| Containers are a typical representative of sandbox technology.The principle is that through virtualization at the operating system layer,a virtualized environment isolated from the outside world can be deployed at the same time.Docker is currently the most representative and widely used container technology.Compared with traditional virtual machines,the advantage of container technology is that the scheduling and allocation of hardware resources are more convenient and efficient,and the efficiency is significantly improved.However,there is a certain gap between its security,especially isolation,and traditional virtual machines,so it is facing increasing The more cyber attacks and security threats.System call analysis is a behavioral malware detection technology.This paper proposes to use the method of system call analysis to detect the abnormality of the container,and to identify the infected container in the production environment by monitoring the process system call in the container.Based on the above methods and models,this paper designs and implements a system call-based container anomaly identification system.This system is based on Docker containers.It is necessary to establish a process feature tree for the behavior of applications normally deployed and run in the container,and then test the process of the system The feature information is called and compared,and if the corresponding location cannot be found,it is determined that the behavior of the process is abnormal.The container anomaly detection system in this article mainly includes two ideas,a method based on the frequency feature of the system call sequence and a method based on the feature of the repeated subsequence.The method based on the feature of the repeated subsequence includes the Teiresias extraction algorithm and the fixed-length feature extraction method.Use these two methods to determine whether an abnormality has occurred.The two methods analyze the behavior characteristics of the system call sequence from two different dimensions.The main idea of ??identifying a test application is to first obtain its system call information,and then extract its behavioral characteristics of the above two aspects,compare it with the characteristics of the normally deployed process to determine whether an abnormality occurs,and also need to confirm the parent of the process Whether the process is located in the corresponding position of the feature tree,the purpose is to exclude some abnormal behaviors in the feature tree,such as malicious deletion,which can significantly reduce the false alarm rate.Finally,this paper verifies the effectiveness of the method based on the frequency characteristics of the system call sequence and the method based on the repeated subsequence characteristics.The experimental results show that the method is reasonable and effective.At the same time,it simulates normal behavior and malicious behavior in the actual deployed container.In order to evaluate the function of the anomaly identification system,the results show that the system performs well in identifying various anomalous applications or malicious samples. |
