Container Image Process Profiling for Runtime Security Enforcement

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security solutions are inadequate for detecting vulnerabilities in software container images, as they cannot process the specific structure of container images and cannot predict how they will behave during execution, leaving them vulnerable to malicious code and exploitation.

Innovation Solution

Generate a security profile for container images through static analysis, including lists of allowed system calls, network actions, filesystem actions, and signatures of executable files, and monitor runtime execution to enforce these profiles and detect violations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing security solutions are used to scan container images, then general malware detection is provided, but they cannot process the specific structure of container images and cannot predict runtime behavior

Engineering Contradiction:

Improvesecurity detection capabilityVSAvoidability to handle container image structure

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs static analysis of container images before runtime to generate security profiles that predict runtime behavior. This preliminary action creates a baseline of expected system calls, spawned processes, and other behaviors that can be monitored during execution, enabling detection of malicious activities that deviate from the profile.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The security profile is divided into multiple segments including system call profiles, spawned process profiles, network connection profiles, and filesystem operation profiles. Each segment independently analyzes specific aspects of container behavior, allowing comprehensive security monitoring while maintaining manageability and precision in detecting violations.

Inventive Principle:

Principle #1Segmentation

2Ease of operation

If container images are allowed to execute without restrictions, then operational flexibility is maintained, but malicious code can execute and exploit vulnerabilities

Engineering Contradiction:

Improvecontainer execution freedomVSAvoidmalicious code execution risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system continuously monitors runtime container execution against the pre-generated security profile and provides feedback when violations are detected. This feedback mechanism allows the system to maintain operational flexibility by permitting authorized actions while automatically blocking or alerting on malicious activities that deviate from the expected behavior profile.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The security profile pre-identifies authorized system calls, processes, and operations before container execution. By establishing this whitelist of permitted actions in advance, the system prevents malicious code execution through a default-deny approach where only pre-approved actions are allowed, effectively countering potential attacks before they can succeed.

Inventive Principle:

Principle #9Preliminary anti-action

3Reliability

If comprehensive security monitoring is implemented at runtime, then malicious activity detection is improved, but system performance and execution speed are reduced

Engineering Contradiction:

Improvemalicious activity detectionVSAvoidcontainer execution speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The security profile is generated through static analysis before container execution, creating a comprehensive baseline of expected behaviors in advance. This preliminary action shifts much of the security analysis work to pre-execution, reducing the runtime overhead to primarily comparison and violation detection operations rather than full analysis.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system focuses runtime monitoring on specific critical aspects such as system call validation, spawned process verification, and network connection monitoring based on the security profile. Rather than monitoring every possible operation, the system concentrates resources on the most security-critical behaviors, achieving effective detection with reduced performance impact.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12475234B2Profiling of spawned processes in container images and enforcing security policies respective thereof

Publication Date: 2025.11.18 PALO ALTO NETWORKS INC

AI summary

Execution of software containers is secured using security profiles. A security profile is generated for a container image, wherein the container image includes resources utilized to execute a corresponding application container, wherein the generated security profile includes at least a spawned processes profile, wherein the spawned processes profile includes, for each spawned process executed at runtime by the application container, a signature of an executable file of the spawned process. The operation of a runtime execution of the application container is monitored. A violation of the spawned processes profile is detected based on the monitored operation.