| Existing serverless platforms generally use lightweight container technology to build the environment of program and to achieve isolation between different environments.However,there are two problems when the platform applies container technology: First,the platform needs to start the container instance frequently and quickly,but the bloat container image makes it take a lot of time to download the image when the container is started,which increases the container startup delay,and reduces the performance of Serverless platform.Second,the platform will run thousands of container instances.The bloat of the system calls of container makes the kernel loopholes in the system calls more easily exploited by attackers,which reduces the security of the Serverless platform.There have several debloating works that only use dynamic or static analysis,which cannot accurately debloat container images or system calls.Therefore,a debloat method combining dynamic and static analysis is proposed in this thesis,which accurately finds the files and system calls required by the containe,and greatly improves the accuracy of container debloating.The main contributions of this thesis can be summarized into the following two aspects:1.To solve the performance problem caused by image bloating,a container image debloating method combining dynamic and static analysis is proposed in this thesis.In terms of dynamic analysis,fanotify and ptrace techniques are used to obtain a list of files in the container runtime.In terms of static analysis,based on the file list,use static methods to analyze the dynamic segment and rodata segment of the ELF file,and obtain the files directly dependent on the ELF file.Then,based on the file lists obtained by the first two,a collaborative filtering algorithm is used to obtain files that are indirectly related to existing files in the file list.Finally,the list of files obtained by dynamic and static analysis is used as the list of files required for the container,and the image is recreated based on the list of files.In the case of the actual images,experimental results show that the number of files obtained in this paper accounts for 93.5% of the actual number of files required by the container,and the image size can be reduced to 2.7% of the original,and the startup delay of the container can be reduced to 11.1% of the original.The attack surface of the container is reduced,too.2.To solves the security problem caused by the bloating of the available system calls of the container,a system calls debloating method combining dynamic and static analysis is proposed in this thesis.In terms of dynamic analysis,ptrace technology is used to obtain a set of system calls in the container runtime.In terms of static analysis,disassembly technology is used to obtain the corresponding disassembly file for the program obtained by the container image debloating method.Based on the disassembly file,the system call set directly initiated by the program is obtained according to the ”syscall” keyword.And then according to the functions in the dynamic link libraries,the system call set indirectly initiated by the program through the dynamic link libraries is obtained.Finally,a system call blacklist is generated based on the set of system calls obtained by dynamic and static analysis.In the case of the actual images,experimental results show that this paper can reduce the number of system calls available to containers from 332 to an average of 155 per container,reducing system calls by 53%,thereby improving the security of containers. |
