Container Escape Detection via System Call Sequence Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container security technologies can only prevent container escapes before a container runs and are ineffective in detecting or preventing escape events that occur after the container is already running, resulting in weak prevention measures.
Innovation Solution
A container escape detection method and system that uses a monitoring component and an escape detection component to identify potential container escapes by matching the occurrence order of system calls with preset system call orders, determining the similarity between the actual and predicted system call orders, and assessing the presence of high-risk system capabilities to detect malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the host machine determines whether the container has sensitive system permissions before the container runs, then the container escape prevention is improved, but the detection capability for escape events occurring after the container runs deteriorates
Solution Approach 1:
The patent pre-generates escape detection rules based on historical container escape data and system call patterns before runtime. These rules include sequences of system calls that are characteristic of escape attempts, allowing the system to be prepared with detection capabilities in advance without interfering with normal container operation
Solution Approach 2:
The patent implements a feedback mechanism where the container monitoring component continuously collects system call information from running containers and feeds it to the escape detection component. The escape detection component compares actual system call sequences against the pre-generated escape detection rules, and when matches are found, triggers alerts or responses to prevent the escape
2Reliability
If the host machine rejects running of the container when sensitive system permissions are detected, then the container escape prevention is improved, but the adaptability of the system deteriorates
Solution Approach 1:
Instead of completely rejecting containers with sensitive permissions, the patent applies partial action by selectively monitoring only specific system call sequences that are indicative of escape attempts. This allows legitimate containers with sensitive permissions to run while still providing detection for malicious behavior patterns
Solution Approach 2:
The patent applies different levels of scrutiny to different system calls and permission types. Rather than treating all containers with sensitive permissions uniformly, the escape detection rules are tailored to specific permission types and system call patterns, allowing the system to adapt its response based on the local context of each container and its operations
Data Source
AI summary
A container escape detection method includes receiving information that is about a plurality of system calls triggered by a monitored container, and matching an occurrence order of the plurality of system calls with at least one group of preset system call orders in an escape detection rule, and determining, based on a matching result, whether the monitored container escapes.