WO2019174048A1 - 容器逃逸检测方法、装置、系统及存储介质 - Google Patents

容器逃逸检测方法、装置、系统及存储介质 Download PDF

Info

Publication number
WO2019174048A1
WO2019174048A1 PCT/CN2018/079338 CN2018079338W WO2019174048A1 WO 2019174048 A1 WO2019174048 A1 WO 2019174048A1 CN 2018079338 W CN2018079338 W CN 2018079338W WO 2019174048 A1 WO2019174048 A1 WO 2019174048A1
Authority
WO
WIPO (PCT)
Prior art keywords
container
target
information
system call
escape
Prior art date
Application number
PCT/CN2018/079338
Other languages
English (en)
French (fr)
Inventor
张煜
匡大虎
俞岳
陈宇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2018/079338 priority Critical patent/WO2019174048A1/zh
Priority to EP18909785.0A priority patent/EP3761198B1/en
Priority to PCT/CN2018/102667 priority patent/WO2019174193A1/zh
Priority to CN201880091015.XA priority patent/CN111819556B/zh
Publication of WO2019174048A1 publication Critical patent/WO2019174048A1/zh
Priority to US17/021,428 priority patent/US11989283B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45545—Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45591—Monitoring or debugging support

Definitions

  • the present application relates to the field of container safety, and in particular, to a container escape detection method, device, system and storage medium.
  • Cloud Computing (English: Cloud Computing) is a computing model that provides dynamic and scalable virtualized resources through a network in a service manner.
  • Platform as a Service (English: Platform) is a cloud computing A major mode.
  • the cloud computing platform can allocate a host cluster to each user, and the host cluster can include at least one host, wherein the host can be a physical machine or a virtual machine.
  • Users can create and run containers based on container images in the host of the assigned host cluster.
  • Each container has a separate process run space. Ideally, processes in the container can only run in the process of the container. Run in space. However, when there is a malicious process in the container, the malicious process is likely to leave the container's process running space and then attack the host or other container. This phenomenon is called container escaping.
  • the host machine in order to prevent the container from escaping, before the container runs, the host machine can determine whether the container has some sensitive system rights (for example, the sensitive system authority can be dac_override_capability system authority), and the container determines the container at the host machine. With sensitive system permissions, the host can deny the container's operation, thereby preventing malicious processes in the container from attacking the host or other container based on the sensitive system permissions.
  • the sensitive system authority can be dac_override_capability system authority
  • the related technology can only passively prevent the escape of the container before the container is operated, and the container escape event that occurs after the container is run cannot be detected and prevented. Therefore, the prevention of the escape of the container is low.
  • the present application provides a container escape detection method, device, system and storage medium, which can improve the prevention of container escape.
  • a container escape detection method for use in an escape detection assembly of a container escape detection system, the container escape detection system comprising the escape detection assembly and at least one container monitoring assembly, each of the container monitoring The component is for monitoring a host in a target host cluster for which container evasion detection is to be performed, the method comprising:
  • the target container monitoring component Receiving, by the target container monitoring component, a plurality of system call information, where the system call information is sent by the target container monitoring component after detecting that the first process in the first container uses a system call in the first host
  • the system call information carries an identifier of a system call used by the first process
  • the target container monitoring component is any one of the at least one container monitoring component
  • the first host is a a host monitored by the target container monitoring component, the first container being a container deployed in the first host;
  • target order information is used to indicate an order in which the first process uses a plurality of system calls in the first host
  • the preset system call sequence is in the container when the container escapes.
  • the malicious process uses the order of multiple system calls in the host.
  • the malicious process in the container will continuously try to obtain the handle of the host file through brute force. After obtaining the handle of the host file, the malicious process can tamper with the sensitive file in the host.
  • the malicious process In order to complete the container escape attack, in the process of violently cracking the host file handle, the malicious process often needs to use the system call in the host in a certain order (English: system call). Therefore, the escape detection component can determine the possibility of the container escaping in the first container according to the degree of similarity between the order of the plurality of system calls in the first host and the preset system call sequence according to the first process in the first container.
  • the default system call sequence is that when a container escapes, the malicious process in the container uses the order of multiple system calls in the host, which enables the escape detection component to detect the container escape event that occurs after the container is run, thereby improving It is the defense against the escape of the container.
  • the determining, according to the degree of similarity between the sequence indicated by the target sequence information and the preset system call sequence, determining a possibility that the first container is escaping from the container includes:
  • the target state machine including an initial state, a final state, and a state transition condition required to be transferred from the initial state to the final state, the state transition condition being an order indicated by the input sequence information
  • the target state machine including an initial state, a final state, and a state transition condition required to be transferred from the initial state to the final state, the state transition condition being an order indicated by the input sequence information
  • the target state machine transitions from the initial state to the final state, it is determined that the first container has escaped from the container.
  • the acquiring the target state machine includes:
  • state machine database Querying a state machine database according to the process identifier of the first process, where the state machine database stores a correspondence between at least one set of state machines and process identifiers;
  • the state machine database stores a state machine corresponding to the process identifier of the first process
  • the state machine is acquired as the target state machine.
  • the acquiring the target state machine further includes:
  • the state machine When the state machine corresponding to the process identifier of the first process is not stored in the state machine database, the state machine is created according to the preset system call sequence;
  • the created state machine is obtained as the target state machine.
  • the determining, according to the degree of similarity between the sequence indicated by the target sequence information and the preset system call sequence, determining a possibility that the first container is escaping from the container includes:
  • the target container monitoring device Receiving, by the target container monitoring device, a startup parameter of the first container, where the startup parameter includes at least one permission information, where the permission information is used to indicate a system authority owned by the first container;
  • the determining according to the similarity between the starting parameter and the order indicated by the target sequence information and the preset system calling sequence, determining a possibility that the first container is escaping from the container, including:
  • the escape detecting component may determine, according to the degree of similarity between the system authority owned by the first container and the order indicated by the target sequence information and the preset system calling order, the possibility that the container escapes in the first container. Sex.
  • the determining, according to the degree of similarity between the at least one target rights information and the order indicated by the target order information and the preset system call sequence, determining a possibility that the first container is escaping from a container include:
  • Obtaining a target decision tree comprising at least one branch, each of the branches comprising an ordered plurality of nodes, each of the plurality of nodes corresponding to a likelihood identifier, the likelihood identifier Means for indicating the possibility of container escaping, the plurality of nodes comprising a system privilege node and an ordered plurality of system call nodes connected to the system privilege node, the system privilege node corresponding to a system privilege, each The system call node corresponds to a system call, and the sequence of the multiple system calls corresponding to the multiple system call nodes is the same as the preset system call sequence;
  • the at least one target branch is in one-to-one correspondence with the at least one target authority information, and each of the target branches includes a system authority node corresponding to the system authority and the The system authority indicated by the target permission information corresponding to the target branch is the same;
  • n is a positive integer greater than or equal to 1;
  • the method further includes:
  • the sensitive file tampering information is that the target container monitoring component monitors at least a second process preset in the first container to the first host Sending any sensitive file in a sensitive file after a write operation; determining that the container escapes in the first container based on the sensitive file tampering information.
  • the malicious process in the container tampers with the sensitive files in the host during the container escape attack. Therefore, when the escape detection component receives the sensitive file tampering information sent by the target container monitoring component, the escape detection component can determine the first container. A container escape has occurred.
  • the method before receiving the sensitive file tampering information sent by the target container monitoring component, the method further includes:
  • the sensitive file configuration information including an identifier of the at least one sensitive file
  • the sensitive file configuration information being used by the target container monitoring component to configure information according to the sensitive file Determining the at least one sensitive file.
  • the method further includes:
  • the process whitelist includes process identifiers of multiple legal processes; and based on the illegal process operation information, it is determined that the first container may have escaped from the container.
  • the target container monitoring component may send illegal process running information to the escape detection component.
  • the escape detecting component may determine that an illegal process exists in the first container. Because the illegal process is likely to be a malicious process, the escape detecting component may determine the first time after receiving the illegal process running information.
  • a container may have escaped from a container.
  • the container escaping detection system further includes: a client, the method further includes: before receiving the illegal process running information sent by the target container monitoring component, the method further includes:
  • the process whitelist is sent to the target container monitoring component.
  • the escaping detection component is disposed in a second host in the target host cluster, and the computing capability of the second host is greater than the target host cluster except the second host At least one host machine.
  • the escape detection component is disposed in a container of the second host deployment.
  • the container escape detection system includes a cluster of escape detection components, the escape detection component cluster includes a plurality of the escape detection components, and the escape detection component cluster is deployed in a trusted area in the firewall.
  • the target container monitoring component is disposed in a container of the first host deployment.
  • a container escape detection method for use in a target container monitoring assembly of a container escape detection system, the container escape detection system comprising an escape detection assembly and at least one container monitoring assembly, each of the container monitoring assemblies Monitoring for a host in a target host cluster for vessel evasion detection, the target container monitoring component being any one of the at least one container monitoring component, the method comprising:
  • the first host is a host monitored by the target container monitoring component, and the first container is a container deployed in the first host;
  • the multiple system call information is used by the escape detection component to acquire target sequence information according to the multiple system call information, and according to the target sequence information a degree of similarity between the indicated sequence and the preset system call sequence, determining a likelihood that the first container is escaping from the container, the target sequence information being used to indicate that the first process uses the first host.
  • the method further includes:
  • the escape detection component Sending, to the escape detection component, a startup parameter of the first container, where the startup parameter includes at least one permission information, each of the permission information is used to indicate a system authority owned by the first container, and the startup parameter And determining, by the escape detecting component, a possibility that the first container is escaping from the container according to the degree of similarity between the starting parameter and the order indicated by the target sequence information and the preset system calling sequence.
  • the method further includes:
  • the sensitive file tampering information is used by the escape detecting component to determine that a container escape occurs in the first container based on the sensitive file tampering information, the first container being a container deployed in the first host.
  • the method before the sending the sensitive file tampering information to the escaping detection component, the method further includes:
  • the method further includes:
  • the process whitelist After detecting that the process identifier of the third process running in the first container does not belong to the process identifier included in the process whitelist, sending illegal process running information to the escape detecting component, where the illegal process running information is used for the escape.
  • the detecting component determines, according to the illegal process running information, that the first container may have a container escaping, the process whitelist includes process identifiers of multiple legal processes, and the first container is deployed in the first host a container.
  • the container escape detection system further includes: a client, where the method further includes: before the sending the illegal process running information to the escape detection component, the method further includes:
  • the process whitelist is generated by the escape detection component according to the edited correspondence.
  • the escaping detection component is disposed in a second host in the target host cluster, and the computing capability of the second host is greater than the target host cluster except the second host At least one host machine.
  • the escape detection component is disposed in a container of the second host deployment.
  • the container escape detection system includes a cluster of escape detection components, the escape detection component cluster includes a plurality of the escape detection components, and the escape detection component cluster is deployed in a trusted area in the firewall.
  • the target container monitoring component is disposed in a container of the first host deployment.
  • a container escape detection apparatus comprising at least one module for implementing the container escape detection method provided by any of the above first aspect or the first aspect.
  • a container escape detection apparatus comprising at least one module for implementing the container escape detection method provided by any of the above second aspect or the second aspect.
  • a container escape detecting device comprising: a processor and a memory;
  • the processor is configured to execute instructions stored in the memory, the processor implementing the container escape detection method provided by any of the above first aspect or the first aspect by executing the instructions.
  • a container escape detecting apparatus comprising: a processor and a memory;
  • the processor is configured to execute instructions stored in the memory, the processor implementing the container escape detection method provided by any of the alternatives of the second aspect or the second aspect by executing the instructions.
  • a computer readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the first aspect or the first aspect.
  • a computer program product comprising instructions for causing a computer to perform a container escape detection method in any one of the first aspect or the first aspect of the first aspect, when the computer program product is run on a computer Or, causing the computer to perform the container escape detection method in any of the possible implementations of the second aspect or the second aspect above.
  • a container escape detection system comprising the container escape detection device of any of the above aspects, and the container escape detection device of any of the above fourth aspects.
  • the default system call sequence is that when a container escapes, the malicious process in the container uses the order of multiple system calls in the host, so that the escape detection component can detect the container escape event that occurs after the container runs, thereby improving the container. Efforts to escape.
  • FIG. 1A is a schematic diagram of a path of a container escape attack provided by an embodiment of the present application.
  • FIG. 1B is a schematic diagram of an implementation environment provided by an embodiment of the present application.
  • FIG. 1C is a schematic diagram of another implementation environment provided by an embodiment of the present application.
  • FIG. 2A is a flow chart of a container escape detection method provided by an embodiment of the present application.
  • 2B is a schematic diagram of a target state machine provided by an embodiment of the present application.
  • 2C is a schematic diagram of another target state machine provided by an embodiment of the present application.
  • 2D is a schematic diagram of a target decision tree provided by an embodiment of the present application.
  • FIG. 3 is a block diagram of a container escape detecting apparatus according to an embodiment of the present application.
  • FIG. 4 is a block diagram of a container escape detecting apparatus provided by an embodiment of the present application.
  • FIG. 5 is a block diagram of a container escape detecting apparatus according to an embodiment of the present application.
  • FIG. 6 is a block diagram of a container escape detecting apparatus according to an embodiment of the present application.
  • FIG. 7 is a block diagram of a container escape detecting apparatus according to an embodiment of the present application.
  • FIG. 8 is a block diagram of a container escape detection system according to an embodiment of the present application.
  • Cloud Computing (English: Cloud Computing) is a computing model that provides dynamic and scalable virtualized resources through a network in a service manner.
  • Platform as a Service (English: Platform) is a cloud computing A major mode.
  • the cloud computing platform can allocate a host cluster to the host, and the host cluster can include at least one host (English: Host).
  • the host machine is a concept relative to the container (English: container), the so-called host refers to the device that deploys the container.
  • the host machine can be a physical machine (such as a server, etc.) or a virtual machine. .
  • Users in the PaaS mode can deploy containers on the host in the cluster of hosts assigned to them by the cloud computing platform to perform corresponding operations using the deployed containers.
  • the user can download the container image from the mirrored software repository of the cloud computing platform and create a container in the host based on the downloaded container image.
  • the container image can include at least one readable and non-writable file layer.
  • the host can create a readable and writable file layer on the container image and create a separate process running space.
  • the process in the process can run in the process run space, the running process can read the file in the at least one readable and writable file layer, and can also write the file in the readable and writable file layer operating.
  • the cloud computing platform can allow ordinary users to upload container images to the mirrored software repository. Therefore, the security of the container image in the mirrored software warehouse is difficult to guarantee, which makes the container created based on the container image in the mirrored software warehouse very There may be a malicious process that is likely to leave the container's process running space and then attack the container's host or other container. This phenomenon is often referred to as container escaping.
  • container escaping generally has the following attack paths:
  • the first, malicious process in the container attacks the container daemon (English: docker daemon).
  • the malicious process a in the container A deployed in the host machine 1 can attack the container A. After the container A is compromised, the malicious process a can be separated from the process running space of the container A. And attack the container daemon S1.
  • the malicious process c in the container C deployed in the host machine 2 can attack the container C.
  • the malicious process c can leave the process running space of the container C.
  • the container daemon S2 After the container daemon S2 is compromised, the malicious process c can attack the container D deployed in the host 2.
  • the third type the malicious process in the container attacks the operating system of the host (English: Operating System; OS for short).
  • the malicious process d in the container D deployed in the host machine 2 can attack the container D.
  • the malicious process d can be separated from the process running space of the container D. And using the container shared library to attack the operating system OS2 of the host 2.
  • the fourth, malicious process in the container attacks other containers through the host's operating system.
  • the malicious process a in the container A deployed in the host machine 1 can attack the container A.
  • the malicious process a can be separated from the process running space of the container A. And uploading the virus to the shared storage volume of the operating system OS1 of the host 1, and the process b in the container B deployed in the host 1 reads and executes the virus uploaded by the malicious process a in the shared storage volume. Poisoned.
  • the malicious process b in the container B deployed in the host machine 1 can attack the container B.
  • the malicious process b can leave the process running space of the container B.
  • the host machine can determine whether the container has some sensitive system rights.
