| With the rapid development of computer technology,computer data to two years doubled the speed of rapid accumulation,for the efficient and rapid processing of massive data,many new technologies,new concepts were put forward one after another,big data all-in-one machine technology is one of them.Compared with the general-purpose chips,the processing speed of domestic chips is slow and the ecology is poor,which leads to the poor support of domestic chips for big data all-in-one machine.In order to realize the bending of core technology and independent security control,the big data all-in-one machine developed based on domestic chips has become a hot spot for research.In order to solve the problem of poor software ecology of domestic chips,the big data all-in-one machine with domestic chips used in this dissertation chooses Docker,which has platform-independent characteristics,to deploy applications.However,because the Docker container lacks security detection of the image at the image pulling stage,users may download and use Docker images with security risks,and there is a risk of attackers using these risks to launch attacks on the container;in addition,the security of the Docker container relies on the Linux kernel namespace and control group mechanism,which also makes it more vulnerable to external attacks compared with hardware-based virtualization technologies.In order to protect the operation of the big data all-in-one machine from external intrusions as well as to improve the security of the data in the big data all-in-one machine,this dissertation proposes a corresponding solution with the following main work:(1)To address the image security problem faced by Docker containers,this dissertation proposes a Docker image vulnerability detection and evaluation method.The method collects the image layer operating system and package information as metadata by scanning the image downloaded by users,and matches the metadata with the common vulnerability database to obtain the image vulnerability information,and then takes the collected vulnerability information as input to get the vulnerability risk score through the vulnerability evaluation system,and evaluates the overall security of the image by combining the vulnerability risk score results,and reminds or removes the image with security risks.(2)For the intrusion attack problem brought by the container’s own security mechanism,a container intrusion detection method based on host system calls is proposed.The method takes advantage of the different frequency of system calls between different attack behaviors,collects system calls generated during container operation,extracts system call features by combining sliding window and TF-IDF algorithm,and classifies them by comparing feature similarity.Through experimental verification,the method detects up to 97% of attack operations in containers and less than 4% of false positives for normal operations,which can effectively protect the running containers.(3)Combining the Docker image vulnerability detection and evaluation method with the host system call-based container intrusion detection method,this dissertation designs and implements a Docker security detection system.In order to test the performance of the system,the experimental environment is built on the domestic chip(Longxin)big data all-in-one machine,and it is verified that the system can effectively discover the risky Docker images and the running containers that are under attack. |
