Container safety detection method based on machine learning

Abstract

The invention discloses a container security detection method based on machine learning. The method comprises the following steps: collecting local mirror image information and running container information through a script; scanning mirror image vulnerability information through a tool Anchore; evaluating the vulnerability severity score by using CVSS; realizing the mirror image security evaluation according to all vulnerability scoring results of the mirror image; collecting system calls generated by the container in operation through a tool Strace; generating a system call mapping file in combination with the system call table; characterizing the system call mapping file in combination with a sliding window method; calculating a TF-IDF value of each word in the feature file by using an optimized machine learning method TF-IDF; performing training or detecting by using the features; and updating local data, so the intrusion detection rate is improved. Vulnerability detection and evaluation of the container mirror image and intrusion detection of the container in operation are fused, and safety detection of the container in the whole life cycle from mirror image downloading to operation ending is achieved.

Description

technical field [0001] The invention relates to a container security detection method based on machine learning, which is mainly used for the vulnerability detection and evaluation of the Docker image and the intrusion detection of the running Docker container, and provides security detection for the Docker container from the image pulling to the end of the container operation, Belongs to container technology. Background technique [0002] Container technology is a type of lightweight virtualization technology that provides a lightweight virtual environment by grouping and isolating a set of processes and resources (such as memory, CPU, disk, etc.) from the host and any other containers. environment. Docker technology is a leader in container technology. Its appearance effectively solves the problems of application operating environment and configuration, and lays a solid foundation for continuous integration and continuous deployment. While container technology provides u...

AI Technical Summary

Problems solved by technology

In the process of using containers, users usually choose to download images directly from the warehouse, and rarely check the downloaded images, which allows malicious users to attack user containers and hosts by uploading vulnerable images

In addition, the Docker official did not perform correct verification on the pulled image, so that some data may be replaced during the image transmission process, that is, there is a possibility of man-in-the-middle attack

Images