  • the host machine can determine that the container has It is possible that the container escapes, so the host can deny the operation of the container, thereby preventing the container from escaping.
  • the above related technology can only passively prevent the escape of the container before the container is operated, and the container escape event occurring after the operation of the container cannot be detected and prevented, and therefore, the prevention of escape of the container is low.
  • the embodiment of the present application provides a container escape detection method, which can detect a container escape event that occurs after the container is operated, thereby improving the strength of preventing the container from escaping.
  • FIG. 1B is a schematic diagram of an implementation environment involved in a container escape detection method according to an embodiment of the present application.
  • the implementation environment may include at least one container monitoring component 11 (only FIG. 1B shows 3).
  • a container monitoring component 11 an escape detection component 12, a service component 13, a storage component 14, and a client 15.
  • each host n in the host cluster Q may be provided with a container monitoring component 11 , optionally
  • the container monitoring component 11 in a host may be disposed in a container of the host deployment.
  • the container monitoring component 11 disposed in a host machine can monitor the container deployed in the host machine and send the monitoring result to the escape detecting component 12.
  • the escape detection component 12 can be disposed on one of the hosts in the host cluster Q. Alternatively, the escape detection component 12 can be disposed in a container of the host deployment. It should be noted that the escaping detection component 12 can be generally disposed in a host computer with strong computing power in the host cluster Q. In actual implementation, the escaping detection component 12 can be set in the host cluster Q with the strongest computing power. In a host machine.
  • the escape detecting component 12 can receive the monitoring result sent by each container monitoring component 11 set in the host cluster Q, and can determine, according to the received monitoring result, the possibility that the container in each host in the host cluster Q escapes from the container.
  • the escape detection component 12 can also send a container escape event report to the service component 13, which can include the likelihood that the container in one host in the host cluster Q will escape.
  • the service component 13 and the storage component 14 may be disposed in a trusted area G within the firewall, the service component 13 may receive a container escape event report sent by the escape detection component 12, and the service component 13 may store the received container escape event report in the In storage component 14.
  • the client 15 can be a web client or an application client, and the client 15 can send a query request to the service component 13 under the trigger of the user A to query the container escape event report of the host cluster Q, and the service component 13 can After receiving the query request sent by the client 15, the container escape event report of the host cluster Q is obtained from the storage component 14, and the container escape event report is sent to the client 15.
  • FIG. 1C is a schematic diagram of another implementation environment involved in the container escape detection method according to an embodiment of the present application.
  • the implementation environment may include at least one container monitoring component 21, an escape detection component 22, and a service component. 23.
  • the container monitoring component 21, the service component 23, the storage component 24, and the client terminal 25 are deployed in the same manner as the container monitoring component 11, the service component 13, the storage component 14, and the client 15 shown in FIG. 1B, respectively, and the container The monitoring component 21, the service component 23, the storage component 24, and the client 25 are identical to the technical processes performed by the container monitoring component 11, the service component 13, the storage component 14, and the client 15, respectively, shown in FIG. 1B.
  • the escape detection component 22 in FIG. 1C is disposed in the trusted area G in the firewall, and the escape detection component 22 can receive multiple host clusters (only shown in FIG. 1C).
  • the monitoring results sent by the container monitoring component 21 in the two host clusters U and V) are generated, and the possibility of the container escaping of the host in the plurality of host clusters can be determined based on the received monitoring results.
  • multiple escape detection components 22 may be deployed (only shown in FIG. 1C). Two escape detection components 22), such that a failure of an escape detection component 22 does not affect the detection of container escape.
  • FIG. 2A is a flowchart of a container escape detection method according to an embodiment of the present application.
  • the container escape detection method can be applied to the implementation environment shown in FIG. 1B or FIG. 1C, as shown in FIG. 2A, the container escape detection method.
  • the steps can be included:
  • Step 201 After monitoring that the first process in the first container uses the system call in the first host, the target container monitoring component sends multiple system call information to the escape detection component.
  • the implementation environment involved in the container escape detection method provided by the embodiment of the present application may include at least one container monitoring component.
  • Each container monitoring component can be disposed on a host in the host cluster for monitoring the container in the host, and each container monitors the technical process performed by the component during container escape detection.
  • the container escaping detection method provided by the embodiment of the present application is described by taking only one container monitoring component (ie, the target container monitoring component) of the at least one container monitoring component as an example.
  • the first host may be a host in a host cluster to be tested for container escaping.
  • the first host may be a host in a host cluster allocated by the cloud computing platform to a certain user.
  • the host, the target container monitoring component is a container monitoring component disposed in the first host, the first container is a container deployed in the first host, and the first process is a process running in the first container.
  • the malicious process in the container will continue to obtain the handle of the host file through brute force cracking. After obtaining the handle of the host file, the malicious process can tamper with the sensitivity of the host. Files, thus completing the container escape attack, and in the process of violently cracking the host file handle, the malicious process often needs to use the system call in the host in a certain order (English: system call), for example, the malicious process can be in the following order Use the system calls in the host: open_by_handle_at, fstat, fcntl, getdents, and open_by_handle_at.
  • the container monitoring component needs to monitor the system call event in the container deployed in the host machine, and send the monitoring result to the escape detection component, so as to be determined by the escape detection component according to the monitoring result.
  • the possibility of the container escaping occurs in the container in the host.
  • the target container monitoring component may monitor a system call event in a container deployed in the first host, when it is detected that the first process in the first container uses a system call in the first host,
  • the target container monitoring component can generate a plurality of system call information and send the plurality of system call information to the escape detection component to determine, by the escape detection component, the possibility of the container escaping from the first container based on the plurality of system call information.
  • Each system call information may correspond to a system call in the first host used by the first process, and each system call information may include an identifier of the corresponding system call.
  • the auditing module can be used to monitor system call events in the container deployed in the first host.
  • the auditing module can be configured with multiple auditing rules, and each auditing rule can be a process in the container. Use the rules of a system call in the host.
  • the audit audit module may generate an audit report when the first process triggers the audit rule, that is, when the first process uses the system call in the first host, and send the audit report to the target container monitoring component, the target After receiving the audit report, the container monitoring component may generate system call information based on the audit report and send the system call information to the escape detection component.
  • Step 202 The escape detection component receives a plurality of system call information sent by the target container monitoring component, and acquires target sequence information according to the multiple system call information.
  • the target sequence information is used to indicate the order in which the first process uses multiple system calls in the first host.
  • each system call information may further carry a generation time, where the generation time is used to indicate a time when the target container monitoring component generates the system call information, and the escape detection component may carry according to each system call information.
  • the generation time acquires the sequence of the plurality of system calls corresponding to the plurality of system call information, and then the escape detection component may generate the target sequence information based on the sequence of the multiple system calls corresponding to the multiple system call information, wherein the multiple The order of the multiple system calls corresponding to the system call information is the order indicated by the target sequence information.
  • the escape detection component receives three system call information sent by the target container monitoring component, and the three system call information are system call information a, system call information b, and system call information c, respectively.
  • the system call information a corresponds to the system call p used by the first process
  • the generation time carried by the system call information a is 14:00
  • the system call information b corresponds to the system call q used by the first process
  • the generation time carried by b is 14:01
  • the system call information c corresponds to the system call k used by the first process
  • the generation time carried by the system call information c is 14:02.
  • the escape detection component can obtain the order of the three system calls corresponding to the three system call information according to the generation time carried by the three system call information, where the system calls p, the system call q, and the system call k, and then, The escape detection component may generate target order information according to the sequence, wherein the order indicated by the target order information is: system call p, system call q, and system call k.
  • the escape detection component may acquire the sequence of the multiple system calls corresponding to the multiple system call information according to the sequence of receiving the multiple system call information, and then the escape detection component may be based on the multiple The order of the plurality of system calls corresponding to the system call information generates target order information, wherein the order of the plurality of system calls corresponding to the plurality of system call information is the order indicated by the target order information.
  • the escape detection component receives three system call information sent by the target container monitoring component, and the three system call information are system call information a, system call information b, and system call information c, respectively.
  • the system call information a corresponds to the system call p used by the first process
  • the escape detection component receives the system call information a at 14:00
  • the system call information b corresponds to the system call q used by the first process
  • escapes receives the system call information b at 14:01
  • the system call information c corresponds to the system call k used by the first process
  • the escape detection component receives the system call information c at 14:02.
  • the escape detecting component can obtain the order of the three system calls corresponding to the three system call information according to the order of receiving the three system call information, where the system calls p, the system call q, and the system call k, and then, The escape detection component may generate target order information according to the sequence, wherein the order indicated by the target order information is: system call p, system call q, and system call k.
  • Step 203 The escape detection component determines, according to the degree of similarity between the order indicated by the target sequence information and the preset system call sequence, the possibility that the container escapes from the first container.
  • the preset system call sequence is the order in which the malicious process in the container uses multiple system calls in the host when the container escapes.
  • the preset system call sequence may be set by the technician in the order of using multiple system calls in the host according to the malicious process of the container in the known container escape event.
  • a more common container escape attack is a shocker attack, so the technician can set the preset system call order according to the order in which the malicious process uses the system call when the shocker attack occurs.
  • the escape detection component can use multiple system calls in the first host according to the first process.
  • the degree of similarity between the order (ie, the order indicated by the target order information) and the preset system call order determines the likelihood that the first container will escape from the container.
  • the higher the degree of similarity between the order indicated by the target order information and the preset system call order the higher the probability that the first container will escape from the container, the order indicated by the target order information and the preset system call.
  • the lower the degree of similarity between the sequences the lower the likelihood that the first container will escape from the container.
  • the embodiment of the present application provides two ways to determine the possibility of the container escaping in the first container according to the degree of similarity between the order indicated by the target sequence information and the preset system call sequence.
  • the first way the escape detection component determines the degree of similarity between the order indicated by the target order information and the preset system call order based on the state machine (English: Finite-state machine), and determines the first container occurrence container according to the similarity degree The possibility of escape.
  • the state machine is a mathematical model, which may include a limited number of states and state transition conditions that need to be met for the mutual transfer between the states.
  • the finite number of states may include an initial state and a final state, or the finite number of states may include an initial state, a final state, and at least one intermediate state, wherein the state machine may perform corresponding information output when transitioning to the final state.
  • the escape detection component may query the state machine database according to the identifier of the first process.
  • the escape detection component may obtain the state machine.
  • the escape detection component may create a state machine according to the preset system call sequence, and acquire the created state machine as the target state machine. .
  • the state machine database stores a correspondence between at least one set of state machines and a process identifier, where the target state machine includes an initial state, a final state, and a state transition condition that is required to be transferred from the initial state to the final state, the state transition The condition is that the order of the input order information is the same as the preset system call order.
  • the target state machine may include at least one intermediate state in addition to the initial state and the final state, and accordingly, in this case, the state transition condition may include a plurality of sub-conditions, wherein the plurality of sub-conditions The sub-conditions required for the initial state transition to the intermediate state adjacent to the initial state, the sub-conditions required for the adjacent two intermediate state transitions, and the intermediate state adjacent to the final state may be transferred to the The sub-conditions that the final state needs to satisfy.
  • the target state machine may include an initial state C, a final state Z, and a state transition condition T that is required to be transferred from the initial state C to the final state Z, which is the input sequence information.
  • the order indicated is the condition that the system calls a, b, c, d, e, and f
  • the preset system call order is the order in which the system calls a, b, c, d, e, and f.
  • the target state machine may include an initial state C, an intermediate state J1, an intermediate state J2, and a final state Z, and the target state machine may further include a requirement to be transferred from the initial state C to the intermediate state J1.
  • the sub-condition T3 is the condition that the last two system calls indicated by the input sequence information are e and f
  • the preset system call order is system call a, b, c, d, e, and The order of f.
  • the escape detection component may determine, based on the target state machine, a degree of similarity between the order indicated by the target order information and the preset system call sequence, and determine, according to the degree of similarity, that the first container has escaped from the container. possibility.
  • the escape detection component may input target sequence information to the target state machine, and when the target state machine is transferred from the initial state to the final state, indicating the order indicated by the target sequence information
  • the preset system call sequence is the same, therefore, the escape detection component can determine that the degree of similarity between the order indicated by the target order information and the preset system call order is 100%, in which case the escape detection component can determine the first container A container escape has occurred.
  • the escape detection component determines the possibility of the container escaping in the first container according to the degree of similarity between the system authority owned by the first container and the order indicated by the target sequence information and the preset system call sequence.
  • the escape detecting component may determine, according to the degree of similarity between the system authority owned by the first container and the order indicated by the target sequence information and the preset system calling order, the possibility that the container escapes in the first container. Sex. It should be pointed out that in Linux systems, system permissions can also be called capabilities (English: capability).
  • the target container monitoring component may obtain a startup parameter of the first container by using a docker socket interface, where the startup parameter is a parameter included in a docker run command used by the first host to create the first container, and the startup parameter may include At least one permission information, wherein each permission information is used to indicate a system authority owned by the first container.
  • the target container monitoring component may send the startup parameter of the first container to the escape detection component, so that the escape detection component acquires the system authority owned by the first container, and is indicated according to the system authority owned by the first container and the target sequence information. The degree of similarity between the order of the preset system calls and the order in which the first system is escaping is determined.
  • the escaping detection component may be configured with multiple privilege extraction plugins (English: plugin), each privilege extraction plugin may correspond to a target privilege information, and each privilege extraction plugin is used for starting parameters from the first container.
  • the at least one privilege information is extracted from the target privilege information corresponding to the privilege extraction plugin, wherein the system privilege indicated by each target privilege information is a system privilege owned by the container in which the container escaping occurs.
  • the escape detection component may determine, according to the degree of similarity between the at least one target authority information and the order indicated by the target sequence information and the preset system call sequence, determining that the first container may escape from the container Sex.
  • the escape detection component may acquire a target decision tree, and the target decision tree may include at least one branch, and each branch includes an ordered plurality of nodes.
  • Each of the plurality of nodes corresponds to a likelihood identifier that is used to indicate the likelihood of a container escaping.
  • the plurality of nodes include a system authority node and an ordered plurality of system call nodes connected to the system authority node, wherein the system authority node corresponds to a system authority, each system call node corresponds to one system call, and multiple systems The order of multiple system calls corresponding to the calling node is the same as the preset system call sequence.
  • the target decision tree may include two branches 1 and 2, wherein the branch 1 includes a root node g, a node a1, a node a2, a node a3, a node a4, a node a5, and a node a6, and the branch 2 includes Root node g, node b1, node b2, node b3, node b4, node b5, and node b6.
  • the node a1 is a system authority node, which corresponds to the system authority dac_override_capability, and the corresponding possibility identifier is 4, and the node a2 is a system call node, which corresponds to the system call open_by_handle_at, and the corresponding possibility identifier is 5, node a3 Calling the node for the system, which corresponds to the system call fstat, the corresponding possibility identifier is 5, the node a4 is the system call node, which corresponds to the system call fcntl, the corresponding possibility identifier is 6, and the node a5 is the system call node.
  • node a6 is a system call node, which corresponds to the system call open_by_handle_at, and its corresponding probability identifier is 8.
  • the node b1 is a system authority node, which corresponds to the system authority dac_read_search_capability, and the corresponding possibility identifier is 4
  • the node b2 is a system call node, which corresponds to the system call open_by_handle_at, and the corresponding possibility identifier is 5
  • the node b3 is the system.
  • the corresponding possibility identifier is 5
  • the node b4 is a system call node, which corresponds to the system call fcntl
  • the corresponding possibility identifier is 6
  • the node b5 is a system call node
  • the corresponding possibility identifier is 6
  • the node b6 is the system call node, which corresponds to the system call open_by_handle_at
  • the corresponding possibility identifier is 8.
  • the order of the preset system calls is: open_by_handle_at, fstat, fcntl, getdents, and open_by_handle_at.
  • the value range of the possibility identifier may be [0, 10], wherein the larger the value of the possibility identifier indicates the possibility of container escape. The higher the sex.
