Container Intrusion Detection Using Event Filtering and Rule Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection methods for container environments suffer from increased memory and CPU occupancy rates as the detection rule set grows, leading to reduced performance and efficiency, while existing optimizations introduce new issues such as mis-determinations and resource pressure.
Innovation Solution
Construct an event recognition model based on historical normal system events of a target container to filter out normal system events, and apply intrusion detection only to suspicious events, using a dual-engine model to enhance accuracy and reduce resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a detection rule set is used for intrusion detection, then detection capability is provided, but memory and CPU occupancy rates increase linearly with the size of the detection rule set
Solution Approach 1:
The patent segments the intrusion detection process into two distinct stages: a machine learning-based anomaly detection stage that filters out normal events, and a traditional rule-based detection stage that analyzes suspicious events. This segmentation allows the system to use lightweight rules for initial screening while reserving heavy computational resources for only the necessary anomaly analysis, thereby reducing overall resource consumption while maintaining detection capability.
Solution Approach 2:
The patent applies preliminary action by using machine learning models to pre-filter and identify normal system events before they reach the traditional intrusion detection rule set. This preliminary filtering action reduces the volume of events that require expensive rule-based analysis, thereby lowering CPU and memory occupancy rates while maintaining comprehensive detection coverage.
2Reliability
If the detection rule set is increased to improve detection coverage, then more intrusions can be detected, but intrusion detection performance and efficiency are reduced
Solution Approach 1:
The patent divides the detection workload into two segments: a high-efficiency machine learning-based filtering segment that handles the bulk of normal event identification, and a targeted rule-based detection segment that focuses only on suspicious events. This segmentation maintains comprehensive detection coverage while significantly improving overall efficiency by avoiding unnecessary rule evaluations on normal events.
Solution Approach 2:
The patent introduces machine learning models as an intermediary between event collection and traditional intrusion detection rules. This intermediary component filters and prioritizes events, allowing the rule-based system to focus only on the most suspicious events. The intermediary thus bridges the gap between comprehensive coverage and detection efficiency by intelligently routing events to the appropriate detection mechanism.
Data Source
AI summary
A method, a device and a storage medium for detecting intrusion of a container environment. The method includes: performing event recognition on a real-time system event by calling an event recognition model corresponding to the target container, where the event recognition model is constructed based on a historical normal system event of the target container; in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, to determine whether the real-time system event is an intrusion event. Thus, a real-time system event that belongs to a normal system event may be filtered out, and a complete intrusion detection may be performed on the abnormal system event, thereby reducing the amount of data for intrusion detection, reducing resource occupation, and improving the performance and efficiency of the intrusion detection.