first type of attribute information is a strong characteristic attribute, which has a fixed amount of information and a fixed mode, such as process name, process bin, parent process name, parent process bin, standard input type, standard output type, etc. Such strong characteristic attributes are highly reliable features, and each type of attribute information has one or more candidate items, i.e., a constant amount of information and a fixed mode (e.g., fixed format, fixed type, fixed quantity, etc.), and mismatch may not be permitted. In the event of a mismatch, the process execution event indicates an abnormality. For example, the attribute information called process name has several fixed candidate process names, each candidate process name represents one process, and the process name of the same process is fixed, i.e., in a fixed mode. Therefore, for the attribute information called process name, its amount of information and mode are constant, and if the process name of a process execution event does not match any of the candidate process names, the process execution event is an abnormal process execution event. Type 2 attribute information consists of weak feature attributes, has lower confidence than Type 1 attribute information, contains a large amount of information, may not have a constant amount of information, has an unfixed mode, and may not be usable without data transformation to extract features. For example, process parameters, the type, format, and quantity of process parameters for different instructions are all different, and even the process parameters for the same instruction are different. Therefore, Type 2 attribute information requires data transformation (or generalization) to derive stable feature dimensions.

[0043] Here, the transformation to the second type attribute information may be achieved by feature extraction, and the features extracted here may include, but are not limited to, the following dimensions. a) Whether or not it is a digital type. b) Whether or not it is a word. c) Whether or not it is a script type. d) Whether or not a URL (Uniform Resource Locator) exists. e) Presence or absence of an IP address. f) Presence or absence of a UUID (Universally Unique Identifier). g) Other types.

[0044] The feature identification of the aforementioned dimensional data can be analyzed using known algorithms or regular expressions, and such a description is omitted here.

[0045] Therefore, as shown in Figure 4, in this embodiment, first type attribute information and second type attribute information are obtained from the real-time system event data, a conversion process is performed on the second type attribute information to obtain derived attribute information, and then the first type attribute information and derived attribute information are merged to obtain target feature information.

[0046] The target feature information for process execution events is as follows: [Table 1]

[0047] S302, the event identification model corresponding to the target container is called, and it is determined whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and event identification is performed on the real-time system event based on the determination result.

[0048] In this embodiment, an event identification model can be constructed in advance based on the history of normal system events of the target container, and the event identification model can learn and summarize the parameter length information and target feature information of the normal system events of the target container. The event identification model may be a machine learning model or other model that can arbitrarily achieve the learning objectives described above.

[0049] Furthermore, for any real-time system event, the event identification model determines, based on the target feature information of the real-time system event, whether the parameter length and target feature information of the real-time system event deviate from those of a normal system event. If they deviate, the real-time system event is determined to be a suspicious event; otherwise, the real-time system event is determined to be a normal system event. By utilizing the unity and stability features of the container and combining the parameter length and target feature information, missed events and misjudgments can be reduced. Herein, in this embodiment, the method of learning and summarizing the parameter length information and target feature information of normal system events in the event identification model is not limited, and the model used in the event identification model is not limited; the above functions may be realized with one model or with two or more models.

[0050] S303, If it is determined that the real-time system event is not a normal system event, the pre-configured intrusion detection rule is invoked to perform intrusion detection on the real-time system event and determine whether or not the real-time system event is an intrusion event.

[0051] The explanation for S202 above will be omitted here.

[0052] This embodiment utilizes the unity and stability characteristics of containers to determine whether a real-time system event deviates from a normal system event based on two aspects: the parameter length of the real-time system event and the target feature information. By filtering out real-time system events that do not deviate from normal system events with high accuracy and performing complete intrusion detection on real-time system events that deviate from normal system events, the amount of data for intrusion detection is reduced, resource occupation is lowered, intrusion detection performance and efficiency are improved, and intrusion detection is accelerated.

[0053] Based on any of the above embodiments, in order to improve the effectiveness of the model and reduce the missed and false positive rates, the event identification model is implemented using a dual-engine model, which includes a first event identification model and a second event identification model. The first event identification model is a model built on the parameter lengths of historical normal system events in the target container and determines whether the parameter lengths of real-time system events do not meet the parameter lengths of normal system events. The second event identification model is a model built on the feature information of historical normal system events in the target container and determines whether the target feature information of real-time system events deviates from the feature information of normal system events.

[0054] Therefore, as shown in Figure 5, the overall flow of the intrusion detection method for a container environment according to this embodiment is as follows: After determination by the first event identification model and the second event identification model, if the first event identification model determines that the parameter length of the real-time system event satisfies the parameter length of a normal system event, and the second event identification model determines that the target feature information of the real-time system event does not deviate from the feature information of a normal system event, then the real-time system event is determined to be a normal system event. If the first event identification model determines that the parameter length of the real-time system event does not satisfy the parameter length of a normal system event, and / or the second event identification model determines that the target feature information of the real-time system event deviates from the feature information of a normal system event, then the real-time system event is determined not to be a normal system event, and the real-time system event is determined to be a suspicious event.

[0055] Furthermore, calling the event identification model corresponding to the target container, determining whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing event identification on the real-time system event based on the determination result, The target feature information and the parameter length of the real-time system event are input to the first event identification model, and it is determined whether or not the parameter length of the real-time system event satisfies the parameter length of a normal system event. This includes inputting the target feature information into the second event identification model and determining whether the target feature information deviates from the feature information of a normal system event.