  • the escape detection component may determine at least one target branch from at least one branch included in the target decision tree, the at least one target branch and the escape detection component including at least one of the startup parameters of the first container
  • the at least one target authority information extracted in the authority information is in one-to-one correspondence, wherein the system authority corresponding to the system authority node included in each target branch is the same as the system authority indicated by the target authority information corresponding to the target branch.
  • the escape detection component may determine the branch 2 in FIG. 2D as the target branch.
  • the escape detection component can determine, based on the at least one target branch, a likelihood that the first container is escaping from the container.
  • the escape detection component can obtain the likelihood identifier corresponding to the nth system call node in the target branch, where n is a positive integer greater than or equal to 1. The escape detection component can then determine the likelihood of the container escaping from the first container based on the likelihood flag.
  • the order indicated by the target order information may be: open_by_handle_at, fstat, fcntl, and open_by_handle_at, the order of the three system calls corresponding to the first three system call nodes in the first three system calls (open_by_handle_at, fstat) Consistent with fcntl), the escape detection component can obtain the possibility identifier 6 corresponding to the third system call node in the branch 2, and the escape detection component can determine, according to the possibility identifier, the possibility that the container escapes in the first container.
  • the escape detecting component may further determine, according to other information reported by the target container monitoring component, that the first container may escape from the container.
  • the target container monitoring component may report the sensitive file tampering information to the escape detecting component, and the escape detecting component may determine, according to the sensitive file tampering information, the possibility that the first container may escape from the container.
  • the escaping detection component may send the sensitive file configuration information to the target container monitoring component, wherein the sensitive file configuration information may include an identifier of the at least one sensitive file preset in the first host.
  • the target container monitoring component may determine at least one sensitive file preset in the first host according to the sensitive file configuration information, and perform monitoring of the writing operation on the at least one sensitive file.
  • the target container monitoring component can send sensitive file tamper information to the escape detection component.
  • the target container monitoring component can monitor the write operation of the at least one sensitive file preset in the first host machine based on the observer watcher in the inotify module.
  • the malicious process in the container tampers with the sensitive file in the host when performing the container escape attack. Therefore, when the escape detection component receives the sensitive file tampering information sent by the target container monitoring component, the escape detection component can It is determined that the container escapes in the first container.
  • the sensitive file configuration information may further include an identifier of the at least one sensitive file preset in the first container, and the target container monitoring component may determine at least one sensitive file preset in the first container according to the sensitive file configuration information. And monitoring the write operation of at least one sensitive file in the first container.
  • the target container monitoring component may also send sensitive file tampering information to the escape detection component after detecting that the second process in the first container writes to any of the at least one sensitive file in the first container. In this case, after the escape detection component receives the sensitive file tampering information, it may be determined that there may be a malicious process in the first container. Therefore, the escape detection component may determine that the container may escape in the first container.
  • the target container monitoring component may send illegal process running information to the escape detecting component, and the escape detecting component may determine, according to the illegal process running information, a possibility that the first container is escaping from the container.
  • the target container monitoring component may send, to the escape detection component, a correspondence between the container image of the first host and the process, and the escape detection component may send the correspondence to the client, so that the client displays the correspondence to the user.
  • the user can edit the correspondence. For example, the user can add some processes to the correspondence or delete some processes.
  • the client may send the user-edited correspondence to the escaping detection component.
  • the escaping component may generate a process whitelist based on the process included in the correspondence, and the process whitelist may include multiple legal processes. Process ID.
  • the escape detection component can send the process whitelist to the target container monitoring component.
  • the target container monitoring component can monitor the process running in the first container, and when the target container monitoring component monitors the third process running in the first container (the third process may be the first process, or may be the first process After the process identifier of the different process does not belong to the process identifier included in the process whitelist, the target container monitoring component may send illegal process running information to the escape detection component. After receiving the illegal process running information, the escape detecting component may determine that an illegal process exists in the first container. Because the illegal process is likely to be a malicious process, the escape detecting component may determine the first time after receiving the illegal process running information. A container may have escaped from a container.
  • the target container monitoring component can monitor the processes running in the first container by using the cAdvisor module.
  • Step 204 The escape detection component generates and sends a container escape event report to the service component after determining that the first container has a possibility of container escaping.
  • the container escape event report can include the likelihood that the first container in the first host will escape from the container.
  • the service component may store the received container escape event report in the storage component.
  • the client may send a query request to the service component under the trigger of the user to query the container escape event report of the first container, and the service component may obtain the container of the first container from the storage component after receiving the query request sent by the client. Escape event report and send the container escape event report to the client.
  • the container escape detection method uses the escape detection component to use the sequence of multiple system calls in the first host according to the first process in the first container and the preset system call sequence.
  • the degree of similarity determines the possibility of the container escaping in the first container, wherein the preset system call sequence is when the container escapes, the malicious process in the container uses the order of multiple system calls in the host, so that the escape detection component can The container escape event that occurs after the container is run is detected, thereby increasing the defense against the escape of the container.
  • FIG. 3 is a block diagram of a container escape detecting apparatus 300 provided by an embodiment of the present application.
  • the container escape detecting apparatus 300 can be applied to the escape detecting component shown in FIG. 1B or FIG. 1C.
  • the container escape detecting apparatus 300 may include a first receiving module 301, an obtaining module 302, and a first determining module 303.
  • the first receiving module 301 is configured to receive, by the target container monitoring component, a plurality of system call information, where each system call information is that the target container monitoring component monitors the first process in the first container to use the first host After the system call is sent, the system call information carries an identifier of a system call used by the first process, and the target container monitoring component is any one of the at least one container monitoring component, the first host is the The host monitored by the target container monitoring component, the first container being a container deployed in the first host.
  • the obtaining module 302 is configured to obtain target order information according to the multiple system call information, where the target order information is used to indicate that the first process uses an order of multiple system calls in the first host.
  • the first determining module 303 is configured to determine, according to the degree of similarity between the order indicated by the target sequence information and the preset system calling sequence, the possibility that the first container is escaping from the container, and the preset system calling sequence is a generating container When escaping, the malicious process in the container uses the order of multiple system calls in the host.
  • the first determining module 303 includes:
  • Obtaining a sub-module configured to acquire a target state machine, where the target state machine includes an initial state, a final state, and a state transition condition required to be transferred from the initial state to the final state, the state transition condition being indicated by the input sequence information The order of the same order as the preset system call;
  • An input submodule configured to input the target sequence information to the target state machine when the target state machine is in the initial state
  • the first determining submodule is configured to determine that the container escapes in the first container when the target state machine is transferred from the initial state to the final state.
  • the first determining module 303 includes:
  • a receiving submodule configured to receive a startup parameter of the first container sent by the target container monitoring device, where the startup parameter includes at least one permission information, where each permission information is used to indicate a system authority owned by the first container;
  • a second determining submodule configured to determine, according to the startup parameter and the degree of similarity between the sequence indicated by the target sequence information and the preset system call sequence, the possibility that the first container is escaping from the container.
  • the second determining submodule is configured to:
  • the second determining submodule is configured to:
  • the target decision tree comprising at least one branch, each branch comprising an ordered plurality of nodes, each of the plurality of nodes corresponding to a likelihood identifier, the possibility identifier being used to indicate that a container is generated
  • the plurality of nodes includes a system privilege node and an ordered plurality of system call nodes connected to the system privilege node, the system privilege node corresponding to a system privilege, and each system call node corresponding to a system call
  • the sequence of the multiple system calls corresponding to the multiple system call nodes is the same as the preset system call sequence;
  • the at least one target branch is in one-to-one correspondence with the at least one target authority information, and the system authority corresponding to the system authority node included in each target branch and the target authority corresponding to the target branch
  • the system permissions indicated by the information are the same;
  • the first n system calls in the plurality of system calls indicated by the target sequence information and the n n system call nodes corresponding to the plurality of system call nodes included in the target branch When the order of the system calls is the same, the probability identifier corresponding to the nth system call node in the target branch is obtained, where n is a positive integer greater than or equal to 1;
  • the embodiment of the present application further provides another container escape detecting device 400.
  • the container escape detecting device 400 may further include a second receiving module 304 in addition to the modules included in the container escape detecting device 300.
  • the second receiving module 304 is configured to receive sensitive file tampering information sent by the target container monitoring component, where the sensitive file tampering information is that the target container monitoring component monitors the second process in the first container to the first host Any one of the at least one sensitive file preset in the file is sent after the write operation.
  • the second determining module 305 is configured to determine that the container escapes in the first container based on the sensitive file tampering information.
  • the third receiving module 306 is configured to receive the illegal process running information sent by the target container monitoring component, where the target process monitoring component detects that the process identifier of the third process running in the first container does not belong to
  • the process whitelist is sent after the process ID is included.
  • the process whitelist includes the process IDs of multiple legal processes.
  • the third determining module 307 is configured to determine, according to the illegal process running information, that the first container may have escaped from the container.
  • the container escape detecting apparatus uses the degree of similarity between the order of multiple system calls in the first host and the preset system calling order according to the first process in the first container. Determining the possibility of the container escaping in the first container, wherein the preset system call sequence is when the container escapes, the malicious process in the container uses the order of multiple system calls in the host, so that the container can be generated after the container is run The escape event is detected and raised to prevent the escape of the container.
  • FIG. 5 is a block diagram of a container escape detecting device 500 provided by an embodiment of the present application.
  • the container escape detecting device 500 can be applied to the container monitoring assembly shown in FIG. 1B or FIG. 1C.
  • the container escape detecting apparatus 500 may include a generating module 501 and a first transmitting module 502.
  • the generating module 501 is configured to generate, after the first process in the first container uses the system call in the first host, multiple system call information, where each system call information carries a system call used by the first process
  • the identifier is that the first host is a host monitored by the target container monitoring component, and the first container is a container deployed in the first host.
  • the first sending module 502 is configured to send the multiple system call information to the escape detection component, where the multiple system call information is used by the escape detection component to acquire target sequence information according to the multiple system call information, and according to the target Determining the degree of similarity between the order indicated by the sequence information and the preset system call sequence, determining the possibility of the container escaping from the first container, the target order information being used to indicate that the first process uses the first host.
  • the order of the system calls which is the order in which the malicious processes in the container use the multiple system calls in the host when the container escapes.
  • the embodiment of the present application further provides another container escape detecting device 600.
  • the container escape detecting device 600 may further include a second sending module 503 in addition to the modules included in the container escape detecting device 500.
  • a second sending module 503 configured to send, to the escape detection component, a startup parameter of the first container, where the startup parameter includes at least one permission information, where each permission information is used to indicate a system permission owned by the first container, and the startup The parameter is configured to determine, by the escape detection component, a likelihood that the first container is escaping from the container according to the degree of similarity between the startup parameter and the order indicated by the target sequence information and the preset system call sequence.
  • the third sending module 504 is configured to: after detecting that the second process in the first container performs a write operation on any one of the at least one sensitive file preset in the first host, to the escape detecting component Sending sensitive file tampering information for the escape detecting component to determine that the container has escaped from the first container based on the sensitive file tampering information.
  • the fourth sending module 505 is configured to: after detecting that the process identifier of the third process running in the first container does not belong to the process identifier included in the process whitelist, send the illegal process running information to the escape detecting component, where the illegal process runs.
  • the information is used by the escape detection component to determine that a container escape may occur in the first container based on the illegal process operation information, and the process whitelist includes process identifiers of multiple legal processes.
  • the container escape detecting apparatus sends the system call information to the escape detecting component by using the system call in the first host machine by the first process in the first container, so that the escape detecting component is configured according to
  • the first process in the first container determines the possibility of the container escaping in the first container by using the degree of similarity between the order of the multiple system calls in the first host and the preset system call order, wherein the preset system call
  • the malicious process in the container uses the order of multiple system calls in the host machine, so that the container escape event occurring after the container is run can be detected, and the protection against the escape of the container is improved.
  • the embodiment of the present application provides a container escape detecting device 700, which may be a server, or other computing device that can deploy a container.
  • the container escape detection device 700 can be used to perform the container escape detection method provided in the above method embodiments.
  • the container escape detection device 700 includes a processor, such as a central processing unit (CPU) 701.
  • the container escape detection device 700 includes a memory, such as a random access memory (RAM) 702 and a system memory 704 of a read-only memory (ROM) 703.
  • the container escape detection device 700 includes a system bus 705 that connects the system memory 704 to the central processing unit 701.
  • the container escape detection device 700 also includes a basic input/output (I/O) system 706 that facilitates transfer of information between various devices within the computer, and for storing the operating system 713, applications 714, and other programs.
  • Mass storage device 707 of module 715 Mass storage device 707 of module 715.
  • the basic input/output system 706 includes a display 708 for displaying information and an input device 709 such as a mouse or keyboard for user input of information.
  • the display 708 and input device 709 are both connected to the central processing unit 701 via an input and output controller 710 that is coupled to the system bus 705.
  • the basic input/output system 706 can also include an input and output controller 710 for receiving and processing input from a plurality of other devices, such as a keyboard, mouse, or electronic stylus.
  • input and output controller 710 also provides output to a display screen, printer, or other type of output device.
  • the mass storage device 707 is connected to the central processing unit 701 by a mass storage controller (not shown) connected to the system bus 705.
  • the mass storage device 707 and its associated computer readable medium provide non-volatile storage for the container escape detection device 700. That is, the mass storage device 707 can include a computer readable medium (not shown) such as a hard disk or a CD-ROM drive.
  • the computer readable medium can include computer storage media and communication media.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.
  • Computer storage media include RAM, ROM, EPROM, EEPROM, flash memory or other solid state storage technologies, CD-ROM, DVD or other optical storage, tape cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices.
  • RAM random access memory
  • ROM read only memory
  • EPROM Erasable programmable read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • the container escape detection device 700 can also be operated by a remote computer connected to the network through a network such as the Internet. That is, the container escape detecting device 700 can be connected to the network 712 through the network interface unit 711 connected to the system bus 705, or the network interface unit 711 can be used to connect to other types of networks or remote computer systems (not shown). Out).
  • the memory further includes one or more programs, the one or more programs being stored in the memory, and the central processor 701 implementing the one or more programs to implement the container escape detection method provided by the above method embodiments.
  • FIG. 8 is a block diagram of a container escape detection system 800 provided by an embodiment of the present application.
  • the container escape detection system 800 can include an escape detection component 801 and at least one container monitoring component 802 (only shown in FIG. 8).
  • a container monitoring component 802) is provided.
  • the escape detection component 801 is configured to execute the container escape detection method performed by the escape detection component in the above method embodiment.
  • the container monitoring component 802 is configured to perform the container escape detection method performed by the target container monitoring component of the above method embodiment.
  • the embodiment of the present application further provides a non-transitory computer readable storage medium including instructions, such as a memory including instructions, which are executable by a processor to perform the container escape detection method shown in the method embodiment of the present application.
  • a non-transitory computer readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.
  • the embodiment of the present application further provides a computer program product comprising instructions, when the computer program product is run on a computer, causing the computer to execute the container escape detection method shown in the embodiment of the method of the present application.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Debugging And Monitoring (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种容器逃逸检测方法、装置、系统及存储介质，涉及容器安全领域，能够提高防范容器逃逸的力度，所述方法包括：接收目标容器监测组件发送的多个系统调用信息，每个系统调用信息是目标容器监测组件在监测到第一容器中的第一进程使用第一宿主机中的系统调用后发送的；根据多个系统调用信息获取目标顺序信息，目标顺序信息用于指示第一进程使用第一宿主机中的多个系统调用的顺序；根据目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性，预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。

