IP Library › Granted Patent US 12705346

Granted Patent B2

US 12705346 · App. 19/106,588 · Granted Aug 11, 2026

Method, device, and storage medium for detecting intrusion of container environment

Inventors: Chen Zhang (Beijing, CN); Jianxin Guo (Beijing, CN)

Assignee: BEIJING VOLCANO ENGINE TECHNOLOGY CO., LTD.

G06F21/554 G06F9/45558 G06F18/24323 G06F2009/45587

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12705346
App. No.: 19/106,588
Granted: Aug 11, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A method, a device and a storage medium for detecting intrusion of a container environment. The method includes: performing event recognition on a real-time system event by calling an event recognition model corresponding to the target container, where the event recognition model is constructed based on a historical normal system event of the target container; in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, to determine whether the real-time system event is an intrusion event. Thus, a real-time system event that belongs to a normal system event may be filtered out, and a complete intrusion detection may be performed on the abnormal system event, thereby reducing the amount of data for intrusion detection, reducing resource occupation, and improving the performance and efficiency of the intrusion detection.

Claims (96)

1 . A method for detecting intrusion of a container environment, comprising:

for a real-time system event of a target container, performing, by calling an event recognition model corresponding to the target container, event recognition on the real-time system event, wherein the event recognition model is constructed based on a historical normal system event of the target container, and is configured to recognize whether the real-time system event in the target container belongs to a normal system event; and

in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, and determining whether the real-time system event is an intrusion event;

wherein calling the event recognition model corresponding to the target container to perform the event recognition on the real-time system event comprises:

performing feature extraction on the real-time system event to obtain target feature information; and

calling the event recognition model corresponding to the target container to determine whether a parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container; and

performing the event recognition on the real-time system event based on a determination result,

wherein the event recognition model comprises a first event recognition model and a second event recognition model, and

wherein calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing the event recognition on the real-time system event based on the determination result comprises:

inputting the target feature information and the parameter length of the real-time system event into the first event recognition model, and determining whether the parameter length of the real-time system event does not meet a parameter length of the normal system event; and

inputting the target feature information into the second event recognition model; and

determining whether the target feature information deviates from feature information of the normal system event.

2 . The method according to claim 1 ,

wherein the first event recognition model is constructed based on a parameter length of the historical normal system event of the target container, and the second event recognition model is constructed based on feature information of the historical normal system event of the target container.

3 . The method according to claim 2 , wherein the first event recognition model is configured with a predetermined mapping relationship, the predetermined mapping relationship is a mapping between a keyword corresponding to the normal system event of the target container and corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the feature information of the normal system event,

calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container comprises:

constructing a target keyword based on the target feature information;

retrieving in the predetermined mapping relationship based on the target keyword;

in response to retrieving a keyword that is identical to the target keyword in the predetermined mapping relationship, acquiring parameter length information of a normal system event corresponding to the keyword;

determining whether the parameter length of the real-time system event does not meet the parameter length of the normal system event based on the parameter length of the real-time system event and the parameter length information of the normal system event; and

in response to not retrieving the keyword that is identical to the target keyword in the predetermined mapping relationship, determining that the target feature information deviates from the normal system event.

4 . The method according to claim 1 , wherein the second event recognition model is an outlier determination model;

wherein inputting the target feature information into the second event recognition model and determining whether the target feature information deviates from the feature information of the normal system event comprises:

inputting the target feature information into the second event recognition model, and determining whether the target feature information is an outlier relative to the feature information corresponding to the normal system event; and

in response to determining that the target feature information is the outlier, determining that the target feature information deviates from the feature information of the normal system event.

5 . The method according to claim 4 , wherein the second event recognition model is an isolation forest model constructed based on the historical normal system event;

wherein inputting the target feature information into the second event recognition model, and determining whether the target feature information is the outlier relative to the feature information corresponding to the historical normal system event comprises:

constructing a matrix based on the target feature information to obtain a target feature matrix; and

matching the target feature matrix and the isolation forest model to determine whether the target feature matrix is an outlier.

