TWI827203B - Verification system and verification method for malicious file of container - Google Patents

Abstract

A verification system and a verification method for malicious file of a container are provided. The verification method includes: obtaining an operating parameter from a container operating interface of the container and copying the container operating interface to generate a container transcribed interface; accessing, by the container transcribed interface, a container file system to operate according to the container file system and the operating parameter, so as to generate an output parameter; and determining whether an abnormal event has occurred according to the output parameter and determining that the contained includes a malicious file and prohibiting an operating of the container in response to determining the abnormal event being occurred.

Description

Verification system and verification method for malicious files in containers

The present invention relates to a verification system and verification method for malicious files in a container.

A container (such as a Docker container) contains an application and the environment required to execute the application (such as a program library or configuration file, etc.). Containers have the advantage of high portability and can be deployed to any hardware device for execution. When the container contains malicious files, executing the container may cause the container to be damaged. Therefore, how to determine whether a container contains malicious files that can cause anomalies is one of the important topics in this field.

The present invention provides a verification system and verification method for malicious files in a container, which can verify whether the container contains malicious files.

The present invention provides a verification system for malicious files in containers, including a storage medium and a processor. Storage media stores multiple modules. The processor is coupled to the storage medium and the transceiver, and accesses and executes a plurality of modules, wherein the plurality of modules include container transcription Management interface, container transcription interface and container operation analysis interface. The container transcription management interface obtains operating parameters from the container's container runtime interface, and copies the container runtime interface to generate a container transcription interface. The container transcription interface accesses the container's container file system to operate according to the container file system and operating parameters, thereby generating output parameters. The container running analysis interface determines whether an abnormal event occurs based on the output parameters, and in response to determining that an abnormal event occurs, determines that the container contains a malicious file and prohibits the container from running.

In one embodiment of the present invention, the above container operation analysis interface instructs the container to run in response to determining that no abnormal event has occurred.

In an embodiment of the present invention, the above-mentioned plurality of modules further include a container file feature database and a container file analysis interface. The container file characteristics database stores file characteristics corresponding to files in the container file system. The container file analysis interface reads the header of the file to determine whether the header matches the file characteristics, and in response to determining that the header matches the file characteristics, instructs the container transcription management interface to generate a container transcription interface.

In an embodiment of the present invention, the above-mentioned container file analysis interface obtains operating parameters from the container transcription management interface, wherein the container file analysis interface determines whether the operating parameters match the file characteristics, and indicates in response to determining that the operating parameters match the file characteristics. The container transcription management interface generates a container transcription interface.

In an embodiment of the present invention, the above-mentioned output parameters include container status information, central processing unit usage information, and memory usage information.

In an embodiment of the present invention, the above-mentioned central processing unit usage information includes the current central processing unit usage, wherein the container operation analysis interface is based on the content. The server status information determines whether the container transcription interface stops running, and in response to determining that the container transcription interface stops running and the current central processing unit usage is not zero, it is determined that an abnormal event occurs.

In one embodiment of the present invention, the above memory usage information includes the current memory usage, wherein the container operation analysis interface determines whether the container transcription interface stops running based on the container status information, and in response to determining that the container transcription interface stops running and The current memory usage is not zero and an abnormal event occurs.

In one embodiment of the present invention, the above-mentioned central processing unit usage information includes multiple central processing unit usages, wherein the container operation analysis interface determines in response to one of the multiple central processing unit usages exceeding the usage limit. An unusual event occurs.

In one embodiment of the present invention, the above memory usage information includes multiple memory usages, wherein the container operation analysis interface determines that an abnormal event occurs in response to one of the multiple memory usages exceeding the usage limit. .

In an embodiment of the present invention, the above-mentioned operating parameters include at least one of the following: container identification code, container instruction, container status, central processing unit usage, and memory usage.

