Container Attack Detection Using Network-Process Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing WebRCE intrusion detection methods in containers suffer from single-dimensional detection, leading to high false alarm rates and vulnerability to bypassing, particularly for unknown vulnerabilities like 0-Day attacks.
Innovation Solution
A combined analysis method that integrates network access requests and process execution events within containers, using trained models to detect abnormal patterns in both dimensions, enhancing detection accuracy and adaptability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If single-dimensional detection is used for WebRCE attacks, then detection simplicity is maintained, but detection accuracy and reliability deteriorate due to high false alarm rates and vulnerability to bypassing
Solution Approach 1:
The patent combines network access request detection with container process execution event detection into a unified multi-dimensional detection system. The network detection module monitors HTTP requests for WebRCE attack patterns, while the process detection module simultaneously monitors process execution events, and both detection results are correlated to improve overall detection accuracy and reduce false alarms.
Solution Approach 2:
The patent transitions from single-dimensional network request detection to multi-dimensional detection by adding the process execution event dimension. This allows the system to correlate network layer anomalies with process layer anomalies, creating a more comprehensive detection capability that can identify WebRCE attacks more accurately while maintaining system manageability.
2Reliability
If multi-dimensional combined analysis is implemented, then detection accuracy and reliability improve, but system complexity increases
Solution Approach 1:
The patent divides the detection system into distinct functional modules: a network detection module for analyzing access requests, a process detection module for monitoring process execution events, and a correlation analysis module for integrating results. This segmentation allows each module to specialize in specific detection tasks, improving reliability through focused functionality while managing overall system complexity through modular design.
Solution Approach 2:
The detection system is designed to handle multiple detection dimensions (network requests and process events) within a unified framework. The correlation analysis module serves multiple functions by integrating results from different detection modules, enabling the system to maintain high reliability across various attack scenarios without proportionally increasing complexity.
3Measurement precision
If multiple detection dimensions are integrated, then false alarm rates are reduced, but data processing complexity increases
Solution Approach 1:
The patent introduces a correlation analysis module that acts as an intermediary between network detection and process detection. This module receives detection results from both dimensions, performs correlation analysis to identify true attacks versus false alarms, and generates unified detection results. The intermediary approach simplifies the integration process and reduces the overall difficulty of processing multi-dimensional data.
Solution Approach 2:
The system implements feedback mechanisms where detection results from one dimension inform the analysis in another dimension. The correlation analysis module uses feedback from both network and process detection to continuously refine its analysis, reducing false alarms while managing data processing complexity through iterative improvement rather than complex one-time processing.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
An attack detection method for a container and an electronic device are provided. The attack detection of the combined analysis of the terminal and the network is realized, and the intrusion attack of the container is analyzed based on multiple dimensions to improve the detection rate and accuracy of the attack. The attack detection method includes: acquiring, from a network side, a network access request for a service of a first container load, and acquiring, from a device terminal where the first container is located, a process execution event in the first container; determining an abnormal access request in the network access request and an abnormal process event in the process execution event; and determining, based on the abnormal access request and the abnormal process event, an attack detection result.