The invention discloses an automatic detection method and
system for a cross-
domain interface of a confidential container, which belong to the field of
network security, and are used for uniformly modeling interface interaction behaviors among a
host machine, a confidential
virtual machine and a container during operation on the basis of cross-
domain interface calling involved in the operation process of the confidential container. According to the method, a complete interface calling association relationship is constructed by analyzing calling
semantics, a sequential relationship and a dependency relationship of a cross-
domain interface, so that a representative
system behavior path can be extracted from a complex cross-domain interaction process; the problems that in existing confidential container cross-domain interface detection, the detection
granularity is too coarse, the interface calling relation is not clear, and
attack behaviors are difficult to restore are solved. Meanwhile, automatic detection of the cross-domain interface is performed based on interface behavior
feature modeling and abnormal mode recognition, effective detection of the abnormal calling behavior of the cross-domain interface of the confidential container is realized on the premise of not depending on priori knowledge of
attack behaviors, and relatively high detection accuracy and efficiency are taken into account.