6 . The method according to claim 1 , wherein performing the feature extraction on the real-time system event of the target container to obtain the target feature information comprises:

acquiring first type of attribute information and second type of attribute information from data of the real-time system event; wherein the first type of attribute information is attribute information having a fixed amount of information and a fixed pattern, and the second type of attribute information is attribute information having an unfixed amount of information or pattern;

converting the second type of attribute information to obtain derived attribute information; and

combining the first type of attribute information and the derived attribute information to obtain the target feature information.

7 . An electronic device, comprising:

at least one processor; and

a memory;

the memory storing computer-executable instructions;

the at least one processor executing the computer-executable instructions stored in the memory, to execute acts comprising:

wherein calling the event recognition model corresponding to the target container to perform the event recognition on the real-time system event comprises:

performing feature extraction on the real-time system event to obtain target feature information; and

performing the event recognition on the real-time system event based on a determination result,

wherein the event recognition model comprises a first event recognition model and a second event recognition model, and

inputting the target feature information into the second event recognition model; and

determining whether the target feature information deviates from feature information of the normal system event.

8 . The electronic device according to claim 7 ,

9 . The electronic device according to claim 8 , wherein the first event recognition model is configured with a predetermined mapping relationship, the predetermined mapping relationship is a mapping between a keyword corresponding to the normal system event of the target container and corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the feature information of the normal system event,

constructing a target keyword based on the target feature information;

retrieving in the predetermined mapping relationship based on the target keyword;

10 . The electronic device according to claim 7 , wherein the second event recognition model is an outlier determination model;

in response to determining that the target feature information is the outlier, determining that the target feature information deviates from the feature information of the normal system event.

11 . The electronic device according to claim 10 , wherein the second event recognition model is an isolation forest model constructed based on the historical normal system event;

constructing a matrix based on the target feature information to obtain a target feature matrix; and

matching the target feature matrix and the isolation forest model to determine whether the target feature matrix is an outlier.

12 . The electronic device according to claim 7 , wherein performing the feature extraction on the real-time system event of the target container to obtain the target feature information comprises:

converting the second type of attribute information to obtain derived attribute information; and

combining the first type of attribute information and the derived attribute information to obtain the target feature information.

13 . A non-transitory computer readable storage medium having computer-executable instructions stored thereon, when executing the computer-executable instructions, a processor implements acts comprising:

wherein calling the event recognition model corresponding to the target container to perform the event recognition on the real-time system event comprises:

performing feature extraction on the real-time system event to obtain target feature information; and

wherein the event recognition model comprises a first event recognition model and a second event recognition model, and

inputting the target feature information into the second event recognition model; and

determining whether the target feature information deviates from feature information of the normal system event.

14 . The non-transitory computer readable storage medium according to claim 13 ,

15 . The non-transitory computer readable storage medium according to claim 14 , wherein the first event recognition model is configured with a predetermined mapping relationship, the predetermined mapping relationship is a mapping between a keyword corresponding to the normal system event of the target container and corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the feature information of the normal system event,

constructing a target keyword based on the target feature information;

retrieving in the predetermined mapping relationship based on the target keyword;

16 . The non-transitory computer readable storage medium according to claim 13 , wherein the second event recognition model is an outlier determination model, wherein inputting the target feature information into the second event recognition model and determining whether the target feature information deviates from the feature information of the normal system event comprises:

in response to determining that the target feature information is the outlier, determining that the target feature information deviates from the feature information of the normal system event.

17 . The non-transitory computer readable storage medium according to claim 16 , wherein the second event recognition model is an isolation forest model constructed based on the historical normal system event, wherein inputting the target feature information into the second event recognition model, and determining whether the target feature information is the outlier relative to the feature information corresponding to the historical normal system event comprises:

constructing a matrix based on the target feature information to obtain a target feature matrix; and

matching the target feature matrix and the isolation forest model to determine whether the target feature matrix is the outlier.