[0056] More specifically, the first event identification model pre-learns and summarizes the parameter length rules of historical normal system events to obtain a pre-configured mapping relationship. This pre-configured mapping relationship is a mapping relationship between a keyword corresponding to a normal system event and the corresponding parameter length information, and can be stored using a key-value pair. The keyword Key is a keyword constructed based on the characteristic information of the historical normal system event, and the Value is the parameter length information of the historical normal system event. For example, the characteristic information of a certain historical normal system event is as follows: [Table 2]

[0057] Based on the characteristic information of the historical normal system event, a keyword Key is constructed. For example, by superimposing and combining each dimension of the characteristic information, curl& / bin / curl&java& / bin / java&1&1&0&1&1&0 is obtained. The Value is the mean and standard deviation, or the minimum and maximum values, of the parameter lengths of historical normal system events with the same Key. Using mean and standard deviation as an example, the pre-configured mapping relationship is as follows. [Table 3]

[0058] For real-time system events, a target keyword is constructed based on its target feature information. A search is then performed within a pre-configured mapping relationship. By searching for the same keyword as the target keyword within the pre-configured mapping relationship, parameter length information for the corresponding normal system event can be obtained. Furthermore, based on the parameter length X of the real-time system event and the parameter length information of the corresponding normal system event, it is determined whether the parameter length X of the real-time system event does not meet the parameter length of the normal system event. For example, if the parameter length information of the normal system event is the mean u and standard deviation σ, it is possible to calculate whether the parameter length X of the real-time system event satisfies the confidence threshold setting. Based on Chebyshev's inequality theorem, the calculation of the confidence threshold can be simplified to y = u ± N * σ (where u is the mean, σ is the standard deviation, and N is the tolerance), i.e., the threshold interval is the standard deviation σ which is N times the mean u. If the parameter length X of a real-time system event falls within this threshold interval, the real-time system event is considered to match the first event identification model; that is, the parameter length of the real-time system event satisfies the parameter length of a normal system event. Otherwise, it is determined that the real-time system event has fallen outside the first event identification model; that is, the parameter length of the real-time system event does not satisfy the parameter length of a normal system event.

[0059] If the parameter length information for a normal system event is the maximum and minimum values, the threshold interval is directly determined based on the maximum and minimum values. If the parameter length X of a real-time system event is within the threshold interval, the real-time system event is considered to match the first event identification model, i.e., the parameter length of the real-time system event is considered to satisfy the parameter length of a normal system event. Otherwise, it is determined that the real-time system event has fallen outside the first event identification model, i.e., the parameter length of the real-time system event does not satisfy the parameter length of a normal system event.

[0060] Furthermore, in the aforementioned pre-configured mapping relationship, if the same keyword as the target keyword is not found, it is determined that the real-time system event is excluded from the first event identification model. In particular, the target keyword of the real-time system event is excluded from the keyword of the normal system event, and the discrepancy between the target feature information of the real-time system event and the feature information of the normal system event is also explained.

[0061] In any of the above embodiments, the second event identification model is used to determine whether the target feature information of a real-time system event is outside the feature information of a normal system event. Therefore, the second event identification model may also be an out-point determination model. The target feature information is input to the second event identification model, and it is determined whether the feature information corresponding to the normal system event is an out-point. If it is determined that the target feature information is an out-point, it is determined that the target feature information is a feature information that is outside the normal system event.

[0062] The out-point determination model selectively adopted in the second event identification model may be an Isolation Forest model that divides data using a binary tree, where the depth at which a data point is located in the binary tree responds to the degree of "separation" of the data in question, with shallower depths indicating a higher probability of being an out-point. In this embodiment, the second event identification model includes a binary tree structure in which a feature matrix of normal system events is constructed. Furthermore, a matrix is ​​constructed based on the target feature information of real-time system events, the target feature matrix is ​​obtained, and the target feature matrix is ​​matched with the Isolation Forest model to determine the depth of the target feature matrix in the binary tree, thereby determining whether the target feature matrix is ​​an out-point or not. Here, when constructing a matrix based on the target feature information of real-time system events, non-numeric type feature information in the target feature information can be converted to a numeric type, for example, a LabelEncoder or a one-hot algorithm can be used, but are not limited to these methods.

[0063] Based on any of the above embodiments, the above first event identification model is obtained by the following procedure.

[0064] S401, obtain multiple historical normal system events of the target container.

[0065] S402, feature extraction is performed on each of the multiple historical normal system events, and historical feature information corresponding to each historical normal system event is obtained.

[0066] S403, Based on the historical feature information corresponding to the multiple historical normal system events and the parameters of the multiple historical normal system events, parameter length information of the normal system events is obtained, and the first event identification model is obtained.

[0067] In this embodiment, multiple historical normal system events of the target container can be collected, for example, normal system events that occurred over a past period (e.g., one or two days). A feature extraction process and S201 are performed on each of the multiple historical normal system events. Furthermore, parameter length information of the normal system events is learned based on the historical feature information corresponding to the multiple historical normal system events and the parameters of the multiple historical normal system events, and a first event identification model is constructed.

[0068] Specifically, the parameter length information of a normal system event in the first event identification model includes a pre-configured mapping relationship, and since this pre-configured mapping relationship is a mapping relationship between a keyword corresponding to a normal system event and the corresponding parameter length information, the pre-configured mapping relationship can be constructed based on historical feature information corresponding to multiple historical normal system events and the parameters of multiple historical normal system events, and the process is as follows.

