Granted Patent B2

US 12,705,346 · App. 19/106,588 · Granted Aug 11, 2026

Inventors: Chen Zhang (Beijing, CN); Jianxin Guo (Beijing, CN)

Assignee: BEIJING VOLCANO ENGINE TECHNOLOGY CO., LTD.

G06F21/554G06F9/45558G06F18/24323G06F2009/45587

Abstract

Claims (96)

1 . A method for detecting intrusion of a container environment, comprising:

for a real-time system event of a target container, performing, by calling an event recognition model corresponding to the target container, event recognition on the real-time system event, wherein the event recognition model is constructed based on a historical normal system event of the target container, and is configured to recognize whether the real-time system event in the target container belongs to a normal system event; and

in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, and determining whether the real-time system event is an intrusion event;

wherein calling the event recognition model corresponding to the target container to perform the event recognition on the real-time system event comprises:

performing feature extraction on the real-time system event to obtain target feature information; and

calling the event recognition model corresponding to the target container to determine whether a parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container; and

performing the event recognition on the real-time system event based on a determination result,

wherein the event recognition model comprises a first event recognition model and a second event recognition model, and

wherein calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing the event recognition on the real-time system event based on the determination result comprises:

inputting the target feature information and the parameter length of the real-time system event into the first event recognition model, and determining whether the parameter length of the real-time system event does not meet a parameter length of the normal system event; and

inputting the target feature information into the second event recognition model; and

determining whether the target feature information deviates from feature information of the normal system event.

2 . The method according to claim 1 ,

wherein the first event recognition model is constructed based on a parameter length of the historical normal system event of the target container, and the second event recognition model is constructed based on feature information of the historical normal system event of the target container.

3 . The method according to claim 2 , wherein the first event recognition model is configured with a predetermined mapping relationship, the predetermined mapping relationship is a mapping between a keyword corresponding to the normal system event of the target container and corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the feature information of the normal system event,

calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container comprises:

constructing a target keyword based on the target feature information;

retrieving in the predetermined mapping relationship based on the target keyword;

in response to retrieving a keyword that is identical to the target keyword in the predetermined mapping relationship, acquiring parameter length information of a normal system event corresponding to the keyword;

determining whether the parameter length of the real-time system event does not meet the parameter length of the normal system event based on the parameter length of the real-time system event and the parameter length information of the normal system event; and

in response to not retrieving the keyword that is identical to the target keyword in the predetermined mapping relationship, determining that the target feature information deviates from the normal system event.

4 . The method according to claim 1 , wherein the second event recognition model is an outlier determination model;

wherein inputting the target feature information into the second event recognition model and determining whether the target feature information deviates from the feature information of the normal system event comprises:

inputting the target feature information into the second event recognition model, and determining whether the target feature information is an outlier relative to the feature information corresponding to the normal system event; and

in response to determining that the target feature information is the outlier, determining that the target feature information deviates from the feature information of the normal system event.

5 . The method according to claim 4 , wherein the second event recognition model is an isolation forest model constructed based on the historical normal system event;

wherein inputting the target feature information into the second event recognition model, and determining whether the target feature information is the outlier relative to the feature information corresponding to the historical normal system event comprises:

constructing a matrix based on the target feature information to obtain a target feature matrix; and

matching the target feature matrix and the isolation forest model to determine whether the target feature matrix is an outlier.

6 . The method according to claim 1 , wherein performing the feature extraction on the real-time system event of the target container to obtain the target feature information comprises:

acquiring first type of attribute information and second type of attribute information from data of the real-time system event; wherein the first type of attribute information is attribute information having a fixed amount of information and a fixed pattern, and the second type of attribute information is attribute information having an unfixed amount of information or pattern;

converting the second type of attribute information to obtain derived attribute information; and

combining the first type of attribute information and the derived attribute information to obtain the target feature information.

7 . An electronic device, comprising:

at least one processor; and

a memory;

the memory storing computer-executable instructions;

the at least one processor executing the computer-executable instructions stored in the memory, to execute acts comprising:

for a real-time system event of a target container, performing, by calling an event recognition model corresponding to the target container, event recognition on the real-time system event, wherein the event recognition model is constructed based on a historical normal system event of the target container, and is configured to recognize whether the real-time system event in the target container belongs to a normal system event; and

in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, and determining whether the real-time system event is an intrusion event

wherein calling the event recognition model corresponding to the target container to perform the event recognition on the real-time system event comprises:

performing feature extraction on the real-time system event to obtain target feature information; and

calling the event recognition model corresponding to the target container to determine whether a parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container; and

performing the event recognition on the real-time system event based on a determination result,

wherein the event recognition model comprises a first event recognition model and a second event recognition model, and

wherein calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing the event recognition on the real-time system event based on the determination result comprises:

inputting the target feature information and the parameter length of the real-time system event into the first event recognition model, and determining whether the parameter length of the real-time system event does not meet a parameter length of the normal system event; and

inputting the target feature information into the second event recognition model; and

determining whether the target feature information deviates from feature information of the normal system event.

8 . The electronic device according to claim 7 ,

wherein the first event recognition model is constructed based on a parameter length of the historical normal system event of the target container, and the second event recognition model is constructed based on feature information of the historical normal system event of the target container.

