【摘要】 容器技术是目前云计算领域的主流技术之一,与虚拟机相比,容器具有启动速度快、可移植性高、扩展能力强等优势。然而,更低的资源隔离性和共享内核的特性给容器和云平台引入了新的安全风险,容易导致资源侵占、数据泄露,宿主机被劫持等问题。为实现容器云平台安全与可观测性,文章提出了一种基于无监督系统调用过滤规则生成的容器云实时异常检测系统,首先,通过无代理模式采集集群中容器的系统调用行为数据；然后,通过一种适用于系统调用数据且关注具体参数的方法在线挖掘过滤规则模板；最后,将挖掘得到的原始规则模板适配至具体规则检测引擎并更新,实现实时异常检测。实验结果表明,该系统可正确挖掘较为精确的系统调用规则模板并转换为具体检测规则,其检测效果与人工编写基本一致。更多还原

【Abstract】 Container technology is currently one of the mainstream technologies in cloud computing. Compared with virtual machines, containers have significant advantages such as fast startup, high portability, and high scalability. However, the lower resource isolation and shared kernel characteristics introduce new security risks to containers and cloud platforms,which can easily lead to serious threats such as resource appropriation, data leakage, and host hijacking. To achieve security and observability of container cloud platform, this paper proposed a container cloud real-time anomaly detection system based on unsupervised system call filtering rule generation, which collected system call behavior data of containers in the cluster through agentless mode, then mined filtering rules online through a method that applied to system call data and focuses on specific parameters, and finally adapted the original rules to specific rule engines, thus achieving real-time anomaly detection. The experimental results show that this system can correctly mine comparatively accurate syscall templates and convert them into corresponding detection rules, and the detection effect is basically consistent with manually written rules.更多还原