[0069] Based on the historical feature information corresponding to each historical normal system event, corresponding keywords are constructed. The process for constructing these keywords can be found in the above embodiment.

[0070] Multiple historical normal system events are grouped based on keywords, and multiple groups are obtained, with each group containing the same keywords for its historical normal system events. Furthermore, the parameters of each historical normal system event with the same keywords are obtained, and based on the parameters of the historical normal system events with the same keywords, corresponding parameter length information is obtained, such as the mean and standard deviation, or the minimum and maximum values, of the parameter lengths of the historical normal system events with the same keywords. Next, a mapping relationship is constructed between each keyword and the corresponding parameter length information, and a pre-configured mapping relationship is obtained and stored as the parameter length information of a normal system event using a key-value pair, where Key is the keyword and Value is the corresponding parameter length information.

[0071] Based on any of the above embodiments, the above second event identification model can be obtained by following the procedure below.

[0072] S501, acquire multiple historical normal system events of the target container.

[0073] S502, feature extraction is performed on each of the aforementioned normal system events in the history, and history feature information corresponding to each of the aforementioned normal system events in the history is obtained.

[0074] S503. Unsupervised learning is performed on the historical feature information corresponding to multiple historical normal system events to obtain the second event identification model.

[0075] In this embodiment, the multiple history normal system events may be the same history normal system event in S401, or they may be different history normal system events. The feature extraction process and S301 described above are performed for each of the multiple history normal system events. If the multiple history normal system events are the same history normal system event in S401, it is not necessary to acquire the multiple history normal system events of the target container and perform feature extraction for each history normal system event, and it is not necessary to perform it again, as shown in Figure 6.

[0076] After obtaining historical feature information corresponding to multiple historical normal system events, an unsupervised learning model can be obtained based on this historical feature information to acquire a second event identification model. The specific learning process can be distinguished using different out-point determination models based on the second event identification model, and is not limited to this example.

[0077] If the second event discrimination model is an Isolation Forest model, the specific steps for unsupervised learning include the following:

[0078] A matrix is ​​constructed for the historical feature information corresponding to each of the aforementioned historical normal system events, and the feature matrix for each of the aforementioned historical normal system events is obtained. When constructing the matrix, non-numeric type feature information in the historical feature information can be converted to a numeric type, for example, by employing a LabelEncoder or a one-hot algorithm, but this is not limited to these methods. Furthermore, unsupervised learning of the Isolation Forest model can be performed based on the feature matrices of multiple aforementioned historical normal system events. Here, the specific learning process of the Isolation Forest model is omitted from this explanation.

[0079] The first and second event identification models in the above embodiment are trained using multiple historical normal system events of the target container, and utilize the container's unity and stability features. These two models are also specific to the target container, and by using these two models, real-time system events of the target container are detected, the accuracy of normal system event filtering is effectively improved, detection efficiency is enhanced, and the risk of missed events and misidentification is reduced.

[0080] Based on any of the above embodiments, real-time system events belonging to normal system events filtered in steps S201 and S302, and real-time system events that are not intrusion events can be identified and joined to historical normal system events, and by iteratively training the first event identification model and the second event identification model, the models achieve self-adaptation and the robustness of the system is improved.

[0081] Figure 7 is a structural block diagram of an intrusion detection device for a container environment according to an embodiment of the present disclosure. For the sake of explanation, only the parts relevant to the embodiment of the present disclosure are shown. Referring to Figure 7, the intrusion detection device 600 for the container environment comprises an identification unit 601 and an intrusion detection unit 602.

[0082] Here, the identification unit 601 calls an event identification model corresponding to the target container to perform event identification on the real-time system events of the target container. The event identification model is a model constructed based on the historical normal system events of the target container and is used to determine whether or not a real-time system event in the target container belongs to a normal system event.

[0083] If the intrusion detection unit 602 determines that the real-time system event is not a normal system event, it calls a pre-configured intrusion detection rule to perform intrusion detection on the real-time system event and determines whether or not the real-time system event is an intrusion event.

[0084] In one or more embodiments of the present disclosure, the intrusion detection device 600 for the container environment further comprises a feature extraction unit 603 for extracting features from the real-time system events and obtaining target feature information.

[0085] Specifically, the identification unit 601 is configured to call an event identification model corresponding to the target container, determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and perform event identification on the real-time system event based on the determination result.

[0086] In one or more embodiments of the present disclosure, the event identification model includes a first event identification model and a second event identification model, wherein the first event identification model is a model constructed based on the parameter length of the historical normal system events of the target container, and the second event identification model is a model constructed based on the characteristic information of the historical normal system events of the target container.

[0087] In one or more embodiments of the present disclosure, when an event identification model corresponding to the target container is invoked, and it is determined whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and event identification is performed on the real-time system event based on the determination result, the identification unit 601, The target feature information and the parameter length of the real-time system event are input to the first event identification model, and it is determined whether the parameter length of the real-time system event does not satisfy the parameter length of a normal system event. The target feature information is input to the second event identification model, and it is determined whether the target feature information deviates from the feature information of a normal system event.

[0088] In one or more embodiments of the present disclosure, the first event identification model has a pre-configured mapping relationship, which is a mapping relationship between a keyword corresponding to a normal system event of the target container and the corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the characteristic information of the normal system event.

