Threat Scanning Transplanted Containers via Container Map
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As container-based applications become more popular, there is a growing need for effective threat scanning solutions that can identify and remediate security threats within containerized environments, which are complex due to their self-contained nature and shared resource isolation.
Innovation Solution
A threat scanning service that takes snapshots of storage volumes, reconstructs the container hierarchy, and uses container metadata to map threats to specific resources, enabling precise identification and mitigation of compromised resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional threat scanning methods are used on containerized environments, then security threats can be detected, but the complexity of identifying and remediating threats increases due to the self-contained nature and shared resource isolation of containers
Solution Approach 1:
The patent segments the container environment into discrete, mappable components by creating a container map that associates file system paths with specific container identities, layers, and metadata. This segmentation allows threats to be precisely localized to individual containers rather than treating the entire shared environment as a monolithic system, thereby reducing remediation complexity while maintaining detection accuracy
Solution Approach 2:
The patent introduces a container map as an intermediary data structure that bridges the gap between the scanned file system and the containerized application layer. This intermediary translates file system paths into container-specific context, enabling accurate threat identification and streamlined remediation by providing a clear mapping between physical storage locations and logical container boundaries
2Measurement precision
If detailed scanning of containerized environments is performed to identify threats, then security accuracy improves, but the time and resources required for scanning increase
Solution Approach 1:
The patent performs preliminary action by pre-generating and storing container maps that document the relationship between file system paths and container metadata before threat scanning occurs. This pre-established mapping structure allows the scanning process to quickly reference known container boundaries and associations, eliminating the need for complex real-time analysis during scanning and thereby reducing scanning time while maintaining high identification precision
Solution Approach 2:
The patent creates a virtual copy of the container environment's structural metadata (the container map) that mirrors the actual file system layout without duplicating the entire data set. This lightweight copy provides all necessary contextual information for precise threat identification while requiring minimal scanning resources and time, as it contains only the relational structure rather than full content
Data Source
AI summary
Techniques for threat scanning transplanted containers are described. A method of threat scanning transplanted containers may include generating a container map of running containers on a block storage volume mounted to a scanning instance of a threat scanning service, scanning the block storage volume by a scanning engine of the scanning instance, identifying at least one threat on the block storage volume, and identifying at least one container associated with the at least one threat using the container map.