Description

容器逃逸检测方法、装置、系统及存储介质 技术领域
本申请涉及容器安全领域，特别涉及一种容器逃逸检测方法、装置、系统及存储介质。
背景技术
云计算(英文：Cloud Computing)是一种通过网络以服务的方式提供动态可伸缩的虚拟化资源的计算模式，其中，平台即服务(英文：Platform as a Service；简称：PaaS)是云计算的一种主要的模式。在PaaS模式中，云计算平台可以为每一个用户分配一个宿主机集群，该宿主机集群可以包括至少一个宿主机，其中，宿主机可以为物理机或虚拟机。用户可以在分配的宿主机集群的宿主机中基于容器镜像创建并运行容器，其中，每一个容器都拥有一个独立的进程运行空间，理想情况下，容器中的进程只能在该容器的进程运行空间中运行。然而，当容器中存在有恶意进程时，该恶意进程很可能会脱离容器的进程运行空间，继而对宿主机或其他容器展开攻击，这种现象被称为容器逃逸。
相关技术中，为了防范容器逃逸，在某一容器运行前，宿主机可以判断该容器是否拥有一些敏感的系统权限(例如，该敏感的系统权限可以为dac_override_capability系统权限)，在宿主机确定该容器拥有敏感的系统权限时，宿主机可以拒绝该容器的运行，从而避免容器中的恶意进程基于该敏感的系统权限对宿主机或其他容器展开攻击。
在实现本申请的过程中，发明人发现现有技术至少存在以下问题：
相关技术仅能在容器运行前被动地对容器逃逸进行防范，而对容器运行后发生的容器逃逸事件无法检测防范，因此，对容器逃逸的防范力度较低。
发明内容
本申请提供了一种容器逃逸检测方法、装置、系统及存储介质，能够提高对容器逃逸的防范力度。
第一方面，提供了一种容器逃逸检测方法，用于容器逃逸检测系统的逃逸检测组件中，所述容器逃逸检测系统包括所述逃逸检测组件和至少一个容器监测组件，每个所述容器监测组件用于对待进行容器逃逸检测的目标宿主机集群中的宿主机进行监测，所述方法包括：
接收目标容器监测组件发送的多个系统调用信息，每个所述系统调用信息是所述目标容器监测组件在监测到第一容器中的第一进程使用第一宿主机中的系统调用后发送的，所述系统调用信息携带所述第一进程所使用的系统调用的标识，所述目标容器监测组件是所述至少一个容器监测组件中的任一容器监测组件，所述第一宿主机是所述目标容器监测组件监测的宿主机，所述第一容器是所述第一宿主机中部署的一个容器；
根据所述多个系统调用信息获取目标顺序信息，所述目标顺序信息用于指示所述第一进程使用所述第一宿主机中的多个系统调用的顺序；
根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述 第一容器发生容器逃逸的可能性，所述预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。
在容器逃逸发生的过程中，容器中的恶意进程会不断地通过暴力破解的方式尝试获取宿主机文件的句柄，在获取到宿主机文件的句柄后，该恶意进程可以篡改宿主机中的敏感文件，从而完成容器逃逸攻击，而在暴力破解宿主机文件句柄的过程中，恶意进程往往需要按照一定的顺序使用宿主机中的系统调用(英文：system call)。因此，逃逸检测组件可以根据第一容器中的第一进程使用第一宿主机中的多个系统调用的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性，其中，预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序，这使得逃逸检测组件可以对容器运行后发生的容器逃逸事件进行检测，从而提高到了对容器逃逸的防范力度。
可选的，所述根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，包括：
获取目标状态机，所述目标状态机包括初始状态、最终状态以及由所述初始状态转移至所述最终状态所需满足的状态转移条件，所述状态转移条件为输入的顺序信息所指示的顺序与所述预设系统调用顺序相同的条件；
在所述目标状态机处于所述初始状态时，将所述目标顺序信息输入至所述目标状态机；
当所述目标状态机由所述初始状态转移至所述最终状态时，确定所述第一容器发生了容器逃逸。
可选的，所述获取目标状态机，包括：
获取所述第一进程的进程标识；
根据所述第一进程的进程标识查询状态机数据库，所述状态机数据库中存储有至少一组状态机与进程标识的对应关系；
当所述状态机数据库中存储有与所述第一进程的进程标识对应的状态机时，将所述状态机获取为所述目标状态机。
可选的，所述获取目标状态机，还包括：
当所述状态机数据库中没有存储与所述第一进程的进程标识对应的状态机时，根据所述预设系统调用顺序创建状态机；
将创建的所述状态机获取为所述目标状态机。
可选的，所述根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，包括：
接收所述目标容器监测装置发送的所述第一容器的启动参数，所述启动参数包括至少一个权限信息，每个所述权限信息用于指示所述第一容器拥有的一种系统权限；
根据所述启动参数以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
可选的，所述根据所述启动参数以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，包括：
从所述启动参数包括的至少一个权限信息中获取至少一个目标权限信息，每个所述目标权限信息所指示的系统权限为发生容器逃逸的容器所拥有的系统权限；
根据所述至少一个目标权限信息以及所述目标顺序信息所指示的顺序与所述预设系统 调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
在容器逃逸发生的过程中，容器中的恶意进程往往需要按照一定的顺序使用宿主机中的系统调用，而只有在容器拥有某些系统权限的前提下，容器中的进程才能使用宿主机中的系统调用。因此，在本申请实施例中，逃逸检测组件可以根据第一容器拥有的系统权限以及目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性。
可选的，所述根据所述至少一个目标权限信息以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，包括：
获取目标决策树，所述目标决策树包括至少一个分支，每个所述分支包括有序的多个节点，所述多个节点中的每个节点与一个可能性标识对应，所述可能性标识用于指示发生容器逃逸的可能性，所述多个节点包括系统权限节点和与所述系统权限节点相连的有序的多个系统调用节点，所述系统权限节点与一个系统权限对应，每个所述系统调用节点与一个系统调用对应，与所述多个系统调用节点所对应的多个系统调用的顺序与所述预设系统调用顺序相同；
从所述至少一个分支中确定至少一个目标分支，所述至少一个目标分支与所述至少一个目标权限信息一一对应，每个所述目标分支包括的系统权限节点所对应的系统权限与所述目标分支对应的目标权限信息所指示的系统权限相同；
对于每个所述目标分支，当所述目标顺序信息所指示的多个系统调用中的前n个系统调用与所述目标分支中包括的多个系统调用节点中的前n个系统调用节点所对应的n个系统调用的顺序一致时，获取所述目标分支中的第n个系统调用节点所对应的可能性标识，n为大于或等于1的正整数；
根据所述可能性标识确定所述第一容器发生容器逃逸的可能性。
可选的，所述方法还包括：
接收所述目标容器监测组件发送的敏感文件篡改信息，所述敏感文件篡改信息是所述目标容器监测组件在监测到第一容器中的第二进程对所述第一宿主机中预设的至少一个敏感文件中的任一敏感文件进行写操作后发送的；基于所述敏感文件篡改信息，确定所述第一容器发生了容器逃逸。
容器中的恶意进程在进行容器逃逸攻击时会篡改宿主机中的敏感文件，因此，当逃逸检测组件接收到目标容器监测组件发送的敏感文件篡改信息后，该逃逸检测组件即可确定第一容器发生了容器逃逸。
可选的，在接收所述目标容器监测组件发送的敏感文件篡改信息之前，所述方法还包括：
将敏感文件配置信息发送至所述目标容器监测组件，所述敏感文件配置信息包括至少一个敏感文件的标识，所述敏感文件配置信息用于供所述目标容器监测组件根据所述敏感文件配置信息确定所述至少一个敏感文件。
可选的，所述方法还包括：
接收所述目标容器监测组件发送的非法进程运行信息，所述非法进程运行信息是所述目标容器监测组件在监测到第一容器中运行的第三进程的进程标识不属于进程白名单包括的进程标识后发送的，所述进程白名单包括多个合法进程的进程标识；基于所述非法进程 运行信息，确定所述第一容器可能发生了容器逃逸。
当目标容器监测组件监测到第一容器中运行的第三进程的进程标识不属于进程白名单包括的进程标识后，该目标容器监测组件可以向逃逸检测组件发送非法进程运行信息。逃逸检测组件接收到该非法进程运行信息后，可以确定第一容器中存在非法进程，由于该非法进程很可能为恶意进程，因此，逃逸检测组件在接收到该非法进程运行信息后，可以确定第一容器可能发生了容器逃逸。
可选的，所述容器逃逸检测系统还包括客户端，所述在接收所述目标容器监测组件发送的非法进程运行信息之前，所述方法还包括：
接收所述目标容器监测组件发送的所述第一宿主机中的容器镜像与进程的对应关系；
将所述对应关系发送至所述客户端；
接收所述客户端发送的编辑后的所述对应关系；
根据编辑后的所述对应关系生成所述进程白名单；
将所述进程白名单发送至所述目标容器监测组件。
可选的，所述逃逸检测组件设置于所述目标宿主机集群中的第二宿主机中，所述第二宿主机的运算能力大于所述目标宿主机集群中除所述第二宿主机以外的至少一个宿主机。
可选的，所述逃逸检测组件设置于所述第二宿主机部署的一个容器中。
可选的，所述容器逃逸检测系统包括逃逸检测组件集群，所述逃逸检测组件集群包括多个所述逃逸检测组件，所述逃逸检测组件集群部署于防火墙内的可信区域。
可选的，所述目标容器监测组件设置于所述第一宿主机部署的一个容器中。
第一方面，提供了一种容器逃逸检测方法，用于容器逃逸检测系统的目标容器监测组件中，所述容器逃逸检测系统包括逃逸检测组件和至少一个容器监测组件，每个所述容器监测组件用于对待进行容器逃逸检测的目标宿主机集群中的宿主机进行监测，所述目标容器监测组件是所述至少一个容器监测组件中的任一个容器监测组件，所述方法包括：
在监测到第一容器中的第一进程使用第一宿主机中的系统调用后，生成多个系统调用信息，每个所述系统调用信息携带所述第一进程所使用的系统调用的标识，所述第一宿主机是所述目标容器监测组件监测的宿主机，所述第一容器是所述第一宿主机中部署的一个容器；
向所述逃逸检测组件发送所述多个系统调用信息，所述多个系统调用信息用于供所述逃逸检测组件根据所述多个系统调用信息获取目标顺序信息，并根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，所述目标顺序信息用于指示所述第一进程使用所述第一宿主机中的多个系统调用的顺序，所述预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。
可选的，所述方法还包括：
向所述逃逸检测组件发送所述第一容器的启动参数，所述启动参数包括至少一个权限信息，每个所述权限信息用于指示所述第一容器拥有的一个系统权限，所述启动参数用于供所述逃逸检测组件根据所述启动参数以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
可选的，所述方法还包括：
在监测到第一容器中的第二进程对所述第一宿主机中预设的至少一个敏感文件中的任一敏感文件进行写操作后，向所述逃逸检测组件发送敏感文件篡改信息，所述敏感文件篡改信息用于供所述逃逸检测组件基于所述敏感文件篡改信息确定所述第一容器发生了容器逃逸，所述第一容器是所述第一宿主机中部署的一个容器。
可选的，所述向所述逃逸检测组件发送敏感文件篡改信息之前，所述方法还包括：
接收所述逃逸检测组件发送的敏感文件配置信息，所述敏感文件配置信息包括至少一个敏感文件的标识；
根据所述敏感文件配置信息确定所述至少一个敏感文件。
可选的，所述方法还包括：
在监测到第一容器中运行的第三进程的进程标识不属于进程白名单包括的进程标识后，向所述逃逸检测组件发送非法进程运行信息，所述非法进程运行信息用于供所述逃逸检测组件基于所述非法进程运行信息确定所述第一容器可能发生了容器逃逸，所述进程白名单包括多个合法进程的进程标识，所述第一容器是所述第一宿主机中部署的一个容器。
可选的，所述容器逃逸检测系统还包括客户端，所述向所述逃逸检测组件发送非法进程运行信息之前，所述方法还包括：
向所述逃逸检测组件发送所述第一宿主机中的容器镜像与进程的对应关系，以由所述逃逸检测组件将所述对应关系发送至所述客户端，并接收所述客户端返回的编辑后的所述对应关系；
接收所述进程白名单，所述进程白名单是所述逃逸检测组件根据编辑后的所述对应关系生成的。
可选的，所述逃逸检测组件设置于所述目标宿主机集群中的第二宿主机中，所述第二宿主机的运算能力大于所述目标宿主机集群中除所述第二宿主机以外的至少一个宿主机。
可选的，所述逃逸检测组件设置于所述第二宿主机部署的一个容器中。
可选的，所述容器逃逸检测系统包括逃逸检测组件集群，所述逃逸检测组件集群包括多个所述逃逸检测组件，所述逃逸检测组件集群部署于防火墙内的可信区域。
可选的，所述目标容器监测组件设置于所述第一宿主机部署的一个容器中。
第三方面，提供了一种容器逃逸检测装置，该装置包括至少一个模块，该至少一个模块用于实现上述第一方面或第一方面的任一可选方式所提供的容器逃逸检测方法。
第四方面，提供了一种容器逃逸检测装置，该装置包括至少一个模块，该至少一个模块用于实现上述第二方面或第二方面的任一可选方式所提供的容器逃逸检测方法。
第五方面，提供了一种容器逃逸检测装置，所述装置包括：处理器和存储器；
所述处理器被配置为执行所述存储器中存储的指令，所述处理器通过执行所述指令来实现上述第一方面或第一方面的任一可选方式所提供的容器逃逸检测方法。
第六方面，提供了一种容器逃逸检测装置，所述装置包括：处理器和存储器；
所述处理器被配置为执行所述存储器中存储的指令，所述处理器通过执行所述指令来实现上述第二方面或第二方面的任一可选方式所提供的容器逃逸检测方法。
第七方面，提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，使得所述计算机执行上述第一方面或第一方面的任一可选方式所提供的容器逃逸检测方法，或者，使得所述计算机执行上述第二方面或第二方面的 任一可选方式所提供的容器逃逸检测方法。
第八方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面或第一方面中任意一种可能的实现方式中的容器逃逸检测方法，或者，使得计算机执行上述第二方面或第二方面中任意一种可能的实现方式中的容器逃逸检测方法。
第九方面，提供了一种容器逃逸检测系统，该容器逃逸检测系统包括上述第三方面任一所述的容器逃逸检测装置和上述第四方面任一所述的容器逃逸检测装置。
本申请提供的技术方案的有益效果是：
通过逃逸检测组件根据第一容器中的第一进程使用第一宿主机中的多个系统调用的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性，其中，预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序，使得逃逸检测组件可以对容器运行后发生的容器逃逸事件进行检测，从而提高到了对容器逃逸的防范力度。
附图说明
图1A是本申请实施例提供的一种容器逃逸攻击的路径的是示意图。
图1B是本申请实施例提供的一种实施环境的示意图。
图1C是本申请实施例提供的另一种实施环境的示意图。
图2A是本申请实施例提供的一种容器逃逸检测方法的流程图。
图2B是本申请实施例提供的一种目标状态机的示意图。
图2C是本申请实施例提供的另一种目标状态机的示意图。
图2D是本申请实施例提供的一种目标决策树的示意图。
图3是本申请实施例提供的一种容器逃逸检测装置的框图。
图4是本申请实施例提供的一种容器逃逸检测装置的框图。
图5是本申请实施例提供的一种容器逃逸检测装置的框图。
图6是本申请实施例提供的一种容器逃逸检测装置的框图。
图7是本申请实施例提供的一种容器逃逸检测装置的框图。
图8是本申请实施例提供的一种容器逃逸检测系统的框图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
云计算(英文：Cloud Computing)是一种通过网络以服务的方式提供动态可伸缩的虚拟化资源的计算模式，其中，平台即服务(英文：Platform as a Service；简称：PaaS)是云计算的一种主要的模式。
在PaaS模式中，云计算平台上可以注册有多个用户，对于每个用户，云计算平台都可以为其分配一个宿主机集群，该宿主机集群可以包括至少一个宿主机(英文：Host)。其中，宿主机是一个相对容器(英文：container)而言的概念，所谓宿主机指的就是部署容器的设备，实际应用中，宿主机可以是物理机(如服务器等)，也可以是虚拟机。
PaaS模式的用户可以在云计算平台为其分配的宿主机集群中的宿主机上部署容器，以利用部署的容器进行相应的运算。在部署容器的过程中，用户可以从云计算平台的镜像软件仓库中下载容器镜像，并根据下载的容器镜像在宿主机中创建容器。其中，容器镜像可以包括至少一个可读不可写的文件层，在创建容器时，宿主机可以在该容器镜像上创建一个可读且可写的文件层，并创建一个独立的进程运行空间，容器中的进程可以在该进程运行空间中运行，运行中的进程可以读取该至少一个可读不可写的文件层中的文件，也可以对该可读且可写的文件层中的文件进行写操作。
通常情况下，云计算平台可以允许普通用户向镜像软件仓库上传容器镜像，因此，该镜像软件仓库中容器镜像的安全性难以得到保证，这使得基于镜像软件仓库中的容器镜像创建的容器中很可能存在恶意进程，该恶意进程很可能会脱离容器的进程运行空间，继而对容器的宿主机或其他容器展开攻击，这种现象通常被称为容器逃逸。
如图1A所示，实际应用中，容器逃逸一般可以有以下几种攻击路径：
第一种、容器中的恶意进程对容器守护进程(英文：docker daemon)进行攻击。
如图1A中的攻击路径1所示，宿主机1中部署的容器A内的恶意进程a可以对容器A进行攻击，在攻陷了容器A后，该恶意进程a可以脱离容器A的进程运行空间，并对容器守护进程S1进行攻击。
第二种、容器中的恶意进程通过容器守护进程对宿主机中部署的其他容器进行攻击。
如图1A中的攻击路径2所示，宿主机2中部署的容器C内的恶意进程c可以对容器C进行攻击，在攻陷了容器C后，该恶意进程c可以脱离容器C的进程运行空间，并对容器守护进程S2进行攻击，在攻陷了容器守护进程S2后，该恶意进程c可以对宿主机2中部署的容器D进行攻击。
第三种、容器中的恶意进程对宿主机的操作系统(英文：Operating System；简称：OS)进行攻击。
如图1A中的攻击路径3所示，宿主机2中部署的容器D内的恶意进程d可以对容器D进行攻击，在攻陷了容器D后，该恶意进程d可以脱离容器D的进程运行空间，并利用容器共享库对宿主机2的操作系统OS2进行攻击。
第四种、容器中的恶意进程通过宿主机的操作系统对其他容器进行攻击。
