Container intrusion detection and prevention system

1. A method comprising:

scanning, by a scanner, a first container, wherein the first container includes a first application;

creating, by the scanner, a first tag of the first container;

creating, by the scanner, a first set of generic rules for the first container;

packaging, by the scanner, the first tag of the first container with the first set of generic rules to form a first tuple; and

storing, by the scanner, the first tuple in an application rule registry.

2. The method of claim 1 , wherein the first set of generic rules are customized for the first container.

3. The method of claim 1 , further comprising:

scanning, by the scanner, a second container, wherein the second container includes a second application;

creating, by the scanner, a second tag of the second container;

creating, by the scanner, a second set of generic rules for the second container;

packaging, by the scanner, the second tag of the second container with the second set of generic rules to form a second tuple; and

storing, by the scanner, the second tuple in the application rule registry.

4. The method of claim 3 , wherein the second set of generic rules are customized for the second container.

5. The method of claim 1 , further comprising, in response to the scanning, generating, by the scanner, information about at least one of a type of the first application, a version of the first application, a configuration of the first application, and a dependency of the first application.

6. The method of claim 5 , wherein the scanner creates the first set of generic rules based on the information.

7. The method of claim 5 , wherein the type of the first application comprises a database server, a web-server, and a JAVA application.

8. The method of claim 6 , wherein the scanner creates the first set of generic rules by selecting, based on the information, a set of rules for the first container from a rule database, wherein the set of rules are translatable for use with a plurality of different intrusion detection systems.

9. The method of claim 1 , further comprising:

checking, by a network agent in a container system, the first tuple of the first container in the application rule registry;

determining, by the network agent, that the first tag of the first container is associated with the first set of generic rules; and

pulling, by the network agent, the first set of generic rules based on the first tag.

10. The method of claim 9 , further comprising:

determining, by the network agent, a type of an intrusion detection system (IDS) associated with the network agent;

in response to the determination, translating, by the network agent, the first set of generic rules into a set of IDS specific rules based on the determination of the type of the IDS; and

executing, by the network agent, the IDS using the set of IDS specific rules to monitor the first container to detect a malicious attack.

11. The method of claim 8 , wherein the network agent translates the first set of generic rules into the set of IDS specific rules when the first container starts executing or after the first container starts executing.

12. The method of claim 1 , further comprising:

creating, by the scanner, a first signature for the first container; and

packaging, by the scanner, the first signature of the first container in the first tuple.

13. The method of claim 12 , further comprising:

checking, by a network agent in a container system, the first tuple of the first container in the application rule registry;

determining, by the network agent, that the first tag of the first container is associated with the first signature;

pulling, by the network agent, the first signature based on the first tag; and

creating, by the network agent, a set of intrusion detection system (IDS) specific rules based on the first signature.

14. The method of claim 12 , wherein the first signature is created using a hash function.

15. The method of claim 14 , wherein the hash function uses information about at least one of a type of the first application, a version of the first application, a configuration of the first application, and a dependency of the first application as an input to the hash function.

16. The method of claim 12 , wherein the first signature comprises an encrypted message.

17. The method of claim 1 , wherein the first application is a microservice.

18. A system comprising:

a memory;

a physical processor in communication with the memory; and

a scanner executing on the physical processor to:

scan a first container, wherein the first container includes a first application;

create a first tag of the first container;

create a first set of generic rules for the first container;

package the first tag of the first container with the first set of generic rules to form a first tuple; and

store the first tuple in an application rule registry.

19. The system of claim 18 , wherein in response to the scanning the scanner generates information about at least one of a type of the first application, a version of the first application, a configuration of the first application, and a dependency of the first application, wherein the scanner creates the first set of generic rules by selecting, based on the information, a set of rules for the first container from a rule database, wherein the set of rules are translatable for use with a plurality of different intrusion detection systems.

20. A non-transitory machine readable medium storing instructions, which when executed by one or more processors in a computer system, cause the computer system to perform a method comprising:

scanning, by a scanner, a first container, wherein the first container includes a first application;

creating, by the scanner, a first tag of the first container;

creating, by the scanner, a first set of generic rules for the first container;

packaging, by the scanner, the first tag of the first container with the first set of generic rules to form a first tuple; and

storing, by the scanner, the first tuple in an application rule registry.