Container-based security event processing method and device and storage medium

Abstract

The invention provides a security event processing method and device based on a container and a storage medium, and relates to the technical field of computers, and the method comprises the steps: calculating a security coefficient of a container security event based on a container security factor; wherein the container security factors comprise a sensitive degree value of an accessed object of the container, an accessed frequency value of the container and a state change amplitude value of the container; sorting the container security events based on the security coefficients; and performing event type matching on the container security events according to the sorting result, and performing security scanning. According to the method, the device and the storage medium disclosed by the invention, the safety factor can be calculated in combination with a plurality of safety factors and weights of the container, and reasonable judgment is performed according to actual influence on the container, so that a container safety event processing mechanism can be optimized; the risk exposure time can be reduced, and the false alarm rate is effectively reduced.

Description

Technical field [0001] The present disclosure relates to the field of computer technology, in particular to a container-based secure event processing method, apparatus and storage medium. Background [0002] MeC (Multi-access Edge Computing, multi-access edge computing) platform through network capabilities open, the intensive computing power sinks to the edge node closer to the user side, MEC applications can call in real time to access network information, to provide users with high-speed, low-latency quality services. Since the MEC platform and application are deployed in containers, container security protection has become one of the key technologies to ensure the safe and reliable operation of the MEC platform and applications. At present, the container security protection system is based on firewall, intrusion detection and prevention, host monitoring and honeypot load to enable security event listening, and generate container security events by triggering the decision rule...

AI Technical Summary

Problems solved by technology

The existing container security protection system only considers the characteristics of the matching decision rule base, and does not consider the actual impact on the container, resulting in a high false positive rate. Once a large number of container security incidents break out, the processing efficiency of security incidents will be seriously affected.

Images