如图1A中的攻击路径4所示，宿主机1中部署的容器A内的恶意进程a可以对容器A进行攻击，在攻陷了容器A后，该恶意进程a可以脱离容器A的进程运行空间，并将病毒上传到宿主机1的操作系统OS1的共享存储卷上，宿主机1中部署的容器B内的进程b读取并执行该恶意进程a在共享存储卷中上传的病毒后即会中毒。
第五种、容器中的恶意进程对与该容器位于同一组(英文：group)中的其他容器进行攻击。
如图1A中的攻击路径5所示，宿主机1中部署的容器B内的恶意进程b可以对容器B进行攻击，在攻陷了容器B后，该恶意进程b可以脱离容器B的进程运行空间，并对与容器B位于同一组中的容器C进行攻击。
由于容器逃逸会对宿主机和容器带来较大的安全隐患，因此，防范容器逃逸已经成为保证云计算平台安全性的一个重要环节。
通常情况下，容器中的恶意进程往往需要基于容器拥有的一些敏感的系统权限对宿主 机或其他容器展开攻击，例如，该敏感的系统权限可以为dac_override_capability或dac_read_search_capability_等。因此，相关技术中，为了防范容器逃逸，在容器运行前，宿主机可以判断该容器是否拥有一些敏感的系统权限，在宿主机确定容器拥有敏感的系统权限时，宿主机即可确定该容器有可能会发生容器逃逸，因此，宿主机可以拒绝该容器的运行，从而达到防范容器逃逸的目的。
然而，上述相关技术仅能在容器运行前被动地对容器逃逸进行防范，而对容器运行后发生的容器逃逸事件无法检测防范，因此，对容器逃逸的防范力度较低。
本申请实施例提供了一种容器逃逸检测方法，该容器逃逸检测方法可以对容器运行后发生的容器逃逸事件进行检测，因此，可以提高防范容器逃逸的力度。
图1B为本申请实施例提供的容器逃逸检测方法所涉及到的一种实施环境的示意图，如图1B所示，该实施环境可以包括至少一个容器监测组件11(图1B中仅示出了3个容器监测组件11)、逃逸检测组件12、服务组件13、存储组件14和客户端15。
其中，如图1B所示，对于云计算平台为用户A分配的宿主机集群Q而言，该宿主机集群Q中的每个宿主机n上均可以设置有一个容器监测组件11，可选的，某一宿主机中的容器监测组件11可以设置于该宿主机部署的一个容器中。其中，某一宿主机中设置的容器监测组件11可以对该宿主机中部署的容器进行监测，并将监测结果发送至逃逸检测组件12中。
逃逸检测组件12可以设置于宿主机集群Q中的某一个宿主机上，可选的，逃逸检测组件12可以设置于该宿主机部署的一个容器中。需要指出的是，逃逸检测组件12通常可以设置于宿主机集群Q中运算能力较强的一个宿主机中，实际实现时，该逃逸检测组件12可以设置于宿主机集群Q中运算能力最强的一个宿主机中。逃逸检测组件12可以接收宿主机集群Q中设置的各个容器监测组件11发送的监测结果，并可以根据接收到的监测结果确定宿主机集群Q中各宿主机中的容器发生容器逃逸的可能性，逃逸检测组件12还可以向服务组件13发送容器逃逸事件报告，该容器逃逸事件报告可以包括宿主机集群Q中某一宿主机中的容器发生容器逃逸的可能性。
服务组件13和存储组件14可以设置于防火墙内的可信区域G中，该服务组件13可以接收逃逸检测组件12发送的容器逃逸事件报告，服务组件13可以将接收到的容器逃逸事件报告存储于存储组件14中。
客户端15可以为网页客户端或者应用程序客户端，该客户端15可以在用户A的触发下向服务组件13发送查询请求，以查询宿主机集群Q的容器逃逸事件报告，服务组件13可以在接收到客户端15发送的查询请求后，从存储组件14中获取宿主机集群Q的容器逃逸事件报告，并将该容器逃逸事件报告发送至该客户端15。
图1C为本申请实施例提供的容器逃逸检测方法所涉及到的另一种实施环境的示意图，如图1C所示，该实施环境可以包括至少一个容器监测组件21、逃逸检测组件22、服务组件23、存储组件24和客户端25。
其中，容器监测组件21、服务组件23、存储组件24和客户端25分别与图1B中所示的容器监测组件11、服务组件13、存储组件14和客户端15的部署方式相同，且，容器监测组件21、服务组件23、存储组件24和客户端25分别与图1B中所示的容器监测组件11、 服务组件13、存储组件14和客户端15所执行的技术过程同理。
与图1B中的逃逸检测组件12不同的是，图1C中的逃逸检测组件22设置于防火墙内的可信区域G中，该逃逸检测组件22可以接收多个宿主机集群(图1C中仅示出了两个宿主机集群U和V)中的容器监测组件21发送的监测结果，并可以根据接收到的监测结果确定多个宿主机集群中的宿主机发生容器逃逸的可能性。可选的，为了保证逃逸检测组件22的高可用性(英文：High Availability；简称：HA)，在图1C所示的实施环境中，可以部署多个逃逸检测组件22(图1C中仅示出了两个逃逸检测组件22)，这样就可以保证某一逃逸检测组件22发生故障不会影响对容器逃逸的检测。
图2A为本申请实施例提供的一种容器逃逸检测方法的流程图，该容器逃逸检测方法可以应用于图1B或图1C所示的实施环境中，如图2A所示，该容器逃逸检测方法可以包括以下步骤：
步骤201、在监测到第一容器中的第一进程使用第一宿主机中的系统调用后，目标容器监测组件向逃逸检测组件发送多个系统调用信息。
如上所述，本申请实施例提供的容器逃逸检测方法所涉及到的实施环境中可以包括至少一个容器监测组件。其中，每个容器监测组件均可以设置于宿主机集群中的一个宿主机上，用于对该宿主机中的容器进行监测，在进行容器逃逸检测时，每个容器监测组件所执行的技术过程都是同理的，因此，本申请实施例仅以该至少一个容器监测组件中的一个容器监测组件(也即是目标容器监测组件)为例对本申请实施例提供的容器逃逸检测方法进行说明。
其中，第一宿主机可以是待进行容器逃逸检测的宿主机集群中的一个宿主机，换句话说，该第一宿主机可以是云计算平台分配给某一用户的宿主机集群中的一个宿主机，目标容器监测组件是设置于该第一宿主机中的容器监测组件，第一容器为该第一宿主机中部署的一个容器，第一进程为该第一容器中运行的一个进程。
由于在容器逃逸发生的过程中，容器中的恶意进程会不断地通过暴力破解的方式尝试获取宿主机文件的句柄，在获取到宿主机文件的句柄后，该恶意进程可以篡改宿主机中的敏感文件，从而完成容器逃逸攻击，而在暴力破解宿主机文件句柄的过程中，恶意进程往往需要按照一定的顺序使用宿主机中的系统调用(英文：system call)，例如，恶意进程可以按照如下顺序使用宿主机中的系统调用：open_by_handle_at、fstat、fcntl、getdents和open_by_handle_at。因此，在进行容器逃逸检测的过程中，容器监测组件需要对宿主机中部署的容器中的系统调用事件进行监控，并将监控结果发送至逃逸检测组件，以由逃逸检测组件根据该监控结果确定宿主机中的容器发生容器逃逸的可能性。
在步骤201中，目标容器监测组件可以对第一宿主机中部署的容器中的系统调用事件进行监控，当监测到第一容器中的第一进程使用第一宿主机中的系统调用时，该目标容器监测组件可以生成多个系统调用信息，并将该多个系统调用信息发送至逃逸检测组件中，以由逃逸检测组件根据该多个系统调用信息确定第一容器发生容器逃逸的可能性。其中，每个系统调用信息可以与第一进程使用的第一宿主机中的一个系统调用相对应，每个系统调用信息可以包括对应的系统调用的标识。
在Linux系统中，可以利用audit审计模块对第一宿主机中部署的容器中的系统调用事 件进行监控，该audit审计模块中可以配置有多个审计规则，每个审计规则可以为容器中的进程使用宿主机中的某一系统调用的规则。该audit审计模块可以在第一进程触发审计规则时，也即是，在第一进程使用第一宿主机中的系统调用时，生成审计报告，并将该审计报告发送至目标容器监测组件，目标容器监测组件接收到该审计报告后，可以基于该审计报告生成系统调用信息，并将该系统调用信息发送至逃逸检测组件。
如下所示为一个示例性的审计报告：
arch＝c00003e syscall＝304 success＝no exit＝-116 a0＝3 a1＝7ffecb757ac0 a2＝0 a3＝4 item＝0 ppid＝24057 pid＝24785 auid＝4294967295 uid＝0 gid＝0 euid＝0 suid＝0 fsuid＝0 egid＝0 sgid＝0 tty＝pts3 ses＝4284967295 comm＝”shocker”exe＝”/app/shocker”subj＝system_u:system_r:spc_t:s0 key＝67fd5ccc277e19114d7c4516b71743180149b26bc745c94e23c60bb8c933543_gra_highrisk_syscall_24057。
在该审计报告中，字段：syscall＝304表示第一进程使用了第一宿主机中编号为304的系统调用，其中，该系统调用为open_by_handle_at。
字段：success＝no表示第一进程对第一宿主机中编号为304的系统调用使用不成功。
字段：key＝67fd5ccc277e19114d7c4516b71743180149b26bc745c94e23c60bb8c933543_gra_highrisk_syscall_24057表示第一进程触发的审计规则为＝67fd5ccc277e19114d7c4516b71743180149b26bc745c94e23c60bb8c933543_gra_highrisk_syscall_24057。
步骤202、逃逸检测组件接收目标容器监测组件发送的多个系统调用信息，并根据该多个系统调用信息获取目标顺序信息。
其中，该目标顺序信息用于指示第一进程使用第一宿主机中的多个系统调用的顺序。
在一种可能的实现方式中，每个系统调用信息还可以携带有生成时间，该生成时间用于指示目标容器监测组件生成该系统调用信息的时间，逃逸检测组件可以根据每个系统调用信息携带的生成时间获取该多个系统调用信息对应的多个系统调用的顺序，而后，逃逸检测组件可以基于该多个系统调用信息对应的多个系统调用的顺序生成目标顺序信息，其中，该多个系统调用信息对应的多个系统调用的顺序即为该目标顺序信息所指示的顺序。
例如，逃逸检测组件接收到目标容器监测组件发送的3个系统调用信息，该3个系统调用信息分别为系统调用信息a、系统调用信息b和系统调用信息c。其中，系统调用信息a与第一进程使用的系统调用p相对应，系统调用信息a携带的生成时间为14:00，系统调用信息b与第一进程使用的系统调用q相对应，系统调用信息b携带的生成时间为14:01，系统调用信息c与第一进程使用的系统调用k相对应，系统调用信息c携带的生成时间为14:02。则逃逸检测组件可以根据该3个系统调用信息携带的生成时间获取该3个系统调用信息对应的3个系统调用的顺序，该顺序为：系统调用p、系统调用q和系统调用k，而后，逃逸检测组件可以根据该顺序生成目标顺序信息，其中，目标顺序信息所指示的顺序即为：系统调用p、系统调用q和系统调用k。
在另一种可能的实现方式中，逃逸检测组件可以根据接收到该多个系统调用信息的顺序获取该多个系统调用信息对应的多个系统调用的顺序，而后，逃逸检测组件可以基于该多个系统调用信息对应的多个系统调用的顺序生成目标顺序信息，其中，该多个系统调用信息对应的多个系统调用的顺序即为该目标顺序信息所指示的顺序。
例如，逃逸检测组件接收到目标容器监测组件发送的3个系统调用信息，该3个系统 调用信息分别为系统调用信息a、系统调用信息b和系统调用信息c。其中，系统调用信息a与第一进程使用的系统调用p相对应，逃逸检测组件在14:00接收到该系统调用信息a，系统调用信息b与第一进程使用的系统调用q相对应，逃逸检测组件在14:01接收到该系统调用信息b，系统调用信息c与第一进程使用的系统调用k相对应，逃逸检测组件在14:02接收到该系统调用信息c。则逃逸检测组件可以根据接收到该3个系统调用信息的顺序获取该3个系统调用信息对应的3个系统调用的顺序，该顺序为：系统调用p、系统调用q和系统调用k，而后，逃逸检测组件可以根据该顺序生成目标顺序信息，其中，目标顺序信息所指示的顺序即为：系统调用p、系统调用q和系统调用k。
步骤203、逃逸检测组件根据目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性。
其中，该预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。实际实现时，该预设系统调用顺序可以由技术人员根据已知的容器逃逸事件中容器的恶意进程使用宿主机中多个系统调用的顺序进行设定。例如，比较常见的一种容器逃逸攻击是shocker攻击，那么技术人员可以根据发生shocker攻击时，恶意进程使用系统调用的顺序设定该预设系统调用顺序。
如上所述，在容器逃逸发生的过程中，恶意进程往往需要按照一定的顺序使用宿主机中的系统调用，因此，逃逸检测组件可以根据第一进程使用第一宿主机中的多个系统调用的顺序(也即是目标顺序信息所指示的顺序)与预设系统调用顺序之间的相似程度来确定第一容器发生容器逃逸的可能性。
通常情况下，目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度越高，第一容器发生容器逃逸的可能性就越高，目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度越低，第一容器发生容器逃逸的可能性就越低。
本申请实施例提供了两种根据目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度确定第一容器发生容器逃逸的可能性的方式，下面，本申请实施例将对这两种方式进行一一说明：
第一种方式：逃逸检测组件基于状态机(英文：Finite-state machine)确定目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，并根据该相似程度确定第一容器发生容器逃逸的可能性。
其中，状态机是一种数学模型，该数学模型可以包括有限个状态以及这些状态之间相互转移所需满足的状态转移条件。其中，该有限个状态可以包括初始状态和最终状态，或者，该有限个状态可以包括初始状态、最终状态和至少一个中间状态，其中，状态机可以在转移到最终状态时进行相应的信息输出。
在本申请实施例中，逃逸检测组件可以根据第一进程的标识查询状态机数据库，当该状态机数据库中存储有第一进程的标识对应的状态机时，逃逸检测组件可以将该状态机获取为目标状态机，当该状态机数据库中没有存储第一进程的标识对应的状态机时，逃逸检测组件可以根据该预设系统调用顺序创建状态机，并将创建的状态机获取为目标状态机。其中，该状态机数据库中存储有至少一组状态机与进程标识的对应关系，该目标状态机包括初始状态、最终状态以及由初始状态转移至最终状态所需满足的状态转移条件，该状态转移条件为输入的顺序信息所指示的顺序与预设系统调用顺序相同的条件。
实际实现时，该目标状态机除了可以包括初始状态和最终状态外，还可以包括至少一个中间状态，相应地，在这种情况下，状态转移条件可以包括多个子条件，其中，该多个子条件可以包括初始状态转移至与该初始状态相邻的中间状态所需满足的子条件、相邻的两个中间状态转移所需满足的子条件以及由与该最终状态相邻的中间状态转移至该最终状态所需满足的子条件。
例如，如图2B所示，该目标状态机可以包括初始状态C、最终状态Z以及由初始状态C转移至最终状态Z所需满足的状态转移条件T，该状态转移条件T为输入的顺序信息所指示的顺序为系统调用a、b、c、d、e和f的条件，且，预设系统调用顺序为系统调用a、b、c、d、e和f的顺序。
又例如，如图2C所示，该目标状态机可以包括初始状态C、中间状态J1、中间状态J2和最终状态Z，该目标状态机还可以包括由初始状态C转移至中间状态J1所需满足的子条件T1、由中间状态J1转移至中间状态J2所需满足的子条件T2和由中间状态J2转移至最终状态Z所需满足的子条件T3，该子条件T1、T2和T3组成了状态转移条件，其中，该子条件T1为输入的顺序信息所指示的顺序中的前两个系统调用为a和b的条件，该子条件T2为输入的顺序信息所指示的中间两个系统调用为c和d的条件，该子条件T3为输入的顺序信息所指示的后两个系统调用为e和f的条件，且，预设系统调用顺序为系统调用a、b、c、d、e和f的顺序。
在获取了目标状态机后，逃逸检测组件可以基于该目标状态机确定目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，并根据该相似程度确定第一容器发生容器逃逸的可能性。
可选的，在目标状态机处于初始状态时，逃逸检测组件可以将目标顺序信息输入至该目标状态机，当目标状态机由初始状态转移至最终状态时，说明目标顺序信息所指示的顺序与预设系统调用顺序相同，因此，逃逸检测组件可以确定目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度为100％，在这种情况下，逃逸检测组件可以确定第一容器发生了容器逃逸。
第二种方式、逃逸检测组件根据第一容器拥有的系统权限以及目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性。
如上所述，在容器逃逸发生的过程中，容器中的恶意进程往往需要按照一定的顺序使用宿主机中的系统调用，而只有在容器拥有某些系统权限的前提下，容器中的进程才能使用宿主机中的系统调用。因此，在本申请实施例中，逃逸检测组件可以根据第一容器拥有的系统权限以及目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性。需要指出的是，在Linux系统中，系统权限也可以称为能力(英文：capability)。
可选的，目标容器监测组件可以通过docker socket接口获取第一容器的启动参数，该启动参数为第一宿主机创建该第一容器时采用的docker run命令中包括的参数，该启动参数可以包括至少一个权限信息，其中，每个权限信息用于指示第一容器拥有的一种系统权限。目标容器监测组件可以将该第一容器的启动参数发送至逃逸检测组件中，以使该逃逸检测组件获取第一容器拥有的系统权限，并根据第一容器拥有的系统权限以及目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性。
可选的，逃逸检测组件中可以设置有多个权限提取插件(英文：plugin)，每个权限提取插件可以与一个目标权限信息相对应，每个权限提取插件用于从第一容器的启动参数包括的至少一个权限信息中提取与该权限提取插件对应的目标权限信息，其中，每个目标权限信息所指示的系统权限为发生容器逃逸的容器所拥有的系统权限。
在提取了至少一个目标权限信息后，逃逸检测组件可以根据该至少一个目标权限信息以及目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性。
可选的，逃逸检测组件可以获取目标决策树，该目标决策树可以包括至少一个分支，每个分支包括有序的多个节点。该多个节点中的每个节点与一个可能性标识对应，该可能性标识用于指示发生容器逃逸的可能性。该多个节点包括系统权限节点和与系统权限节点相连的有序的多个系统调用节点，其中，系统权限节点与一个系统权限对应，每个系统调用节点与一个系统调用对应，与多个系统调用节点所对应的多个系统调用的顺序与预设系统调用顺序相同。
