System and method for container assessment using sandboxing

1. A method for a software container, comprising:

instantiating the following in a sandbox of a computing device: an operating system, a Berkeley Packet Filter (BPF) virtual machine within a kernel of the operating system, and a software container;

monitoring runtime behavior events of the software container, wherein the monitoring comprises:

monitoring at least one first type of behavior of the software container by the BPF virtual machine; and

monitoring, by the kernel but outside of the BPF virtual machine, a second type of behavior of the container that is different from the at least one first type of behavior;

assigning, based on the monitoring of the at least one first type of behavior and the second type of behavior of the software container, a respective risk score to each of the runtime behavior events that is potentially malicious, each risk score indicating a likelihood that a corresponding behavior event is malicious; and

assigning an overall risk score to the software container that indicates a likelihood that the software container is malicious based on a highest severity risk score of the respective risk scores.

2. The method of claim 1 , wherein the software container is instantiated from a container image, the method comprising:

assigning, based on static image scanning of the container image, a respective container image risk score to each static scanning event of the container image that is potentially malicious, each container image risk score indicating a likelihood that a corresponding static scanning event is malicious; and

further basing said assigning the overall risk score on the container image risk scores.

3. The method of claim 2 , wherein the software container is instantiated by a container engine, the method comprising:

further monitoring runtime behavior events of the software container from outside the sandbox by reviewing a runtime behavior log file from the container engine;

wherein said assigning the overall risk score is further based on said reviewing the runtime behavior log file.

4. The method of claim 1 , wherein the kernel is a LINUX kernel and the at least one first type of behavior includes one or more of:

system calls to the LINUX kernel;

requests to utilize LINUX security hooks; and

file system requests to the LINUX kernel.

5. The method of claim 4 , wherein the second type of behavior includes network traffic behavior associated with the software container.

6. The method of claim 1 , wherein said assigning an overall risk score to the software container comprises assigning a highest severity risk score of the respective risk scores as the overall risk score.

7. The method of claim 1 , wherein the assigning of the respective risk scores and the overall risk score are performed outside of the sandbox.

8. A computing device comprising:

memory; and

a processor operatively connected to the memory, the processor configured to:

instantiate the following in a sandbox of a computing device: an operating system, a Berkeley Packet Filter (BPF) virtual machine within a kernel of the operating system, and a software container, the sandbox corresponding to a virtual machine that is different from the BPF virtual machine;

monitor runtime behavior events of the software container, wherein to monitor the runtime behavior events, the processor is configured to:

monitor at least one first type of behavior of the software container by the BPF virtual machine; and

monitor, by the kernel but outside of the BPF virtual machine, a second type of behavior of the software container that is different from the at least one first type of behavior;

assign, based on the monitoring of the at least one first type of behavior and the second type of behavior of the software container, a respective risk score to each of the runtime behavior events that is potentially malicious, each risk score indicating a likelihood that a corresponding behavior event is malicious; and

assign an overall risk score to the software container that indicates a likelihood that the software container is malicious based on a highest severity risk score of the respective risk scores.

9. The computing device of claim 8 , wherein the software container is instantiated from a container image, and the processor is configured to:

assign, based on static image scanning of the container image, a respective container image risk score to each static scanning event of the container image that is potentially malicious, each container image risk score indicating a likelihood that a corresponding static scanning event is malicious; and

further base the assignment of the overall risk score on the container image risk scores.

10. The computing device of claim 9 , wherein the software container is instantiated by a container engine and the processor is configured to:

further monitor runtime behavior events of the software container from outside the sandbox by reviewing a runtime behavior log file from the container engine; and

further base the assignment of the overall risk score on the reviewing of the log file.

11. The computing device of claim 8 , wherein the kernel is a LINUX kernel and the at least one first type of behavior includes one or more of:

system calls to the LINUX kernel;

requests to utilize LINUX security hooks; and

file system requests to the LINUX kernel.

12. The computing device of claim 11 , wherein the second type of behavior includes network traffic behavior associated with the software container.

13. The computing device of claim 8 , wherein the processor is configured to assign a highest severity risk score of the respective risk scores as the overall risk score.

14. The computing device of claim 8 , wherein the processor is configured to assign the respective risk scores and the overall risk score outside of the sandbox.