The present invention provides a method for verifying malicious files in a container, which includes: obtaining operating parameters from the container's container running interface, and copying the container running interface to generate a container transcription interface; and using the container transcription interface to access the container file system of the container to generate the container file according to the container's file system. run the system and operating parameters to generate output parameters; and determine whether an abnormal event occurs based on the output parameters, and respond to determining that an abnormal event occurs Determine that the container contains malicious files and prohibit the container from running.

Based on the above, the present invention discloses a verification system and verification method for malicious files in a container. Before the container executes the file in the container file system, the file can be analyzed based on the operating parameters of the file and the file characteristics recorded in the container file feature database. . If the file and file characteristics match, the present invention can first transcribe the corresponding container execution environment to isolate the transcribed container execution environment from the original container environment, and then execute the transcribed container. The present invention can determine whether the container contains malicious files based on the execution result of the transcribed container, thereby deciding to allow or prohibit the container from running. In this way, it is possible to prevent the container containing malicious files from being executed and causing the container to be damaged.

10: Verification system

100: Container file analysis interface

11: Processor

110:Container portability executable header analysis

12:Storage media

120: Container parameter analysis interface

13:Transceiver

200:Container transcription management interface

21:Container running interface

22: Container file system

300:Container transcription interface

310:Container running transcription interface

400: Container operation analysis interface

410: Container status analysis interface

420: Container information synthesis interface

500: Container profile feature database

S610, S620, S630: steps

FIG. 1 is a schematic diagram of a verification system for malicious files in a container according to an embodiment of the present invention.

Figure 2 is a schematic diagram of a verification system and a container to be executed according to an embodiment of the present invention.

FIG. 3 is a detailed schematic diagram of a container file analysis interface according to an embodiment of the present invention.

Figure 4 is a detailed schematic diagram of a container transcription interface according to an embodiment of the present invention.

Figure 5 is a detailed schematic diagram of a container operation analysis interface according to an embodiment of the present invention.

FIG. 6 illustrates a flow chart of a method for verifying malicious files in a container according to an embodiment of the present invention.

FIG. 1 is a schematic diagram of a verification system 10 for malicious files in a container according to an embodiment of the present invention. The authentication system 10 may include a processor 11 , a storage medium 12 and a transceiver 13 .

The processor 11 is, for example, a central processing unit (CPU), or other programmable general-purpose or special-purpose micro control unit (MCU), microprocessor, or digital signal processing unit. Digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processing unit (GPU), image signal processor (ISP) ), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), field programmable gate array (field programmable gate array) , FPGA) or other similar components or a combination of the above components. The processor 11 can be coupled to the storage medium 12 and the transceiver 13, and access and execute multiple modules and various applications stored in the storage medium 12.

The storage medium 12 is, for example, any type of fixed or removable random access memory (RAM) or read-only memory. memory (ROM), flash memory (flash memory), hard disk drive (HDD), solid state drive (SSD) or similar components or a combination of the above components, and used for storage can be used by the processor 11 Execution of multiple modules or various applications. In this embodiment, the storage medium 12 can store multiple modules including the container file analysis interface 100, the container transcription management interface 200, the container transcription interface 300, the container operation analysis interface 400, and the container file feature database 500. Their functions will be Explained later.

The transceiver 13 transmits and receives signals in a wireless or wired manner. Transceiver 13 may also perform, for example, low noise amplification, impedance matching, mixing, up or down frequency conversion, filtering, amplification, and similar operations.

FIG. 2 is a schematic diagram of the verification system 10 and the container to be executed according to an embodiment of the present invention. The verification system 10 can access or execute the container running interface 21 and the container file system 22 of the container through the transceiver 13 to run the container. The container execution interface 21 or the container file system 22 may be installed on the storage medium 12 or may be installed on an external electronic device. The container running interface 21 is, for example, an application programming interface (API). The verification system 10 can interact with the container through the container runtime interface 21 . Container file system 22 may contain one or more files required to run the container. The container file system 22 may include data such as binary execution files (binaries) or function libraries (libraries). The container file analysis interface 100 can be communicatively connected to the container file system 22 to access or execute the container file system 22 . The container transcription management interface 200 or the container operation analysis interface 400 can be communicatively connected to the container operation interface 21 to access or execute the container operation interface 21 .