[0089] When the target feature information and the parameter length of the real-time system event are input to the first event identification model, and it is determined whether or not the parameter length of the real-time system event satisfies the parameter length of a normal system event, the identification unit 601, Based on the aforementioned target feature information, target keywords are constructed. Based on the aforementioned target keywords, a search is performed within the pre-configured mapping relationships. When the same keyword as the target keyword is searched in the aforementioned pre-configured mapping relationship, the parameter length information of the normal system event corresponding to that keyword is obtained. Based on the parameter length information of the real-time system event and the normal system event, it is determined whether the parameter length of the real-time system event does not meet the parameter length of the normal system event. If the same keyword as the target keyword is not found in the aforementioned pre-configured mapping relationship, it is determined that the target feature information is outside the normal system event.

[0090] In one or more embodiments of the present disclosure, the second event identification model is an out-point determination model. Accordingly, when the target feature information is input to the second event identification model and it is determined whether the target feature information deviates from the feature information of a normal system event, the identification unit 601 The target feature information is input to the second event identification model, and it is determined whether the target feature information is an out point for the feature information corresponding to a normal system event. If the target feature information is determined to be an out-point, it is determined that the target feature information is a feature information that deviates from a normal systematic event.

[0091] In one or more embodiments of the present disclosure, the second event identification model is an Isolation Forest model constructed based on historical normal system events. Accordingly, when the target feature information is input to the second event identification model and the identification unit 601 determines whether the target feature information is an out point for the feature information corresponding to the historical normal system event, the identification unit 601 A matrix is ​​constructed based on the aforementioned target feature information, and the target feature matrix is ​​obtained. The target feature matrix is ​​matched with the isolation forest model to determine whether the target feature matrix is ​​an out point or not.

[0092] In one or more embodiments of this disclosure, when feature extraction is performed on real-time system events of a target container to obtain target feature information, the feature extraction unit 603, The system acquires first-type attribute information and second-type attribute information from the data of the real-time system event, where the first-type attribute information is attribute information having a fixed amount of information and a fixed mode, and the second-type attribute information is attribute information whose amount of information or mode is not fixed. A conversion process is performed on the aforementioned second type attribute information to obtain derived attribute information, The first type attribute information and the derived attribute information are merged to obtain the target feature information.

[0093] In one or more embodiments of the present disclosure, the apparatus further includes a training unit that performs a training process on the first event identification model, the training process being as follows: The target container acquires multiple historical normal system events, Feature extraction is performed for each of the multiple historical normal system events, and historical feature information corresponding to each historical normal system event is obtained. Based on the historical feature information corresponding to multiple historical normal system events and the parameters of multiple historical normal system events, parameter length information of the normal system events is obtained, and the first event identification model is obtained.

[0094] In one or more embodiments of this disclosure, when obtaining parameter length information of a normal system event based on historical feature information corresponding to a plurality of historical normal system events and parameters of a plurality of historical normal system events, and obtaining the first event identification model, the training unit, Based on the historical characteristic information corresponding to each of the aforementioned historical normal system events, a corresponding keyword is constructed. The process involves grouping multiple historical normal system events based on keywords, obtaining parameters for historical normal system events with the same keyword, and obtaining corresponding parameter length information based on the parameters of the historical normal system events with the same keyword. This includes constructing a mapping relationship between each keyword and its corresponding parameter length information, and obtaining the pre-configured mapping relationship as the parameter length information for a normal system event.

[0095] In one or more embodiments of the present disclosure, the training unit further performs a training process on the second event identification model, the training process being as follows: Obtain multiple historical normal system events from the target container, Feature extraction is performed for each of the aforementioned normal system events in the history, and historical feature information corresponding to each of the aforementioned normal system events in the history is obtained. Unsupervised learning is performed on the historical feature information corresponding to multiple historical normal system events to obtain the second event identification model.

[0096] In one or more embodiments of this disclosure, if the second event identification model is an Isolation Forest model built on historical normal system events, the training unit performs unsupervised learning on historical feature information corresponding to a plurality of such historical normal system events, A matrix is ​​constructed for the historical feature information corresponding to each of the aforementioned historical normal system events, and the feature matrix for each of the aforementioned historical normal system events is obtained. Unsupervised learning of the Isolation Forest model is performed based on the feature matrices of multiple historical normal system events.

[0097] The apparatus according to this embodiment may be configured to implement the technical proposal of the above-described method embodiment, and its implementation principle and technical effects are similar; therefore, in this embodiment, a detailed explanation is omitted here.

[0098] Figure 8 is a schematic diagram showing the configuration of an electronic device 900 suitable for implementing an embodiment of the present disclosure, where the electronic device 700 may be a terminal device or a server. Here, the terminal device may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (PDAs), tablet PCs (Portable Android Devices, PADs), portable media players (PMPs), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. The electronic device shown in Figure 8 is merely an example and does not impose any limitations on the functions and scope of use of the embodiments of the present disclosure.

[0099] As shown in Figure 8, the electronic device 700 may include a processing unit (e.g., a central processing unit, a graphics processor, etc.) 701 capable of performing various appropriate operations and processes based on a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. The RAM 703 also stores various programs and data necessary for the operation of the electronic device 700. The processing unit 701, ROM 702, and RAM 703 are interconnected by a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0100] Typically, the following devices include an I / O interface 705: input devices 706 including, for example, a touchscreen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 707 including, for example, a Liquid Crystal Display (LCD), speaker, vibrator, etc.; storage devices 708 including, for example, magnetic tape, hard disk, etc.; and communication devices 709. The communication devices 709 can allow the electronic device 700 to exchange data with other devices via wireless or wired communication. Figure 8 shows an electronic device 700 with various devices, but it is not required to implement or include all of them. Alternatively, more or fewer devices may be included.