例如，如图2D所示，目标决策树可以包括两个分支1和2，其中，分支1包括根节点g、节点a1、节点a2、节点a3、节点a4、节点a5和节点a6，分支2包括根节点g、节点b1、节点b2、节点b3、节点b4、节点b5和节点b6。其中，节点a1为系统权限节点，其与系统权限dac_override_capability对应，其对应的可能性标识为4，节点a2为系统调用节点，其与系统调用open_by_handle_at对应，其对应的可能性标识为5，节点a3为系统调用节点，其与系统调用fstat对应，其对应的可能性标识为5，节点a4为系统调用节点，其与系统调用fcntl对应，其对应的可能性标识为6，节点a5为系统调用节点，其与系统调用getdents对应，其对应的可能性标识为6，节点a6为系统调用节点，其与系统调用open_by_handle_at对应，其对应的可能性标识为8。节点b1为系统权限节点，其与系统权限dac_read_search_capability对应，其对应的可能性标识为4，节点b2为系统调用节点，其与系统调用open_by_handle_at对应，其对应的可能性标识为5，节点b3为系统调用节点，其与系统调用fstat对应，其对应的可能性标识为5，节点b4为系统调用节点，其与系统调用fcntl对应，其对应的可能性标识为6，节点b5为系统调用节点，其与系统调用getdents对应，其对应的可能性标识为6，节点b6为系统调用节点，其与系统调用open_by_handle_at对应，其对应的可能性标识为8。其中，预设系统调用的顺序为：open_by_handle_at、fstat、fcntl、getdents和open_by_handle_at，可能性标识的取值范围可以为[0,10]，其中，可能性标识的数值越大说明发生容器逃逸的可能性越高。
在获取了目标决策树之后，逃逸检测组件可以从该目标决策树包括的至少一个分支中确定至少一个目标分支，该至少一个目标分支与该逃逸检测组件从第一容器的启动参数包括的至少一个权限信息中提取的至少一个目标权限信息一一对应，其中，每个目标分支包括的系统权限节点所对应的系统权限与该目标分支对应的目标权限信息所指示的系统权限相同。
例如，当逃逸检测组件从第一容器的启动参数包括的至少一个权限信息中提取的目标权限信息所指示的系统权限为dac_read_search_capability时，逃逸检测组件可以将图2D中的分支2确定为目标分支。
在确定了至少一个目标分支后，逃逸检测组件可以基于该至少一个目标分支确定第一 容器发生容器逃逸的可能性。
可选的，对于每个目标分支，当目标顺序信息所指示的多个系统调用中的前n个系统调用与该目标分支中包括的多个系统调用节点中的前n个系统调用节点所对应的n个系统调用的顺序一致时，逃逸检测组件可以获取目标分支中的第n个系统调用节点所对应的可能性标识，其中，n为大于或等于1的正整数。而后，逃逸检测组件可以根据该可能性标识确定第一容器发生容器逃逸的可能性。
例如，目标顺序信息所指示的顺序可以为：open_by_handle_at、fstat、fcntl和open_by_handle_at，其前3个系统调用与分支2中的前3个系统调用节点所对应的3个系统调用的顺序(open_by_handle_at、fstat和fcntl)一致，则逃逸检测组件可以获取分支2中的第3个系统调用节点所对应的可能性标识6，逃逸检测组件可以根据该可能性标识确定第一容器发生容器逃逸的可能性。
需要指出的是，本申请实施例中逃逸检测组件还可以根据目标容器监测组件上报的其他信息确定第一容器发生容器逃逸的可能性。
在一种可能的实现方式中，目标容器监测组件可以向逃逸检测组件上报敏感文件篡改信息，逃逸检测组件可以根据该敏感文件篡改信息确定第一容器发生容器逃逸的可能性。
可选的，逃逸检测组件可以将敏感文件配置信息发送至该目标容器监测组件中，其中，该敏感文件配置信息可以包括第一宿主机中预设的至少一个敏感文件的标识。目标容器监测组件可以根据该敏感文件配置信息确定第一宿主机中预设的至少一个敏感文件，并对该至少一个敏感文件进行写操作的监控。当监测到第一容器中的第二进程(该第二进程可以是第一进程，也可以是与第一进程不同的进程)对该至少一个敏感文件中的任一敏感文件进行写操作后，目标容器监测组件可以向逃逸检测组件发送敏感文件篡改信息。其中，在Linux系统中，目标容器监测组件可以基于inotify模块中的观测器watcher对第一宿主机中预设的至少一个敏感文件进行写操作的监控。
如上所述，容器中的恶意进程在进行容器逃逸攻击时会篡改宿主机中的敏感文件，因此，当逃逸检测组件接收到目标容器监测组件发送的敏感文件篡改信息后，该逃逸检测组件即可确定第一容器发生了容器逃逸。
实际实现时，该敏感文件配置信息还可以包括第一容器中预设的至少一个敏感文件的标识，目标容器监测组件可以根据该敏感文件配置信息确定第一容器中预设的至少一个敏感文件，并对该第一容器中至少一个敏感文件进行写操作的监控。当监测到第一容器中的第二进程对该第一容器中至少一个敏感文件中的任一敏感文件进行写操作后，目标容器监测组件也可以向逃逸检测组件发送敏感文件篡改信息。在这种情况下，逃逸检测组件接收到该敏感文件篡改信息后，可以确定第一容器中可能存在恶意进程，因此，此时逃逸检测组件可以确定第一容器可能会发生容器逃逸。
在另一种可能的实现方式中，目标容器监测组件可以向逃逸检测组件发送非法进程运行信息，逃逸检测组件可以根据该非法进程运行信息确定第一容器发生容器逃逸的可能性。
可选的，目标容器监测组件可以向逃逸检测组件发送第一宿主机的容器镜像与进程的对应关系，逃逸检测组件可以将该对应关系发送至客户端，以由客户端将该对应关系展示给用户。用户可以对该对应关系进行编辑，例如，用户可以在该对应关系中增加某些进程，或者，删除某些进程。客户端可以将经过用户编辑的对应关系发送至逃逸检测组件，逃逸 检测组件接收到该对应关系后，可以基于该对应关系中包括的进程生成进程白名单，该进程白名单可以包括多个合法进程的进程标识。逃逸检测组件可以将该进程白名单发送至目标容器监测组件。
目标容器监测组件可以对第一容器中运行的进程进行监控，当目标容器监测组件监测到第一容器中运行的第三进程(该第三进程可以是第一进程，也可以是与第一进程不同的进程)的进程标识不属于进程白名单包括的进程标识后，该目标容器监测组件可以向逃逸检测组件发送非法进程运行信息。逃逸检测组件接收到该非法进程运行信息后，可以确定第一容器中存在非法进程，由于该非法进程很可能为恶意进程，因此，逃逸检测组件在接收到该非法进程运行信息后，可以确定第一容器可能发生了容器逃逸。
需要指出的是，在Linux系统中，目标容器监测组件可以利用cAdvisor模块对第一容器中运行的进程进行监控。
步骤204、逃逸检测组件在确定第一容器发生容器逃逸的可能性后，生成并向服务组件发送容器逃逸事件报告。
该容器逃逸事件报告可以包括第一宿主机中的第一容器发生容器逃逸的可能性。
服务组件在接收到该容器逃逸事件报告后，可以将接收到的容器逃逸事件报告存储于存储组件中。
客户端可以在用户的触发下向服务组件发送查询请求，以查询第一容器的容器逃逸事件报告，服务组件可以在接收到客户端发送的查询请求后，从存储组件中获取第一容器的容器逃逸事件报告，并将该容器逃逸事件报告发送至该客户端。
综上所述，本申请实施例提供的容器逃逸检测方法，通过逃逸检测组件根据第一容器中的第一进程使用第一宿主机中的多个系统调用的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性，其中，预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序，使得逃逸检测组件可以对容器运行后发生的容器逃逸事件进行检测，从而提高到了对容器逃逸的防范力度。
下述为本申请的装置实施例，可以用于执行本申请的方法实施例。对于本申请装置实施例中未披露的细节，请参照本申请方法实施例。
请参考图3，其示出了本申请实施例提供的一种容器逃逸检测装置300的框图，该容器逃逸检测装置300可以应用于图1B或图1C所示的逃逸检测组件中。参见图3，该容器逃逸检测装置300可以包括第一接收模块301、获取模块302和第一确定模块303。
第一接收模块301，用于接收目标容器监测组件发送的多个系统调用信息，每个系统调用信息是该目标容器监测组件在监测到第一容器中的第一进程使用第一宿主机中的系统调用后发送的，该系统调用信息携带该第一进程所使用的系统调用的标识，该目标容器监测组件是该至少一个容器监测组件中的任一容器监测组件，该第一宿主机是该目标容器监测组件监测的宿主机，该第一容器是该第一宿主机中部署的一个容器。
获取模块302，用于根据该多个系统调用信息获取目标顺序信息，该目标顺序信息用于指示该第一进程使用该第一宿主机中的多个系统调用的顺序。
第一确定模块303，用于根据该目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定该第一容器发生容器逃逸的可能性，该预设系统调用顺序为发生容器逃逸 时，容器中的恶意进程使用宿主机中多个系统调用的顺序。
在本申请的一个实施例中，该第一确定模块303，包括：
获取子模块，用于获取目标状态机，该目标状态机包括初始状态、最终状态以及由该初始状态转移至该最终状态所需满足的状态转移条件，该状态转移条件为输入的顺序信息所指示的顺序与该预设系统调用顺序相同的条件；
输入子模块，用于在该目标状态机处于该初始状态时，将该目标顺序信息输入至该目标状态机；
第一确定子模块，用于在该目标状态机由该初始状态转移至该最终状态时，确定该第一容器发生了容器逃逸。
在本申请的一个实施例中，该第一确定模块303，包括：
接收子模块，用于接收该目标容器监测装置发送的该第一容器的启动参数，该启动参数包括至少一个权限信息，每个权限信息用于指示该第一容器拥有的一种系统权限；
第二确定子模块，用于根据该启动参数以及该目标顺序信息所指示的顺序与该预设系统调用顺序之间的相似程度，确定该第一容器发生容器逃逸的可能性。
在本申请的一个实施例中，该第二确定子模块，用于：
从该启动参数包括的至少一个权限信息中获取至少一个目标权限信息，每个目标权限信息所指示的系统权限为发生容器逃逸的容器所拥有的系统权限；
根据该至少一个目标权限信息以及该目标顺序信息所指示的顺序与该预设系统调用顺序之间的相似程度，确定该第一容器发生容器逃逸的可能性。
在本申请的一个实施例中，该第二确定子模块，用于：
获取目标决策树，该目标决策树包括至少一个分支，每个分支包括有序的多个节点，该多个节点中的每个节点与一个可能性标识对应，该可能性标识用于指示发生容器逃逸的可能性，该多个节点包括系统权限节点和与该系统权限节点相连的有序的多个系统调用节点，该系统权限节点与一个系统权限对应，每个系统调用节点与一个系统调用对应，与该多个系统调用节点所对应的多个系统调用的顺序与该预设系统调用顺序相同；
从该至少一个分支中确定至少一个目标分支，该至少一个目标分支与该至少一个目标权限信息一一对应，每个目标分支包括的系统权限节点所对应的系统权限与该目标分支对应的目标权限信息所指示的系统权限相同；
对于每个目标分支，当该目标顺序信息所指示的多个系统调用中的前n个系统调用与该目标分支中包括的多个系统调用节点中的前n个系统调用节点所对应的n个系统调用的顺序一致时，获取该目标分支中的第n个系统调用节点所对应的可能性标识，n为大于或等于1的正整数；
根据该可能性标识确定该第一容器发生容器逃逸的可能性。
本申请实施例还提供了另一种容器逃逸检测装置400，如图4所示，该容器逃逸检测装置400除了可以包括容器逃逸检测装置300包括的各个模块外，还可以包括第二接收模块304、第二确定模块305、第三接收模块306和第三确定模块307。
第二接收模块304，用于接收该目标容器监测组件发送的敏感文件篡改信息，该敏感文件篡改信息是该目标容器监测组件在监测到该第一容器中的第二进程对该第一宿主机中预设的至少一个敏感文件中的任一敏感文件进行写操作后发送的。
第二确定模块305，用于基于该敏感文件篡改信息，确定该第一容器发生了容器逃逸。
第三接收模块306，用于接收该目标容器监测组件发送的非法进程运行信息，该非法进程运行信息是该目标容器监测组件在监测到该第一容器中运行的第三进程的进程标识不属于进程白名单包括的进程标识后发送的，该进程白名单包括多个合法进程的进程标识。
第三确定模块307，用于基于该非法进程运行信息，确定该第一容器可能发生了容器逃逸。
综上所述，本申请实施例提供的容器逃逸检测装置，通过根据第一容器中的第一进程使用第一宿主机中的多个系统调用的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性，其中，预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序，从而可以对容器运行后发生的容器逃逸事件进行检测，提高到了对容器逃逸的防范力度。
请参考图5，其示出了本申请实施例提供的一种容器逃逸检测装置500的框图，该容器逃逸检测装置500可以应用于图1B或图1C所示的容器监测组件中。参见图5，该容器逃逸检测装置500可以包括生成模块501和第一发送模块502。
生成模块501，用于在监测到第一容器中的第一进程使用第一宿主机中的系统调用后，生成多个系统调用信息，每个系统调用信息携带该第一进程所使用的系统调用的标识，该第一宿主机是该目标容器监测组件监测的宿主机，该第一容器是该第一宿主机中部署的一个容器。
第一发送模块502，用于向该逃逸检测组件发送该多个系统调用信息，该多个系统调用信息用于供该逃逸检测组件根据该多个系统调用信息获取目标顺序信息，并根据该目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定该第一容器发生容器逃逸的可能性，该目标顺序信息用于指示该第一进程使用该第一宿主机中的多个系统调用的顺序，该预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。
本申请实施例还提供了另一种容器逃逸检测装置600，如图6所示，该容器逃逸检测装置600除了可以包括容器逃逸检测装置500包括的各个模块外，还可以包括第二发送模块503、第三发送模块504和第四发送模块505。
第二发送模块503，用于向该逃逸检测组件发送该第一容器的启动参数，该启动参数包括至少一个权限信息，每个权限信息用于指示该第一容器拥有的一个系统权限，该启动参数用于供该逃逸检测组件根据该启动参数以及该目标顺序信息所指示的顺序与该预设系统调用顺序之间的相似程度，确定该第一容器发生容器逃逸的可能性。
第三发送模块504，用于在监测到该第一容器中的第二进程对该第一宿主机中预设的至少一个敏感文件中的任一敏感文件进行写操作后，向该逃逸检测组件发送敏感文件篡改信息，该敏感文件篡改信息用于供该逃逸检测组件基于该敏感文件篡改信息确定该第一容器发生了容器逃逸。
第四发送模块505，用于在监测到该第一容器中运行的第三进程的进程标识不属于进程白名单包括的进程标识后，向该逃逸检测组件发送非法进程运行信息，该非法进程运行信息用于供该逃逸检测组件基于该非法进程运行信息确定该第一容器可能发生了容器逃逸， 该进程白名单包括多个合法进程的进程标识。
综上所述，本申请实施例提供的容器逃逸检测装置，通过在第一容器中的第一进程使用第一宿主机中的系统调用后向逃逸检测组件发送系统调用信息，使得逃逸检测组件根据第一容器中的第一进程使用第一宿主机中的多个系统调用的顺序与预设系统调用顺序之间的相似程度，确定第一容器发生容器逃逸的可能性，其中，预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序，从而可以对容器运行后发生的容器逃逸事件进行检测，提高到了对容器逃逸的防范力度。
本申请实施例提供了一种容器逃逸检测装置700，该容器逃逸检测装置700可以为服务器，或者其它可以部署容器的计算设备。该容器逃逸检测装置700可以用于执行上述方法实施例中提供的容器逃逸检测方法。
参见图7，该容器逃逸检测装置700包括处理器，例如中央处理单元(central processing unit，CPU)701。该容器逃逸检测装置700包括存储器，例如随机存取存储器(random-access memory，RAM)702和只读存储器(read-only memory，ROM)703的系统存储器704。该容器逃逸检测装置700包括连接系统存储器704和中央处理单元701的系统总线705。该容器逃逸检测装置700还包括帮助计算机内的各个器件之间传输信息的基本输入/输出系统(input/output,I/O)系统706，和用于存储操作系统713、应用程序714和其他程序模块715的大容量存储设备707。
该基本输入/输出系统706包括有用于显示信息的显示器708和用于用户输入信息的诸如鼠标、键盘之类的输入设备709。其中该显示器708和输入设备709都通过连接到系统总线705的输入输出控制器710连接到中央处理单元701。该基本输入/输出系统706还可以包括输入输出控制器710以用于接收和处理来自键盘、鼠标、或电子触控笔等多个其他设备的输入。类似地，输入输出控制器710还提供输出到显示屏、打印机或其他类型的输出设备。
该大容量存储设备707通过连接到系统总线705的大容量存储控制器(未示出)连接到中央处理单元701。该大容量存储设备707及其相关联的计算机可读介质为容器逃逸检测装置700提供非易失性存储。也就是说，该大容量存储设备707可以包括诸如硬盘或者CD-ROM驱动器之类的计算机可读介质(未示出)。
不失一般性，该计算机可读介质可以包括计算机存储介质和通信介质。计算机存储介质包括以用于存储诸如计算机可读指令、数据结构、程序模块或其他数据等信息的任何方法或技术实现的易失性和非易失性、可移动和不可移动介质。计算机存储介质包括RAM、ROM、EPROM、EEPROM、闪存或其他固态存储其技术，CD-ROM、DVD或其他光学存储、磁带盒、磁带、磁盘存储或其他磁性存储设备。当然，本领域技术人员可知该计算机存储介质不局限于上述几种。上述的系统存储器704和大容量存储设备707可以统称为存储器。
根据本申请的各种实施例，该容器逃逸检测装置700还可以通过诸如因特网等网络连接到网络上的远程计算机运行。也即容器逃逸检测装置700可以通过连接在该系统总线705上的网络接口单元711连接到网络712，或者说，也可以使用网络接口单元711来连接到其他类型的网络或远程计算机系统(未示出)。
该存储器还包括一个或者一个以上的程序，该一个或者一个以上程序存储于存储器中，中央处理器701通过执行该一个或一个以上程序来实现上述方法实施例提供的容器逃逸检测方法。
请参考图8，其示出了本申请实施例提供的一种容器逃逸检测系统800的框图，该容器逃逸检测系统800可以包括逃逸检测组件801和至少一个容器监测组件802(图8中仅示出了一个容器监测组件802)。
其中，逃逸检测组件801用于执行上述方法实施例中逃逸检测组件所执行的容器逃逸检测方法。
容器监测组件802用于执行上述方法实施例中目标容器监测组件所执行的容器逃逸检测方法。
本申请实施例还提供了一种包括指令的非临时性计算机可读存储介质，例如包括指令的存储器，上述指令可由处理器执行以完成本申请方法实施例所示的容器逃逸检测方法。例如，该非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
本申请实施例还提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行本申请方法实施例所示的容器逃逸检测方法。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (25)