FIG. 3 shows a detailed schematic diagram of the container file analysis interface 100 according to an embodiment of the present invention. The container file analysis interface 100 may include a container portability executable header analysis 110 and a container parameter analysis interface 120. The container file analysis interface 100 can obtain the files required to run the container from the container file system 22 through the container portability executable header analysis 110 . Container portable executable header analysis 110 may read the header of the archive, where the header is, for example, a portable executable (PE) header. The container parameter analysis interface 120 may obtain the header from the container portability executable header analysis 110 . On the other hand, the container transcription management interface 200 can access the container running interface 21 to obtain the running parameters of the container from the container running interface 21 . The container parameter analysis interface 120 can obtain operating parameters from the container transcription management interface 200, where the operating parameters can include information such as container identification codes, container instructions, container status, central processing unit usage or memory usage. Running parameters can also be customized by the user.

The container parameter analysis interface 120 can perform feature comparison on the header or operating parameters of the file to determine whether the file is of an allowable type. Specifically, the container file feature database 500 can pre-store file features corresponding to the files in the container file system 22, where the file features can include but are not limited to the mapping relationship between the information in the header and the file extension, blacklist, whitelist, etc. list, limits on central processing unit usage or limits on memory usage, etc. The container parameter analysis interface 120 can determine whether the header or operating parameters of the file match the file characteristics of the container. If the header or operating parameters of the file match the file characteristics, the container parameter analysis interface 120 may determine that the file is allowed, and then instruct the container transcription management interface 200 to perform the container transcription operation. If the file If the header or running parameters do not match the file characteristics, the container parameter analysis interface 120 may determine that the file is not allowed, and then prohibit the container from running. This prevents containers containing malicious files or files that have been disabled by the system administrator from being executed.

For example, if the file running the container is "test.html", the container portability executable header analysis 110 can obtain "HTML document, UTF-8 Unicode text, with very long line", Header information such as "Container file system is Docker volume" and "Operating system is Linux". The container portability executable header analysis 110 can integrate header information and operating parameters and transmit them to the container parameter analysis interface 120 for feature comparison.

In one embodiment, if the mapping relationship between the file's file extension name and the header does not match the file characteristics, or the file name is not in the whitelist, it means that the file is a fake executable file. Accordingly, the container parameter analysis interface 120 can prohibit the container from running.

FIG. 4 shows a detailed schematic diagram of the container transcription interface 300 according to an embodiment of the present invention. After the container parameter analysis interface 120 determines that the file is allowed and instructs the container transcription management interface 200 to perform the transcription operation, the container transcription management interface 200 can copy the container running interface 21 and the container to generate the container transcription interface 300, where the container transcription interface 300 can It includes a container running transcription interface 310 generated by copying the container running interface 21 and a transcription container generated by copying the container. The container transcription interface 300 may be a container system such as Docker or Podman, and may support files in a variety of file systems, such as various Unix Like series file systems and Windows series file systems.

The container transcription interface 300 can access files in the container file system 22 by to run according to the container file system 22 and run parameters, thereby generating output parameters. Specifically, the container transcription management interface 200 can use the Docker inspect technology to share files in the container file system 22 to the container transcription interface 300, thereby triggering the container transcription interface 300 to run. The container transcription interface 300 can run the transcription container according to the operating parameters and the corresponding files to generate output parameters from the transcription container, where the output parameters can include information such as container status information, central processing unit usage information, or memory usage information. The container transcription interface 300 may transmit the output parameters to the container run analysis interface 400.

For example, the container transcription interface 300 may access the container file system 22 and may access the file "text.html" in the container file system 22 and instruct the transcription container execution file "text.html" to generate output parameters. After the file "text.html" is executed, the container transcription management interface 200 can reset the container transcription interface 300 to release the resources used by the container transcription interface 300 (for example, central processing unit resources or memory resources). The container transcription management interface 200 can obtain the output parameters generated by the container transcription interface 300, and transmit the output parameters and operating parameters of the container to the container operation analysis interface 400.