[0101] In particular, according to embodiments of the present disclosure, the process described with reference to the flowchart above may be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product which includes a computer program that includes program code for performing the method shown in the flowchart. In such embodiments, the computer program may be downloaded and installed from a network via a communication device 709, installed from a storage device 708, or installed from a ROM 702. When the computer program is executed by a processing unit 701, it performs the functions limited to the methods of embodiments of the present disclosure.

[0102] The computer-readable media described in this disclosure may be computer-readable signal media, computer-readable storage media, or any combination of both. Computer-readable storage media may, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination of more than these. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections having one or more wires, portable computer magnetic disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this disclosure, computer-readable storage media may be any tangible medium containing a program, which may be instructed to be used with or in combination with a system, device, or apparatus. In this disclosure, computer-readable signal media may include data signals propagating in the baseband or as part of a carrier wave, which contain computer-readable program code. Such propagating data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium may be any computer-readable medium other than a computer-readable storage medium, and such computer-readable signal medium may transmit, propagate, or transmit instruction execution systems, apparatus, or devices, or programs used in combination therewith. Program code contained in the computer-readable medium may be transmitted using any suitable medium, but is not limited thereto.

[0103] The computer-readable medium described above may be included in the electronic device described above, or it may exist independently without being incorporated into the electronic device.

[0104] The computer-readable medium described above carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device is instructed to perform the method shown in the above embodiment.

[0105] Computer program code for performing the operations of the Disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java®, Smalltalk, and C++, and further including the C language or a similar programming language. The program code may run entirely on the user's computer, partially on the user's computer, run as a standalone software package, run partially on the user's computer or partially on a remote computer, or run entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or it may be connected to an external computer (for example, connected via the Internet using an Internet service provider).

[0106] The flowcharts and block diagrams in the drawings illustrate the implementable system architectures, functions, and operations of systems, methods, and computer program products relating to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, block, or portion of code containing one or more executable instructions for implementing a pre-configured logical function. Alternatively, note that the functions described in a block may be generated in an order different from the order shown in the drawings. For example, two consecutively shown blocks may actually be executed essentially in parallel, or they may be executed in reverse order, as determined by the functions. Furthermore, each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, may be implemented by a system with dedicated hardware for performing the pre-configured function or operation, or by a combination of dedicated hardware and computer instructions.

[0107] The units referred to in the embodiments of this disclosure may be implemented in software or in hardware. The unit names are not limiting to the units themselves; for example, the first acquisition unit may be described as "a unit that acquires at least two Internet Protocol addresses."

[0108] Here, at least part of the functions described above may be performed by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, not limited to, include field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), dedicated standard products (ASSPs), on-chip systems (SOCs), and complex programmable logic devices (CPLDs).

[0109] In the context of this disclosure, a machine-readable medium may be a tangible medium that contains or stores a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium includes, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or apparatus, or any suitable combination thereof. More specific examples of machine-readable storage media include one or more wire-based electrical connections, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0110] According to a first aspect, one or more embodiments of the present disclosure provide a method for detecting intrusion in a container environment. The method is: Regarding real-time system events of a target container, the event identification model corresponding to the target container is invoked to perform event identification on the real-time system events, wherein the event identification model is a model constructed based on the historical normal system events of the target container, and is used to identify whether or not a real-time system event in the target container belongs to a normal system event. If it is determined that the real-time system event is not a normal system event, the system includes calling a pre-configured intrusion detection rule to perform intrusion detection on the real-time system event and determining whether or not the real-time system event is an intrusion event.

[0111] According to one or more embodiments of this disclosure, calling an event identification model corresponding to the target container to perform event identification on the real-time system event is: The process involves extracting features from the aforementioned real-time system events to obtain target feature information, This includes calling an event identification model corresponding to the target container, determining whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing event identification on the real-time system event based on the determination result.

[0112] According to one or more embodiments of the present disclosure, the event identification model includes a first event identification model and a second event identification model, wherein the first event identification model is a model constructed based on the parameter length of the historical normal system events of the target container, and the second event identification model is a model constructed based on the characteristic information of the historical normal system events of the target container.

[0113] According to one or more embodiments of this disclosure, an event identification model corresponding to the target container is invoked, and it is determined whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and event identification is performed on the real-time system event based on the determination result, The target feature information and the parameter length of the real-time system event are input to the first event identification model, and it is determined whether or not the parameter length of the real-time system event satisfies the parameter length of a normal system event. This includes inputting the target feature information into the second event identification model and determining whether the target feature information deviates from the feature information of a normal system event.

[0114] According to one or more embodiments of the present disclosure, the first event identification model has a pre-configured mapping relationship, which is a mapping relationship between a keyword corresponding to a normal system event of the target container and the corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the characteristic information of the normal system event.

[0115] Calling the event identification model corresponding to the target container and determining whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container is: Constructing target keywords based on the aforementioned target feature information, The search is performed in a pre-configured mapping relationship based on the aforementioned target keyword. When searching for the same keyword as the target keyword in the aforementioned pre-configured mapping relationship, the parameter length information of the normal system event corresponding to that keyword is obtained. Based on the parameter length information of the real-time system event and the normal system event, it is determined whether the parameter length of the real-time system event does not meet the parameter length of the normal system event. This includes determining that the target feature information is outside the normal system event category if the same keyword as the target keyword is not found in the pre-configured mapping relationship.