  1. 一种容器逃逸检测方法，其特征在于，用于容器逃逸检测系统的逃逸检测组件中，所述容器逃逸检测系统包括所述逃逸检测组件和至少一个容器监测组件，每个所述容器监测组件用于对待进行容器逃逸检测的目标宿主机集群中的宿主机进行监测，所述方法包括：
    接收目标容器监测组件发送的多个系统调用信息，每个所述系统调用信息是所述目标容器监测组件在监测到第一容器中的第一进程使用第一宿主机中的系统调用后发送的，所述系统调用信息携带所述第一进程所使用的系统调用的标识，所述目标容器监测组件是所述至少一个容器监测组件中的任一容器监测组件，所述第一宿主机是所述目标容器监测组件监测的宿主机，所述第一容器是所述第一宿主机中部署的一个容器；
    根据所述多个系统调用信息获取目标顺序信息，所述目标顺序信息用于指示所述第一进程使用所述第一宿主机中的多个系统调用的顺序；
    根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，所述预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，包括：
    获取目标状态机，所述目标状态机包括初始状态、最终状态以及由所述初始状态转移至所述最终状态所需满足的状态转移条件，所述状态转移条件为输入的顺序信息所指示的顺序与所述预设系统调用顺序相同的条件；
    在所述目标状态机处于所述初始状态时，将所述目标顺序信息输入至所述目标状态机；
    当所述目标状态机由所述初始状态转移至所述最终状态时，确定所述第一容器发生了容器逃逸。
  3. 根据权利要求1所述的方法，其特征在于，所述根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，包括：
    接收所述目标容器监测装置发送的所述第一容器的启动参数，所述启动参数包括至少一个权限信息，每个所述权限信息用于指示所述第一容器拥有的一种系统权限；
    根据所述启动参数以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述启动参数以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，包括：
    从所述启动参数包括的至少一个权限信息中获取至少一个目标权限信息，每个所述目标权限信息所指示的系统权限为发生容器逃逸的容器所拥有的系统权限；
    根据所述至少一个目标权限信息以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
  5. 根据权利要求4所述的方法，其特征在于，所述根据所述至少一个目标权限信息以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，包括：
    获取目标决策树，所述目标决策树包括至少一个分支，每个所述分支包括有序的多个节点，所述多个节点中的每个节点与一个可能性标识对应，所述可能性标识用于指示发生容器逃逸的可能性，所述多个节点包括系统权限节点和与所述系统权限节点相连的有序的多个系统调用节点，所述系统权限节点与一个系统权限对应，每个所述系统调用节点与一个系统调用对应，与所述多个系统调用节点所对应的多个系统调用的顺序与所述预设系统调用顺序相同；
    从所述至少一个分支中确定至少一个目标分支，所述至少一个目标分支与所述至少一个目标权限信息一一对应，每个所述目标分支包括的系统权限节点所对应的系统权限与所述目标分支对应的目标权限信息所指示的系统权限相同；
    对于每个所述目标分支，当所述目标顺序信息所指示的多个系统调用中的前n个系统调用与所述目标分支中包括的多个系统调用节点中的前n个系统调用节点所对应的n个系统调用的顺序一致时，获取所述目标分支中的第n个系统调用节点所对应的可能性标识，n为大于或等于1的正整数；
    根据所述可能性标识确定所述第一容器发生容器逃逸的可能性。
  6. 根据权利要求1至5任一所述的方法，其特征在于，所述方法还包括：
    接收所述目标容器监测组件发送的敏感文件篡改信息，所述敏感文件篡改信息是所述目标容器监测组件在监测到所述第一容器中的第二进程对所述第一宿主机中预设的至少一个敏感文件中的任一敏感文件进行写操作后发送的；
    基于所述敏感文件篡改信息，确定所述第一容器发生了容器逃逸。
  7. 根据权利要求1至5任一所述的方法，其特征在于，所述方法还包括：
    接收所述目标容器监测组件发送的非法进程运行信息，所述非法进程运行信息是所述目标容器监测组件在监测到所述第一容器中运行的第三进程的进程标识不属于进程白名单包括的进程标识后发送的，所述进程白名单包括多个合法进程的进程标识；
    基于所述非法进程运行信息，确定所述第一容器可能发生了容器逃逸。
  8. 一种容器逃逸检测方法，其特征在于，用于容器逃逸检测系统的目标容器监测组件中，所述容器逃逸检测系统包括逃逸检测组件和至少一个容器监测组件，每个所述容器监测组件用于对待进行容器逃逸检测的目标宿主机集群中的宿主机进行监测，所述目标容器监测组件是所述至少一个容器监测组件中的任一个容器监测组件，所述方法包括：
    在监测到第一容器中的第一进程使用第一宿主机中的系统调用后，生成多个系统调用信息，每个所述系统调用信息携带所述第一进程所使用的系统调用的标识，所述第一宿主机是所述目标容器监测组件监测的宿主机，所述第一容器是所述第一宿主机中部署的一个容器；
    向所述逃逸检测组件发送所述多个系统调用信息，所述多个系统调用信息用于供所述逃 逸检测组件根据所述多个系统调用信息获取目标顺序信息，并根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，所述目标顺序信息用于指示所述第一进程使用所述第一宿主机中的多个系统调用的顺序，所述预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    向所述逃逸检测组件发送所述第一容器的启动参数，所述启动参数包括至少一个权限信息，每个所述权限信息用于指示所述第一容器拥有的一个系统权限，所述启动参数用于供所述逃逸检测组件根据所述启动参数以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
  10. 根据权利要求8至9任一所述的方法，其特征在于，所述方法还包括：
    在监测到所述第一容器中的第二进程对所述第一宿主机中预设的至少一个敏感文件中的任一敏感文件进行写操作后，向所述逃逸检测组件发送敏感文件篡改信息，所述敏感文件篡改信息用于供所述逃逸检测组件基于所述敏感文件篡改信息确定所述第一容器发生了容器逃逸。
  11. 根据权利要求8至9任一所述的方法，其特征在于，所述方法还包括：
    在监测到所述第一容器中运行的第三进程的进程标识不属于进程白名单包括的进程标识后，向所述逃逸检测组件发送非法进程运行信息，所述非法进程运行信息用于供所述逃逸检测组件基于所述非法进程运行信息确定所述第一容器可能发生了容器逃逸，所述进程白名单包括多个合法进程的进程标识。
  12. 一种容器逃逸检测装置，其特征在于，用于容器逃逸检测系统的逃逸检测组件中，所述容器逃逸检测系统包括所述逃逸检测组件和至少一个容器监测组件，每个所述容器监测组件用于对待进行容器逃逸检测的目标宿主机集群中的宿主机进行监测，所述装置包括：
    第一接收模块，用于接收目标容器监测组件发送的多个系统调用信息，每个所述系统调用信息是所述目标容器监测组件在监测到第一容器中的第一进程使用第一宿主机中的系统调用后发送的，所述系统调用信息携带所述第一进程所使用的系统调用的标识，所述目标容器监测组件是所述至少一个容器监测组件中的任一容器监测组件，所述第一宿主机是所述目标容器监测组件监测的宿主机，所述第一容器是所述第一宿主机中部署的一个容器；
    获取模块，用于根据所述多个系统调用信息获取目标顺序信息，所述目标顺序信息用于指示所述第一进程使用所述第一宿主机中的多个系统调用的顺序；
    第一确定模块，用于根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，所述预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。
  13. 根据权利要求12所述的装置，其特征在于，所述第一确定模块，包括：
    获取子模块，用于获取目标状态机，所述目标状态机包括初始状态、最终状态以及由所 述初始状态转移至所述最终状态所需满足的状态转移条件，所述状态转移条件为输入的顺序信息所指示的顺序与所述预设系统调用顺序相同的条件；
    输入子模块，用于在所述目标状态机处于所述初始状态时，将所述目标顺序信息输入至所述目标状态机；
    第一确定子模块，用于在所述目标状态机由所述初始状态转移至所述最终状态时，确定所述第一容器发生了容器逃逸。
  14. 根据权利要求12所述的装置，其特征在于，所述第一确定模块，包括：
    接收子模块，用于接收所述目标容器监测装置发送的所述第一容器的启动参数，所述启动参数包括至少一个权限信息，每个所述权限信息用于指示所述第一容器拥有的一种系统权限；
    第二确定子模块，用于根据所述启动参数以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
  15. 根据权利要求14所述的装置，其特征在于，所述第二确定子模块，用于：
    从所述启动参数包括的至少一个权限信息中获取至少一个目标权限信息，每个所述目标权限信息所指示的系统权限为发生容器逃逸的容器所拥有的系统权限；
    根据所述至少一个目标权限信息以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
  16. 根据权利要求15所述的装置，其特征在于，所述第二确定子模块，用于：
    获取目标决策树，所述目标决策树包括至少一个分支，每个所述分支包括有序的多个节点，所述多个节点中的每个节点与一个可能性标识对应，所述可能性标识用于指示发生容器逃逸的可能性，所述多个节点包括系统权限节点和与所述系统权限节点相连的有序的多个系统调用节点，所述系统权限节点与一个系统权限对应，每个所述系统调用节点与一个系统调用对应，与所述多个系统调用节点所对应的多个系统调用的顺序与所述预设系统调用顺序相同；
    从所述至少一个分支中确定至少一个目标分支，所述至少一个目标分支与所述至少一个目标权限信息一一对应，每个所述目标分支包括的系统权限节点所对应的系统权限与所述目标分支对应的目标权限信息所指示的系统权限相同；
    对于每个所述目标分支，当所述目标顺序信息所指示的多个系统调用中的前n个系统调用与所述目标分支中包括的多个系统调用节点中的前n个系统调用节点所对应的n个系统调用的顺序一致时，获取所述目标分支中的第n个系统调用节点所对应的可能性标识，n为大于或等于1的正整数；
    根据所述可能性标识确定所述第一容器发生容器逃逸的可能性。
  17. 根据权利要求12至16任一所述的装置，其特征在于，所述装置还包括：
    第二接收模块，用于接收所述目标容器监测组件发送的敏感文件篡改信息，所述敏感文件篡改信息是所述目标容器监测组件在监测到所述第一容器中的第二进程对所述第一宿主机 中预设的至少一个敏感文件中的任一敏感文件进行写操作后发送的；
    第二确定模块，用于基于所述敏感文件篡改信息，确定所述第一容器发生了容器逃逸。
  18. 根据权利要求12至16任一所述的装置，其特征在于，所述装置还包括：
    第三接收模块，用于接收所述目标容器监测组件发送的非法进程运行信息，所述非法进程运行信息是所述目标容器监测组件在监测到所述第一容器中运行的第三进程的进程标识不属于进程白名单包括的进程标识后发送的，所述进程白名单包括多个合法进程的进程标识；
    第三确定模块，用于基于所述非法进程运行信息，确定所述第一容器可能发生了容器逃逸。
  19. 一种容器逃逸检测装置，其特征在于，用于容器逃逸检测系统的目标容器监测组件中，所述容器逃逸检测系统包括逃逸检测组件和至少一个容器监测组件，每个所述容器监测组件用于对待进行容器逃逸检测的目标宿主机集群中的宿主机进行监测，所述目标容器监测组件是所述至少一个容器监测组件中的任一个容器监测组件，所述装置包括：
    生成模块，用于在监测到第一容器中的第一进程使用第一宿主机中的系统调用后，生成多个系统调用信息，每个所述系统调用信息携带所述第一进程所使用的系统调用的标识，所述第一宿主机是所述目标容器监测组件监测的宿主机，所述第一容器是所述第一宿主机中部署的一个容器；
    第一发送模块，用于向所述逃逸检测组件发送所述多个系统调用信息，所述多个系统调用信息用于供所述逃逸检测组件根据所述多个系统调用信息获取目标顺序信息，并根据所述目标顺序信息所指示的顺序与预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性，所述目标顺序信息用于指示所述第一进程使用所述第一宿主机中的多个系统调用的顺序，所述预设系统调用顺序为发生容器逃逸时，容器中的恶意进程使用宿主机中多个系统调用的顺序。
  20. 根据权利要求19所述的装置，其特征在于，所述装置还包括：
    第二发送模块，用于向所述逃逸检测组件发送所述第一容器的启动参数，所述启动参数包括至少一个权限信息，每个所述权限信息用于指示所述第一容器拥有的一个系统权限，所述启动参数用于供所述逃逸检测组件根据所述启动参数以及所述目标顺序信息所指示的顺序与所述预设系统调用顺序之间的相似程度，确定所述第一容器发生容器逃逸的可能性。
  21. 根据权利要求19至20任一所述的装置，其特征在于，所述装置还包括：
    第三发送模块，用于在监测到所述第一容器中的第二进程对所述第一宿主机中预设的至少一个敏感文件中的任一敏感文件进行写操作后，向所述逃逸检测组件发送敏感文件篡改信息，所述敏感文件篡改信息用于供所述逃逸检测组件基于所述敏感文件篡改信息确定所述第一容器发生了容器逃逸。
  22. 根据权利要求19至20任一所述的装置，其特征在于，所述装置还包括：
    第四发送模块，用于在监测到所述第一容器中运行的第三进程的进程标识不属于进程白 名单包括的进程标识后，向所述逃逸检测组件发送非法进程运行信息，所述非法进程运行信息用于供所述逃逸检测组件基于所述非法进程运行信息确定所述第一容器可能发生了容器逃逸，所述进程白名单包括多个合法进程的进程标识。
  23. 一种容器逃逸检测装置，其特征在于，所述装置包括处理器和存储器；
    所述处理器被配置为执行所述存储器中存储的指令，所述处理器通过执行所述指令来实现权利要求1至7任一所述的容器逃逸检测方法；或者，
    所述处理器通过执行所述指令来实现权利要求8至11任一所述的容器逃逸检测方法。
  24. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求1至7中任一所述的容器逃逸检测方法；
    或者，使得所述计算机执行权利要求8至11中任一所述的容器逃逸检测方法。
  25. 一种容器逃逸检测系统，其特征在于，所述容器逃逸检测系统包括如权利要求12至18任一所述的容器逃逸检测装置和如权利要求19至22任一所述的容器逃逸检测装置。
PCT/CN2018/079338 2018-03-16 2018-03-16 容器逃逸检测方法、装置、系统及存储介质 WO2019174048A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
PCT/CN2018/079338 WO2019174048A1 (zh) 2018-03-16 2018-03-16 容器逃逸检测方法、装置、系统及存储介质
EP18909785.0A EP3761198B1 (en) 2018-03-16 2018-08-28 Container escape detection method, apparatus and system, and storage medium
PCT/CN2018/102667 WO2019174193A1 (zh) 2018-03-16 2018-08-28 容器逃逸检测方法、装置、系统及存储介质
CN201880091015.XA CN111819556B (zh) 2018-03-16 2018-08-28 容器逃逸检测方法、装置、系统及存储介质
US17/021,428 US11989283B2 (en) 2018-03-16 2020-09-15 Container escape detection method, apparatus, and system, and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/079338 WO2019174048A1 (zh) 2018-03-16 2018-03-16 容器逃逸检测方法、装置、系统及存储介质