FIG. 5 shows a detailed schematic diagram of the container operation analysis interface 400 according to an embodiment of the present invention. The container operation analysis interface 400 may include a container status analysis interface 410 and a container information synthesis interface 420. After obtaining the output parameters from the container transcription interface 300, the container status analysis interface 410 of the container operation analysis interface 400 can determine whether an abnormal event occurs based on the output parameters. If the container status analysis interface 410 If it is determined that an abnormal event occurs, the container status analysis interface 410 may determine that the original container or the container file system 22 contains a malicious file. Accordingly, the container status analysis interface 410 can output an instruction through the transceiver 13 to disable the container from running. On the other hand, if the container status analysis interface 410 determines that no abnormal event occurs, the container status analysis interface 410 may determine that the original container or the container file system 22 does not contain malicious files. Accordingly, the container status analysis interface 410 can output instructions through the transceiver 13 to instruct the container to run.

In one embodiment, the CPU usage information of the output parameter may include the current CPU usage. The container status analysis interface 410 can determine whether the container transcription interface 300 (or the transcription container) stops running based on the container status information of the output parameters. If the container status analysis interface 410 determines that the container transcription interface 300 has stopped running and the current CPU usage is not zero, it means that the operation of the transcription container includes suspicious computing resource usage. Accordingly, the container status analysis interface 410 can determine that an abnormal event occurs.

In one embodiment, the memory usage information of the output parameter may include the current memory usage. The container status analysis interface 410 can determine whether the container transcription interface 300 (or the transcription container) stops running based on the container status information of the output parameters. If the container status analysis interface 410 determines that the container transcription interface 300 has stopped running and the current memory usage is not zero, it means that the operation of the transcription container includes suspicious memory resource usage. Accordingly, the container status analysis interface 410 can determine that an abnormal event occurs.

In one embodiment, the CPU usage information of the output parameter may include multiple CPU usages. The container status analysis interface 410 can determine multiple Whether any of the pen central processing unit usage exceeds the central processing unit usage limit. If any one of the multiple central processing unit usages exceeds the usage limit, the container status analysis interface 410 may determine that an abnormal event occurs.

In one embodiment, the memory usage information of the output parameter may include multiple memory usages. The container status analysis interface 410 can determine whether any of the multiple memory usages exceeds the memory usage limit. If any one of the multiple memory usages exceeds the usage limit, the container status analysis interface 410 may determine that an abnormal event occurs.

In one embodiment, after the container status analysis interface 410 determines that no abnormal event has occurred and instructs the container to run, the container information synthesis interface 420 can access the container file system 22 to obtain files used to run the container, obtained from the container execution interface 21 Run parameters, or obtain output parameters from the container transcription interface 300. The container information synthesis interface 420 can compare whether information such as the header, operating parameters or output parameters of the file matches the file characteristics stored in the container file characteristic database 500 . If the above information matches the file characteristics, the container information synthesis interface 420 can output instructions through the transceiver 13 to instruct the container to run. If the above information does not match the file characteristics, the container information synthesis interface 420 can output an instruction through the transceiver 13 to prohibit the container from running.

FIG. 6 illustrates a flow chart of a method for verifying malicious files in a container according to an embodiment of the present invention, wherein the verification method can be implemented by the verification system 10 shown in FIG. 1 . In step S610, running parameters are obtained from the container running interface, and the container running interface is copied to generate a container transcription interface. In step S620, the container transcription interface accesses the container file system of the container to obtain the container file system according to the container file system and Run parameters are run, resulting in output parameters. In step S630, it is determined whether an abnormal event occurs according to the output parameters, and in response to determining that the abnormal event occurs, it is determined that the container contains a malicious file and the container is prohibited from running.