[0116] According to one or more embodiments of this disclosure, the second event identification model is an out-point determination model. Accordingly, inputting the target feature information into the second event identification model and determining whether the target feature information deviates from the feature information of a normal system event is The target feature information is input into the second event identification model, and it is determined whether the target feature information is an out-point for the feature information corresponding to a normal system event. If the target feature information is determined to be an out-point, this includes determining that the target feature information is a feature information that deviates from a normal systematic event.

[0117] According to one or more embodiments of this disclosure, the second event identification model is an Isolation Forest model constructed based on historical normal system events. Accordingly, inputting the target feature information into the second event identification model and determining whether the target feature information is an out point for the feature information corresponding to the historical normal system event is The process involves constructing a matrix based on the aforementioned target feature information to obtain the target feature matrix, This includes matching the target feature matrix with the isolation forest model and determining whether the target feature matrix is ​​an out point or not.

[0118] According to one or more embodiments of this disclosure, feature extraction is performed on real-time system events of a target container to obtain target feature information. The method involves obtaining first-type attribute information and second-type attribute information in the data of the aforementioned real-time system event, wherein the first-type attribute information is attribute information having a fixed amount of information and a fixed mode, and the second-type attribute information is attribute information whose amount of information or mode is not fixed. The process involves performing a conversion on the aforementioned second type attribute information to obtain derived attribute information, This includes merging the first type attribute information and the derived attribute information to obtain the target feature information.

[0119] According to one or more embodiments of the present disclosure, the first event identification model is obtained by the following procedure. Multiple historical normal system events of the target container are obtained. Feature extraction is performed on each of the multiple historical normal system events, and historical feature information corresponding to each historical normal system event is obtained. Based on the historical feature information corresponding to multiple historical normal system events and the parameters of the multiple historical normal system events, parameter length information of the normal system events is obtained, and the first event identification model is obtained.

[0120] According to one or more embodiments of this disclosure, obtaining parameter length information of a normal system event and obtaining the first event identification model based on the historical feature information corresponding to the plurality of historical normal system events and the parameters of the plurality of historical normal system events is: Based on the historical characteristic information corresponding to each of the aforementioned historical normal system events, a corresponding keyword is constructed. The process involves grouping multiple historical normal system events based on keywords, obtaining parameters for historical normal system events with the same keyword, and obtaining corresponding parameter length information based on the parameters of the historical normal system events with the same keyword. This includes establishing a mapping relationship between each keyword and its corresponding parameter length information, and obtaining the pre-configured mapping relationship as the parameter length information for a normal system event.

[0121] According to one or more embodiments of the present disclosure, the second event identification model is obtained by following the procedure described below. Multiple historical normal system events from the target container are retrieved. Feature extraction is performed on each of the aforementioned normal system events in the history, and history feature information corresponding to each of the aforementioned normal system events in the history is obtained. Unsupervised learning is performed on the historical feature information corresponding to multiple historical normal system events to obtain the second event identification model.

[0122] According to one or more embodiments of this disclosure, if the second event identification model is an Isolation Forest model built on historical normal system events, then performing unsupervised learning on the historical feature information corresponding to the plurality of historical normal system events is: A matrix is ​​constructed for the historical feature information corresponding to each of the aforementioned historical normal system events, and the feature matrix for each of the aforementioned historical normal system events is obtained. This includes performing unsupervised learning of an Isolation Forest model based on a feature matrix of multiple historical normal system events.

[0123] In the second part, according to one or more embodiments of the present disclosure, an intrusion detection device for a container environment is provided. The device is An identification unit that performs event identification on real-time system events of a target container by calling an event identification model corresponding to the target container, wherein the event identification model is a model constructed based on the historical normal system events of the target container, and is used to identify whether or not a real-time system event in the target container belongs to a normal system event. The system includes an intrusion detection unit that, if it is determined that the real-time system event is not a normal system event, invokes a pre-configured intrusion detection rule to perform intrusion detection on the real-time system event and determines whether or not the real-time system event is an intrusion event.

[0124] According to one or more embodiments of the present disclosure, the intrusion detection device for the container environment further includes a feature extraction unit for extracting features from the real-time system events and obtaining target feature information.

[0125] Specifically, the identification unit is configured to call an event identification model corresponding to the target container, determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and perform event identification on the real-time system event based on the determination result.

[0126] According to one or more embodiments of the present disclosure, the event identification model includes a first event identification model and a second event identification model, wherein the first event identification model is a model constructed based on the parameter length of the historical normal system events of the target container, and the second event identification model is a model constructed based on the characteristic information of the historical normal system events of the target container.

[0127] According to one or more embodiments of the present disclosure, when an event identification model corresponding to the target container is invoked, and it is determined whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and event identification is performed on the real-time system event based on the determination result, the identification unit: The target feature information and the parameter length of the real-time system event are input to the first event identification model, and it is determined whether the parameter length of the real-time system event does not satisfy the parameter length of a normal system event. The target feature information is input to the second event identification model, and it is determined whether the target feature information deviates from the feature information of a normal system event.

[0128] According to one or more embodiments of the present disclosure, the first event identification model has a pre-configured mapping relationship, which is a mapping relationship between a keyword corresponding to a normal system event of the target container and the corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the characteristic information of the normal system event.