9 . The electronic device according to claim 8 , wherein the first event recognition model is configured with a predetermined mapping relationship, the predetermined mapping relationship is a mapping between a keyword corresponding to the normal system event of the target container and corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the feature information of the normal system event,

calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container comprises:

constructing a target keyword based on the target feature information;

retrieving in the predetermined mapping relationship based on the target keyword;

in response to retrieving a keyword that is identical to the target keyword in the predetermined mapping relationship, acquiring parameter length information of a normal system event corresponding to the keyword;

determining whether the parameter length of the real-time system event does not meet the parameter length of the normal system event based on the parameter length of the real-time system event and the parameter length information of the normal system event; and

in response to not retrieving the keyword that is identical to the target keyword in the predetermined mapping relationship, determining that the target feature information deviates from the normal system event.

10 . The electronic device according to claim 7 , wherein the second event recognition model is an outlier determination model;

wherein inputting the target feature information into the second event recognition model and determining whether the target feature information deviates from the feature information of the normal system event comprises:

inputting the target feature information into the second event recognition model, and determining whether the target feature information is an outlier relative to the feature information corresponding to the normal system event; and

in response to determining that the target feature information is the outlier, determining that the target feature information deviates from the feature information of the normal system event.

11 . The electronic device according to claim 10 , wherein the second event recognition model is an isolation forest model constructed based on the historical normal system event;

wherein inputting the target feature information into the second event recognition model, and determining whether the target feature information is the outlier relative to the feature information corresponding to the historical normal system event comprises:

constructing a matrix based on the target feature information to obtain a target feature matrix; and

matching the target feature matrix and the isolation forest model to determine whether the target feature matrix is an outlier.

12 . The electronic device according to claim 7 , wherein performing the feature extraction on the real-time system event of the target container to obtain the target feature information comprises:

acquiring first type of attribute information and second type of attribute information from data of the real-time system event; wherein the first type of attribute information is attribute information having a fixed amount of information and a fixed pattern, and the second type of attribute information is attribute information having an unfixed amount of information or pattern;

converting the second type of attribute information to obtain derived attribute information; and

combining the first type of attribute information and the derived attribute information to obtain the target feature information.

13 . A non-transitory computer readable storage medium having computer-executable instructions stored thereon, when executing the computer-executable instructions, a processor implements acts comprising:

for a real-time system event of a target container, performing, by calling an event recognition model corresponding to the target container, event recognition on the real-time system event, wherein the event recognition model is constructed based on a historical normal system event of the target container, and is configured to recognize whether the real-time system event in the target container belongs to a normal system event; and

in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, and determining whether the real-time system event is an intrusion event;

wherein calling the event recognition model corresponding to the target container to perform the event recognition on the real-time system event comprises:

performing feature extraction on the real-time system event to obtain target feature information; and

calling the event recognition model corresponding to the target container to determine whether a parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing the event recognition on the real-time system event based on a determination result,

wherein the event recognition model comprises a first event recognition model and a second event recognition model, and

wherein calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing the event recognition on the real-time system event based on the determination result comprises:

inputting the target feature information and the parameter length of the real-time system event into the first event recognition model, and determining whether the parameter length of the real-time system event does not meet a parameter length of the normal system event; and

inputting the target feature information into the second event recognition model; and

determining whether the target feature information deviates from feature information of the normal system event.

14 . The non-transitory computer readable storage medium according to claim 13 ,

wherein the first event recognition model is constructed based on a parameter length of the historical normal system event of the target container, and the second event recognition model is constructed based on feature information of the historical normal system event of the target container.

15 . The non-transitory computer readable storage medium according to claim 14 , wherein the first event recognition model is configured with a predetermined mapping relationship, the predetermined mapping relationship is a mapping between a keyword corresponding to the normal system event of the target container and corresponding parameter length information, and the keyword corresponding to the normal system event is constructed from the feature information of the normal system event,

calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container comprises:

constructing a target keyword based on the target feature information;

retrieving in the predetermined mapping relationship based on the target keyword;

in response to retrieving a keyword that is identical to the target keyword in the predetermined mapping relationship, acquiring parameter length information of a normal system event corresponding to the keyword;

determining whether the parameter length of the real-time system event does not meet the parameter length of the normal system event based on the parameter length of the real-time system event and the parameter length information of the normal system event; and

in response to not retrieving the keyword that is identical to the target keyword in the predetermined mapping relationship, determining that the target feature information deviates from the normal system event.

16 . The non-transitory computer readable storage medium according to claim 13 , wherein the second event recognition model is an outlier determination model, wherein inputting the target feature information into the second event recognition model and determining whether the target feature information deviates from the feature information of the normal system event comprises:

inputting the target feature information into the second event recognition model, and determining whether the target feature information is an outlier relative to the feature information corresponding to the normal system event; and

in response to determining that the target feature information is the outlier, determining that the target feature information deviates from the feature information of the normal system event.

17 . The non-transitory computer readable storage medium according to claim 16 , wherein the second event recognition model is an isolation forest model constructed based on the historical normal system event, wherein inputting the target feature information into the second event recognition model, and determining whether the target feature information is the outlier relative to the feature information corresponding to the historical normal system event comprises:

constructing a matrix based on the target feature information to obtain a target feature matrix; and

matching the target feature matrix and the isolation forest model to determine whether the target feature matrix is the outlier.

Assignments (2)

Priority Claims (1)

Continuity (1)

References Cited (54)