To sum up, the verification system and verification method of malicious files in containers of the present invention have the following characteristics and effects: the verification system of the present invention can be deployed on the client or server in the enterprise to pre-judge the container file system for the enterprise. Whether the files inside are safe and secure ensures the reliability of the operation of the container system to be protected; the container file analysis interface of the present invention can identify the file type in the container file system, so as to determine what kind of application the file is opened and where it needs to be executed. On various container systems and operating systems, it assists in container transcription operations; the container transcription management interface of the present invention can manage the containers of files that the user wants to execute. The container transcription management interface can automatically transcribe the corresponding container according to the container environment in which the file is executed. In addition, the container transcription management interface also transmits container information and files to other interfaces and ensures that the transcribed container execution process does not affect the original container; the container transcription interface of the present invention can be a container system such as Docker and Podman to support files in a variety of file systems , such as: various Unix Like series file systems and Windows series file systems; the container operation analysis interface of the present invention can analyze the execution status of the original container and the transcribed container, integrate various types of information and cooperate with the container file feature database to determine the transcribed container Whether an exception occurs.

S610, S620, S630: steps

Claims (10)

A verification system for malicious files in software containers, including: a transceiver; a storage medium that stores a plurality of modules; and a processor that couples the storage medium and the transceiver, and accesses and executes the plurality of modules. A group, wherein the plurality of modules include: a container transcription management interface, which obtains operating parameters from a container runtime interface of a software container, and copies the container runtime interface to generate a container transcription interface; the container transcription interface, accesses the The container file system of the software container is operated according to the container file system and the operation parameters, thereby generating output parameters; and a container operation analysis interface is used to determine whether an abnormal event occurs according to the output parameters, and in response to determining that the abnormal event occurs And it is determined that the software container includes the malicious file and the operation of the software container is prohibited, and in response to determining that the abnormal event does not occur, instructing the software container to start to start running. The verification system of claim 1, wherein the plurality of modules further includes: a container file feature database that stores file features corresponding to files in the container file system; and a container file analysis interface that reads all the header of the file to determine whether the header matches the file characteristics, and in response to determining whether the header matches the file characteristics Character matching instructs the container transcription management interface to generate the container transcription interface. The verification system of claim 2, wherein the container file analysis interface obtains the operating parameters from the container transcription management interface, and the container file analysis interface determines whether the operating parameters match the file characteristics, and in response to determining that the operating parameters match the file characteristics, instructing the container transcription management interface to generate the container transcription interface. The verification system of claim 1, wherein the output parameters include container status information, central processing unit usage information, and memory usage information. The verification system of claim 4, wherein the central processing unit usage information includes the current central processing unit usage, and the container operation analysis interface determines whether the container transcription interface stops running based on the container status information, And in response to determining that the container transcription interface stops running and that the current central processing unit usage is not zero, it is determined that the abnormal event occurs. The verification system of claim 4, wherein the memory usage information includes current memory usage, and the container operation analysis interface determines whether the container transcription interface stops running based on the container status information, and responds The abnormal event occurs when it is determined that the container transcription interface stops running and the current memory usage is not zero. The verification system of claim 4, wherein the central processing unit usage information includes a plurality of central processing unit usages, and the container running analysis interface responds to one of the plurality of central processing unit usages. The abnormal event is judged to have occurred when the usage limit is exceeded. The verification system of claim 4, wherein the memory usage information includes a plurality of memory usages, and the container running analysis interface responds to one of the plurality of memory usages exceeding the usage rate. Limit and determine that the abnormal event occurs. The verification system of claim 1, wherein the operating parameters include at least one of the following: container identification code, container instruction, container status, central processing unit usage, and memory usage. A method for verifying malicious files of software containers, suitable for verification systems, including: the verification system obtains operating parameters from the container running interface of the software container, and copies the container running interface to generate a container transcription interface; from the verification system The system accesses the container file system of the software container through the container transcription interface to run according to the container file system and the operating parameters, thereby generating output parameters; and the verification system determines whether an occurrence occurs based on the output parameters. An abnormal event, in response to determining that the abnormal event occurs, determining that the software container includes the malicious file and prohibiting the software container from running, and in response to determining that the abnormal event does not occur, instructing the software container to start to start running. .

Images