[0129] When the target feature information and the parameter length of the real-time system event are input to the first event identification model, and it is determined whether or not the parameter length of the real-time system event satisfies the parameter length of a normal system event, the identification unit: Based on the aforementioned target feature information, target keywords are constructed. Based on the aforementioned target keywords, a search is performed within the pre-configured mapping relationships. When the same keyword as the target keyword is searched in the aforementioned pre-configured mapping relationship, the parameter length information of the normal system event corresponding to that keyword is obtained. Based on the parameter length information of the real-time system event and the normal system event, it is determined whether the parameter length of the real-time system event does not meet the parameter length of the normal system event. If the same keyword as the target keyword is not found in the aforementioned pre-configured mapping relationship, it is determined that the target feature information is outside the normal system event.

[0130] According to one or more embodiments of the present disclosure, the second event identification model is an out-point determination model. Accordingly, when the target feature information is input to the second event identification model and the identification unit determines whether the target feature information deviates from the feature information of a normal system event, the identification unit The target feature information is input to the second event identification model, and it is determined whether the target feature information is an out point for the feature information corresponding to a normal system event. If the target feature information is determined to be an out-point, it is determined that the target feature information is a feature information that deviates from a normal systematic event.

[0131] According to one or more embodiments of the present disclosure, the second event identification model is an Isolation Forest model constructed on historical normal system events. Accordingly, when inputting the target feature information into the second event identification model and determining whether the target feature information is an out point for the feature information corresponding to the historical normal system event, the identification unit: A matrix is ​​constructed based on the aforementioned target feature information, and the target feature matrix is ​​obtained. The target feature matrix is ​​matched with the isolation forest model to determine whether the target feature matrix is ​​an out point or not.

[0132] According to one or more embodiments of this disclosure, the feature extraction unit performs feature extraction on real-time system events of the target container and obtains target feature information. The system acquires first-type attribute information and second-type attribute information from the data of the real-time system event, where the first-type attribute information is attribute information having a fixed amount of information and a fixed mode, and the second-type attribute information is attribute information whose amount of information or mode is not fixed. A conversion process is performed on the aforementioned second type attribute information to obtain derived attribute information, The first type attribute information and the derived attribute information are merged to obtain the target feature information.

[0133] According to one or more embodiments of the present disclosure, the apparatus further includes a training unit that performs a training process on the first event identification model, the training process being as follows: Multiple historical normal system events from the target container are retrieved. Feature extraction is performed on each of the multiple historical normal system events, and historical feature information corresponding to each historical normal system event is obtained. Based on the historical feature information corresponding to multiple historical normal system events and the parameters of the multiple historical normal system events, parameter length information of the normal system events is obtained, and the first event identification model is obtained.

[0134] According to one or more embodiments of this disclosure, when acquiring parameter length information of a normal system event based on historical feature information corresponding to a plurality of historical normal system events and parameters of a plurality of historical normal system events, and acquiring the first event identification model, the training unit, Based on the historical characteristic information corresponding to each of the aforementioned normal system events, a corresponding keyword is constructed. The system groups multiple historical normal system events based on keywords, retrieves the parameters of historical normal system events with the same keyword, and retrieves corresponding parameter length information based on the parameters of the historical normal system events with the same keyword. A mapping relationship is established between each keyword and its corresponding parameter length information, and the pre-configured mapping relationship is obtained as the parameter length information for a normal system event.

[0135] According to one or more embodiments of the present disclosure, the training unit further performs a training process on the second event identification model, the training process being as follows: Multiple historical normal system events from the target container are retrieved. Feature extraction is performed on each of the aforementioned normal system events in the history, and history feature information corresponding to each of the aforementioned normal system events in the history is obtained. Unsupervised learning is performed on the historical feature information corresponding to multiple historical normal system events to obtain the second event identification model.

[0136] According to one or more embodiments of this disclosure, if the second event identification model is an Isolation Forest model built on historical normal system events, the training unit performs unsupervised learning on historical feature information corresponding to a plurality of such historical normal system events, A matrix is ​​constructed for the historical feature information corresponding to each of the aforementioned historical normal system events, and the feature matrix for each of the aforementioned historical normal system events is obtained. Unsupervised learning of the Isolation Forest model is performed based on the feature matrices of multiple historical normal system events.

[0137] According to a third aspect, one or more embodiments of the present disclosure provide an electronic device comprising at least one processor and memory. The aforementioned memory stores computer execution commands. The at least one processor causes the at least one processor to execute the intrusion detection method for a container environment described in the first embodiment and various possible designs of the first embodiment by executing computer execution instructions stored in the memory.

[0138] According to a fourth aspect, one or more embodiments of the present disclosure provide a computer-readable storage medium storing computer-executable instructions, and when a processor executes the computer-executable instructions, an intrusion detection method for a container environment described in the first aspect and various possible designs of the first aspect is realized.

[0139] According to a fifth aspect, one or more embodiments of the present disclosure provide a computer program product that includes computer execution instructions, which, when executed by a processor, realizes an intrusion detection method for a container environment described in the first aspect and various possible designs of the first aspect.

[0140] The above is merely a description of preferred embodiments and operating technical principles of the present disclosure. Those skilled in the art will understand that the scope of the disclosure is not limited to any specific combination of the above technical features, and also includes other technical solutions formed by any combination of the above technical features or their equivalents, without departing from the spirit of the disclosure. For example, the above features are technical means formed by substituting each other with similar functional technical features disclosed (but not limited to) in this disclosure.

[0141] Furthermore, although each operation is described in a specific order, these operations do not need to be performed chronologically in the order illustrated. Under certain conditions, multitasking and parallel processing are advantageous. Similarly, although some specific implementation details are included above, these should not be construed as limiting the scope of this disclosure. Some features described in the context of a single embodiment may be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may be implemented individually or in any appropriate subcombination in multiple embodiments.

