Container Image Allow Lists Using Deployment Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge lies in detecting and preventing malicious or anomalous deployment configurations of container images in container orchestration services, particularly from untrusted public registries, which can compromise system security by allowing unauthorized access to sensitive data.
Innovation Solution
A computing system utilizes machine-learning models trained on historical deployment configurations to detect anomalous container image configurations, generating an allow list of trusted images and triggering security alerts or aborting deployments as needed, while minimizing computational burden.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If container images are deployed from public registries to enable broader usage of open-source tools, then adaptability and ease of operation are improved, but system security and reliability deteriorate due to potential malicious images
Solution Approach 1:
The system performs preliminary anomaly detection on container images before deployment by analyzing deployment configurations against trained machine learning models. This advance detection identifies potentially malicious images before they can compromise the system, allowing safe deployment from public registries while maintaining security.
Solution Approach 2:
The patent introduces an intermediary anomaly detection system that sits between the public registry and the container deployment. This intermediary layer analyzes deployment configurations and provides security verification without blocking legitimate open-source tool usage, thus mediating between adaptability and security requirements.
2Reliability
If comprehensive anomaly detection is performed on all container images to improve security, then reliability is improved, but computational burden and processing time increase
Solution Approach 1:
The system applies partial action by focusing anomaly detection on specific deployment configurations and features rather than analyzing every aspect of each container image exhaustively. The machine learning models are trained to identify key anomaly indicators, providing sufficient security detection while reducing unnecessary computational overhead.
Solution Approach 2:
The patent transforms the security detection problem by changing parameters from exhaustive image analysis to configuration-based feature extraction. By converting deployment configurations into structured features and using trained models to evaluate these features, the system achieves high detection accuracy with reduced computational burden compared to analyzing entire container images.
3Reliability
If real-time anomaly detection is implemented to improve security response, then reliability is improved, but device complexity and processing requirements increase
Solution Approach 1:
The detection system is segmented into distinct functional components: feature extraction from deployment configurations, trained machine learning models for anomaly classification, and decision-making logic for allowing or blocking deployments. This segmentation enables real-time detection by distributing computational tasks across specialized modules, reducing overall system complexity while maintaining real-time capability.
Data Source
AI summary
A computing system is configured for detecting anomalies in deployment configurations of container images at a container network. One or more datasets associated with deployment configurations of a container imager are collected, and a plurality of features are extracted based on the one or more datasets for an ID of the container image. A probability score is then generated based on the plurality of features, using a machine-learning model trained on datasets associated with historical deployment configurations of the container image that have been performed via the container orchestration service. The probability score indicates a probability of whether the deployment configurations of the container image are anomalous or not anomalous when compared historical deployment configurations of the container image. An allow list is generated that includes container images and their respective IDs that have a majority of their deployment configurations that are not anomalous.