Publications (1)

Publication Number Publication Date
WO2019174048A1 true WO2019174048A1 (zh) 2019-09-19

Family

ID=67908604

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2018/079338 WO2019174048A1 (zh) 2018-03-16 2018-03-16 容器逃逸检测方法、装置、系统及存储介质
PCT/CN2018/102667 WO2019174193A1 (zh) 2018-03-16 2018-08-28 容器逃逸检测方法、装置、系统及存储介质

Family Applications After (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/102667 WO2019174193A1 (zh) 2018-03-16 2018-08-28 容器逃逸检测方法、装置、系统及存储介质

Country Status (4)

Country Link
US (1) US11989283B2 (zh)
EP (1) EP3761198B1 (zh)
CN (1) CN111819556B (zh)
WO (2) WO2019174048A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111221625A (zh) * 2019-12-31 2020-06-02 北京健康之家科技有限公司 文件检测方法、装置及设备
CN113761537A (zh) * 2021-07-29 2021-12-07 苏州浪潮智能科技有限公司 一种防范容器逃逸的方法、系统、设备、存储介质
US11811910B2 (en) 2018-08-03 2023-11-07 Huawei Cloud Computing Technologies Co., Ltd. Blockchain maintenance method and apparatus, server, and computer-readable storage medium

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11062022B1 (en) * 2019-05-01 2021-07-13 Intuit Inc. Container packaging device
CN111310180A (zh) * 2020-02-18 2020-06-19 上海迅软信息科技有限公司 一种企业信息安全用计算机进程防冒充方法
CN111881453A (zh) * 2020-07-20 2020-11-03 北京百度网讯科技有限公司 一种容器逃逸检测方法、装置以及电子设备
CN113221103B (zh) * 2021-05-08 2022-09-20 山东英信计算机技术有限公司 一种容器安全防护方法、系统及介质
CN113553598A (zh) * 2021-09-18 2021-10-26 云宏信息科技股份有限公司 操作系统的完整性校验方法、可读存储介质及校验系统
US11983268B2 (en) * 2022-02-15 2024-05-14 Palo Alto Networks, Inc. Prevention of container escape-based attacks of a host system
CN115373798A (zh) * 2022-07-25 2022-11-22 国网新疆电力有限公司乌鲁木齐供电公司 一种智能物联终端容器逃逸攻击检测和防御方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104915285A (zh) * 2015-06-30 2015-09-16 北京奇虎科技有限公司 一种容器进程监控方法、装置及系统
CN105590054A (zh) * 2014-11-11 2016-05-18 航天恒星科技有限公司 虚拟机进程监控的方法、装置及系统
CN105608374A (zh) * 2015-12-18 2016-05-25 北京奇虎科技有限公司 虚拟机逃逸的检测方法及装置
CN107679399A (zh) * 2017-10-19 2018-02-09 郑州云海信息技术有限公司 一种基于容器的恶意代码检测沙盒系统及检测方法

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8272048B2 (en) * 2006-08-04 2012-09-18 Apple Inc. Restriction of program process capabilities
US9037854B2 (en) * 2013-01-22 2015-05-19 Amazon Technologies, Inc. Privileged cryptographic services in a virtualized environment
US9832217B2 (en) * 2014-03-13 2017-11-28 International Business Machines Corporation Computer implemented techniques for detecting, investigating and remediating security violations to IT infrastructure
US20160379136A1 (en) * 2015-06-26 2016-12-29 Qualcomm Incorporated Methods and Systems for Automatic Extraction of Behavioral Features from Mobile Applications
KR102294568B1 (ko) 2015-08-19 2021-08-26 삼성에스디에스 주식회사 컨테이너 이미지 보안 검사 방법 및 그 장치
US10586042B2 (en) * 2015-10-01 2020-03-10 Twistlock, Ltd. Profiling of container images and enforcing security policies respective thereof
US10223534B2 (en) * 2015-10-15 2019-03-05 Twistlock, Ltd. Static detection of vulnerabilities in base images of software containers
US9521115B1 (en) 2016-03-24 2016-12-13 Varmour Networks, Inc. Security policy generation using container metadata
CN106778257A (zh) * 2016-12-08 2017-05-31 北京国电通网络技术有限公司 一种虚拟机防逃逸装置
US10791134B2 (en) * 2016-12-21 2020-09-29 Threat Stack, Inc. System and method for cloud-based operating system event and data access monitoring
US10824745B2 (en) * 2017-04-19 2020-11-03 Servicenow, Inc. System for accessing a kernel space of an operating system with access control functionality

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105590054A (zh) * 2014-11-11 2016-05-18 航天恒星科技有限公司 虚拟机进程监控的方法、装置及系统
CN104915285A (zh) * 2015-06-30 2015-09-16 北京奇虎科技有限公司 一种容器进程监控方法、装置及系统
CN105608374A (zh) * 2015-12-18 2016-05-25 北京奇虎科技有限公司 虚拟机逃逸的检测方法及装置
CN107679399A (zh) * 2017-10-19 2018-02-09 郑州云海信息技术有限公司 一种基于容器的恶意代码检测沙盒系统及检测方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11811910B2 (en) 2018-08-03 2023-11-07 Huawei Cloud Computing Technologies Co., Ltd. Blockchain maintenance method and apparatus, server, and computer-readable storage medium
CN111221625A (zh) * 2019-12-31 2020-06-02 北京健康之家科技有限公司 文件检测方法、装置及设备
CN111221625B (zh) * 2019-12-31 2023-08-04 北京水滴科技集团有限公司 文件检测方法、装置及设备
CN113761537A (zh) * 2021-07-29 2021-12-07 苏州浪潮智能科技有限公司 一种防范容器逃逸的方法、系统、设备、存储介质

Also Published As

Publication number Publication date
US20200410089A1 (en) 2020-12-31
EP3761198A1 (en) 2021-01-06
EP3761198B1 (en) 2023-07-26
WO2019174193A1 (zh) 2019-09-19
US11989283B2 (en) 2024-05-21
EP3761198A4 (en) 2021-04-28
CN111819556A (zh) 2020-10-23
CN111819556B (zh) 2024-04-09

Similar Documents

Publication Publication Date Title
WO2019174048A1 (zh) 容器逃逸检测方法、装置、系统及存储介质
US11870811B2 (en) Trusted execution security policy platform
KR102301721B1 (ko) 다수의 네트워크 종점들을 보호하기 위한 듀얼 메모리 인트로스펙션
RU2645268C2 (ru) Сложное классифицирование для выявления вредоносных программ
US11222123B2 (en) Securing privileged virtualized execution instances from penetrating a virtual host environment
US9596257B2 (en) Detection and prevention of installation of malicious mobile applications
RU2568295C2 (ru) Система и способ временной защиты операционной системы программно-аппаратных устройств от приложений, содержащих уязвимости
JP2019512791A (ja) クラウド環境における動的かつ一時的な仮想マシンインスタンスの保護
EP3474174B1 (en) System and method of adapting patterns of dangerous behavior of programs to the computer systems of users
US20180026986A1 (en) Data loss prevention system and data loss prevention method
WO2021121382A1 (en) Security management of an autonomous vehicle
US9894045B1 (en) Determining application reputation based on deviations in security rating scores
VS et al. Container security: precaution levels, mitigation strategies, and research perspectives
RU2708355C1 (ru) Способ обнаружения вредоносных файлов, противодействующих анализу в изолированной среде
CN110889112A (zh) 一种基于白名单机制的软件运行统一控制系统及方法
US11449610B2 (en) Threat detection system
US10089261B2 (en) Discriminating dynamic connection of disconnectable peripherals
RU2583709C2 (ru) Система и способ устранения последствий заражения виртуальных машин
CN116566633A (zh) 攻击行为防御方法、装置、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18909438

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18909438

Country of ref document: EP

Kind code of ref document: A1