[0142] While this subject matter has been described in language specific to structural features and / or methodological behavior, it should be understood that the subject matter described in the claims is not necessarily limited to the specific features or behaviors described above. Conversely, the specific features and behaviors described above are merely illustrative examples of the claims.

Claims

1. A method for detecting intrusion into a container environment performed by an electronic device, With respect to the real-time system events of a target container, an event identification model corresponding to the target container is invoked to perform event identification on the real-time system events, wherein the event identification model is a model constructed based on the historical normal system events of the target container and is used to determine whether or not the real-time system events in the target container belong to normal system events. If it is determined that the real-time system event is not a normal system event, the system includes calling a pre-configured intrusion detection rule to perform intrusion detection on the real-time system event and determining whether or not the real-time system event is an intrusion event. Calling the event identification model corresponding to the target container and performing event identification on the real-time system event is, The process involves extracting features from the aforementioned real-time system events to obtain target feature information, This includes calling an event identification model corresponding to the target container, determining whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing event identification on the real-time system event based on the determination result, An intrusion detection method for a container environment, characterized by the following features.

2. The event identification model includes a first event identification model and a second event identification model, wherein the first event identification model is a model constructed based on the parameter length of the historical normal system events of the target container, and the second event identification model is a model constructed based on the characteristic information of the historical normal system events of the target container. The method according to claim 1, characterized in that

3. Calling the event identification model corresponding to the target container, determining whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing event identification on the real-time system event based on the determination result, The target feature information and the parameter length of the real-time system event are input to the first event identification model, and it is determined whether the parameter length of the real-time system event does not meet the parameter length of the normal system event. This includes inputting the target feature information into the second event identification model and determining whether the target feature information deviates from the feature information of a normal system event, The method according to claim 2, characterized in that

4. The first event identification model has a pre-configured mapping relationship, which is a mapping relationship between a keyword corresponding to the normal system event of the target container and the corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the characteristic information of the normal system event. Calling the event identification model corresponding to the target container and determining whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container is: Constructing target keywords based on the aforementioned target feature information, Searching in the pre-configured mapping relationships based on the target keywords, When searching for the same keyword as the target keyword in the aforementioned pre-configured mapping relationship, the parameter length information of the normal system event corresponding to that keyword is obtained. Based on the parameter length information of the real-time system event and the parameter length information of the normal system event, it is determined whether the parameter length of the real-time system event does not meet the parameter length of the normal system event. This includes determining that if the same keyword as the target keyword is not found in the pre-configured mapping relationship, the target feature information is excluded from the normal system event. The method according to claim 2, characterized in that

5. The second event identification model is an out-point determination model, and in correspondence, the target feature information is input to the second event identification model, and it is determined whether or not the target feature information deviates from the feature information of a normal system event. The target feature information is input into the second event identification model, and it is determined whether the target feature information is an out-point for the feature information corresponding to a normal system event. If the target feature information is determined to be an out-point, the determination that the target feature information is a feature information that deviates from a normal systematic event includes: The method according to claim 3, characterized in that

6. The second event identification model is an Isolation Forest model constructed based on historical normal system events. Accordingly, the target feature information is input to the second event identification model, and it is determined whether the target feature information is an out point for the feature information corresponding to the historical normal system event. The process involves constructing a matrix based on the aforementioned target feature information to obtain the target feature matrix, This includes matching the target feature matrix with the Isolation Forest model and determining whether the target feature matrix is ​​an out point or not. The method according to claim 5, characterized in that

7. Performing the feature extraction on the aforementioned real-time system event and obtaining the aforementioned target feature information is, The method involves obtaining first-type attribute information and second-type attribute information in the data of the aforementioned real-time system event, wherein the first-type attribute information is attribute information having a fixed amount of information and a fixed mode, and the second-type attribute information is attribute information whose amount of information or mode is not fixed. The process involves performing a conversion on the aforementioned second type attribute information to obtain derived attribute information, This includes merging the first type attribute information and the derived attribute information to obtain the target feature information, The method according to claim 1, characterized in that

8. An identification unit that performs event identification on a real-time system event of a target container by calling an event identification model corresponding to the target container, wherein the event identification model is a model constructed based on the historical normal system events of the target container, and is used to identify whether or not the real-time system event in the target container belongs to a normal system event. If the real-time system event is determined not to be a normal system event, an intrusion detection unit calls a pre-configured intrusion detection rule to perform intrusion detection on the real-time system event and determines whether or not the real-time system event is an intrusion event. An intrusion detection device for a container environment, comprising: The intrusion detection device for the container environment further comprises a feature extraction unit for extracting features from the real-time system events and obtaining target feature information. Specifically, the identification unit is used to call an event identification model corresponding to the target container, determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and perform event identification on the real-time system event based on the determination result. An intrusion detection device for a container environment, characterized by the following features.

9. An electronic device comprising at least one processor and memory, The aforementioned memory stores computer execution instructions, The at least one processor causes the at least one processor to perform the method according to any one of claims 1 to 7 by executing computer execution instructions stored in the memory. An electronic device characterized by the following features.

10. A computer-readable storage medium in which computer execution instructions are stored, characterized in that when a processor executes the computer execution instructions, the method according to any one of claims 1 to 7 is realized.

11. A computer program that includes a computer execution instruction, wherein when a processor executes the computer execution instruction, it realizes the method according to any one of claims 1 to 7.

Images