Docker image vulnerability inspection device and method for performing docker file analysis
View Patent ↗Provided is a docker image vulnerability inspection device, which extracts and classifies an instruction by analyzing a manifest file of a docker image, maps a file designated in the instruction to a plurality of classes, sets vulnerability of the file according to an extraction condition preset to each of the plurality of classes, and checks vulnerability of the file according to the vulnerability set to the file based on a CVE database prepared in advance.
1 . A docker image vulnerability inspection device, comprising:
an instruction extracting unit configured to extract an instruction by analyzing a manifest file of a docker image and classify the instruction according to a name of the instruction;
a file mapping unit configured to map a file designated in the instruction to a plurality of classes based on the instruction classified according to the name of the instruction;
a vulnerability setting unit configured to set vulnerability of the file mapped into the plurality of classes according to an extraction condition preset to each of the plurality of classes; and
a vulnerability checking unit configured to check the set vulnerability of the file based on a CVE database prepared in advance,
wherein the instruction extracting unit is further configured to classify the instruction extracted by analyzing the manifest file into a no-operation instruction or an operation instruction according to whether there is a no-operation symbol appearing from the name of the instruction,
wherein when the instruction extracted by analyzing the manifest file is classified into the no-operation instruction, the instruction extracting unit is further configured to classify the instruction into a base instruction showing any file of an operating system in which the docker image is executed or an additional instruction provided to create any file by the docker image, according to a name of the no-operation instruction,
wherein the file mapping unit is further configured to perform:
when the instruction is classified according to the name of the instruction into a base instruction showing any file of an operating system in which the docker image is executed, mapping the file designated in the base instruction to a base class;
when the instruction is classified according to the name of the instruction into an additional instruction provided to create any file by the docker image, mapping the file designated in the additional instruction to an additional class; and
when the instruction is classified according to the name of the instruction into an execution instruction provided to execute the file by the docker image, mapping the file designated in the execution instruction to an execution class,
wherein the vulnerability setting unit is further configured to perform:
for the file mapped to the base class, setting the vulnerability as safe;
for the file mapped to the additional class, setting the vulnerability as weak; and
for the file mapped to the execution class, when the file mapped to the execution class has a download command or a compile command, setting the vulnerability as weak,
wherein the instruction extracting unit is further configured to extract the manifest file provided in the docker image and extract at least one instruction from a history field appearing in the manifest file.
2 . The device of claim 1 ,
wherein when the instruction extracted by analyzing the manifest file is classified into the operation instruction, the instruction extracting unit is further configured to classify the instruction classified as the operation instruction into an execution instruction provided to execute any file by the docker image.
3 . A docker image vulnerability inspection method, comprising:
extracting an instruction by analyzing a manifest file of a docker image and classifying the instruction according to a name of the instruction;
mapping a file designated in the instruction to a plurality of classes based on the instruction classified according to the name of the instruction;
setting vulnerability of the file mapped into the plurality of classes according to an extraction condition preset to each of the plurality of classes; and
checking the vulnerability of the file based on a CVE database prepared in advance,
wherein the classifying the instruction comprises classifying the instruction extracted by analyzing the manifest file into a no-operation instruction or an operation instruction according to whether there is a no-operation symbol appearing from the name of the instruction,
wherein when the instruction extracted by analyzing the manifest file is classified into the no-operation instruction, the classifying the instruction further comprises classifying the instruction into a base instruction showing any file of an operating system in which the docker image is executed or an additional instruction provided to create any file by the docker image, according to a name of the no-operation instruction,
wherein the mapping the file to the plurality of classes comprises:
when the instruction is classified according to the name of the instruction into a base instruction showing any file of an operating system in which the docker image is executed, mapping the file designated in the base instruction to a base class;
when the instruction is classified according to the name of the instruction into an additional instruction provided to generate any file by the docker image, mapping the file designated in the additional instruction to an additional class; and
when the instruction is classified according to the name of the instruction into an execution instruction provided to execute the file by the docker image, mapping the file designated in the execution instruction to an execution class,
wherein the setting the vulnerability of the file comprises:
for the file mapped to the base class, setting the vulnerability as safe,
for the file mapped to the additional class, setting the vulnerability as weak, and
for the file mapped to the execution class, when the file mapped to the execution class has a download command or a compile command, setting the vulnerability as weak,
wherein the classifying the instruction comprises extracting the manifest file provided in the docker image and extracting at least one instruction from a history field appearing in the manifest file.
4 . The method of claim 3 , wherein when the instruction extracted by analyzing the manifest file is classified into the operation instruction, the classifying the instruction further comprises classifying the instruction classified as the operation instruction into an execution instruction provided to execute any file by the docker image.