Container Runtime Analysis Using Event-Driven Reference Pictures

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for identifying vulnerabilities in container instances are either limited to periodic scans of container images, which miss runtime changes, or require privileged instances that lack timing control, leading to inefficiencies in vulnerability detection.

Innovation Solution

An automated method and system for analyzing running container instances by capturing an initial reference picture, transmitting data to an external test system upon event occurrence, and producing an updated reference picture for analysis, allowing event-based scanning without privileged instances.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If periodic scans of container images are performed, then vulnerabilities can be identified at regular intervals, but runtime changes in container instances are not detected

Engineering Contradiction:

Improvevulnerability detection completenessVSAvoidruntime change information

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The system transitions from static periodic scanning to dynamic event-driven scanning. A monitoring unit continuously monitors container instances and triggers scans only when specific events occur (file system changes, network connections, process creation), ensuring runtime changes are captured without requiring continuous periodic scanning of all containers.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system creates a reference picture (baseline state) of the container instance before operations occur. This reference picture is prepared in advance and used for comparison during event-triggered scans, enabling efficient detection of changes without re-scanning the entire container state periodically.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If privileged container instances are used to examine other container instances, then vulnerability scanning can be performed on running containers, but resource consumption increases and timing control is lost

Engineering Contradiction:

Improveruntime vulnerability detectionVSAvoidscanning efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The monitoring unit is integrated within the container runtime environment itself, allowing it to monitor container instances without requiring external privileged containers. The system uses the runtime environment's own capabilities to detect events and trigger scans, eliminating the overhead of privileged container infrastructure.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system implements event-driven feedback loops where the monitoring unit detects specific events (file changes, network connections, process creation) and automatically triggers vulnerability scans. This feedback mechanism ensures scans occur at optimal times based on actual container state changes rather than fixed schedules or privileged container availability.

Inventive Principle:

Principle #23Feedback

3Loss of energy

If container images are scanned only when new container instances are restarted, then scanning resources are conserved, but vulnerabilities introduced during runtime operations remain undetected

Engineering Contradiction:

Improvescanning resource consumptionVSAvoidvulnerability detection timeliness

Core Design Contradiction:

Loss of energyVSReliability

Solution Approach 1:

The system dynamically adjusts scanning frequency based on container activity. Instead of fixed periodic scanning or scanning only at restart, the monitoring unit continuously watches for events and triggers scans only when relevant changes occur, optimizing the balance between resource consumption and detection timeliness.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system replaces mechanical periodic scanning with event-driven scanning triggered by monitoring the container instance's operational state. The monitoring unit detects events such as file system changes, network connections, and process creation, substituting rigid timing mechanisms with responsive event-based triggers that adapt to actual container behavior.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12488114B2Analysis of a container instance of an operating system

Publication Date: 2025.12.02 SIEMENS AG

AI summary

Various embodiments include an automated method for analyzing a container instance running on a host system in a runtime environment. The method may include: capturing an initial reference picture including a reproduction of the container instance; transferring the picture to a test system; capturing data when triggered by an event relating to an operation on the container instance; transmitting the data to the test system; producing an updated reference picture of the container instance by adjusting the initial reference picture for effects that the operations have on the container instance, the effects expected effects that the operations cause as expected; and analyzing the updated reference picture using the test system.