| In recent years,containers have been widely used in the industry because of their lightweight,flexible,and rapid deployment,and become the basic virtualization technology in the cloud era.However,the resource isolation mechanism of the container,kernel sharing feature,and,the open attitude of its mirror source provide convenience to users and bring huge security risks.With the gradual disclosure of container security problems such as new container vulnerabilities,container escape,and attack methods against containers,the industry has panicked over container applications in order to ensure the stability and security of its own business,and container security is feared to become a huge obstacle in the coming cloud era.Research on intrusion detection technology for container scenarios is imminent.System call traces are the most direct mapping of process behavior at the operating system level and the most granular data source in container intrusion detection.At the same time,the rapid development of deep learning has given new vitality to container intrusion detection technology based on system calls.At present,container intrusion detection still faces the following problems:(1)The system call traces generated by the container process is large and contains a lot of redundant information,which makes the accuracy of intrusion detection low and the false positive rate high.(2)There has been a lack of an effective real-time anomaly detection framework to deal with sudden attacks during the lifecycle of container processes.(3)The existing container intrusion detection methods lack sufficient robustness in practical application,and their detection performance will decrease or even fail in the face of a rapidly changing deployment environment and attack events against the model.Given the above problems,this thesis analyzes the research status of container intrusion detection technology,and conducts in-depth research on the data preprocessing and model training for system call traces,aiming to improve the intrusion detection capability in container environments based on deep learning technology and system call data,enhance the abnormal detection performance of the container,and become a strong guarantee for the safe and stable operation of the container.The main research achievements of this thesis are as follows.1.In view of the problem of the long system call trace generated by the container process,an intrusion detection model fused graph convolutional network and deep neural network.In this model,the training data is first data-enhanced to enhance the feature expression ability of the data.Then,based on the probability segmentation rule,the short sequence feature mapping of the system call is obtained,and the edge weight information is added based on the original graph representation method of the system call traces,so as to obtain the local semantic and overall graph structure joint features independent of the length of the system call traces.Finally,the model fused graph convolutional network and deep neural network are designed to obtain the features.In the experimental representation on ADFA-LD and AWSCTD datasets,the model has high intrusion detection accuracy(96.5% and 95.4%)while ensuring a low false alarm rate(3%and 4%).In addition,the experiments show that this model has better generalization.2.In order to solve the problem that the existing container intrusion detection models had poor real-time in face of burst network attacks,A real-time enhanced container anomaly detection method is proposed.Firstly,the slices and processing modules are added to the general process of container intrusion detection based on complete traces and random forest model,and the time point of model intrusion detection is brought forward by calling slicing.Then,based on the integration learning idea,the anomaly detection model of the system call segment and the complete traces are constructed respectively,and the results are organically combined,and the update feedback loop of each model is set up.Experiments on the ADFA-LD data set show that this method not only improves the accuracy of abnormal detection in the original general detection process(reached 99.3%),and realizes the early warning function of high real-time container anomaly for sudden attack activities.3.In view of the problem that the existing container intrusion detection performance decreases due to the change of the deployment environment or the attack event to the model,a robust container intrusion detection method based on multiple detection streams is proposed.Firstly,three detection streams are set up respectively based on the three formats of system calls data,and the components such as data preprocessing,model training agent,and input agent are embedded in them.Then,through the integrated judgment module,the semi-supervised learning model,unsupervised learning model and supervised learning model trained based on the system call data of three data formats are organically combined.Finally,the database update mechanism enhances the following characteristics of the model training set and the actual environment,so as to further improve the robustness of the intrusion detection method in the practical application environment.The experiments in the data set and real application environment show that the detection performance of the proposed method is almost constant in the face of data poisoning attacks,which is more robust.And,the method proposed in this thesis is also robust in the face of environmental changes. |
