Generating containers for applications utilizing reduced sets of libraries based on risk analysis

Patent metadata

Field	Value
Publication number	US-10073974-B2
Application number	US-201615216190-A
Country	US
Kind code	B2
Filing date	Jul 21, 2016
Priority date	Jul 21, 2016
Publication date	Sep 11, 2018
Grant date	Sep 11, 2018

Abstract

A method includes analyzing a given application to determine one or more packages utilized by the given application, the one or more packages comprising a plurality of libraries, identifying a subset of the plurality of libraries utilized by the given application, determining one or more dependent libraries for each of the identified libraries in the subset, generating a given container for the given application, the given container comprising the identified libraries in the subset and the dependent libraries for each of the identified libraries, performing risk analysis for the given container including comparing a risk value calculated for the given container to a designated risk threshold, simulating one or more actions in the given container responsive to the risk value calculated for the given container exceeding the designated risk threshold, and determining whether to accept or reject the given container responsive to the risk analysis and simulated actions.

First claim

What is claimed is:

1. A method comprising:
analyzing a given application to determine one or more packages utilized by the given application, the one or more packages comprising a plurality of libraries;
identifying a subset of the plurality of libraries utilized by the given application;
determining one or more dependent libraries for each of the identified libraries in the subset;
generating a given container for the given application, the given container comprising the identified libraries in the subset and the dependent libraries for each of the identified libraries;
performing risk analysis for the given container, the risk analysis comprising comparing a risk value calculated for the given container to a designated risk threshold;
simulating one or more actions in the given container responsive to the risk value calculated for the given container exceeding the designated risk threshold; and
determining whether to accept or reject the given container responsive to the risk analysis and simulated actions;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory; and
wherein the given container comprises a reduced set of libraries relative to a default container for the given application that comprises all of the plurality of libraries in the one or more packages utilized by the given application, such that the given container at least one of: has a smaller memory footprint relative to the default container; has a faster boot time relative to the default container; and utilizes less processing power relative to the default container; and
wherein the given container provides enhanced security relative to the default container by at least one of: including less code subject to exploitation; and reducing a number of open network ports.

2. The method of claim 1 , wherein the given container comprises an operating system base image.

3. The method of claim 1 , wherein the given container comprises a virtual machine.

4. The method of claim 1 , wherein the given container comprises a portable container.

5. The method of claim 1 , wherein identifying the subset of the plurality of libraries utilized by the given application comprises analyzing source code of the given application.

6. The method of claim 1 , wherein identifying a subset of the plurality of libraries utilized by the given application comprises analyzing a binary of the given application.

7. The method of claim 1 , wherein determining the one or more dependent libraries comprises utilizing a pattern database, the pattern database comprising at least one of: one or more dependency graphs for respective ones of a plurality of libraries; and one or more dependency trees for respective ones of the plurality of libraries.

8. The method of claim 7 , wherein determining the one or more dependent libraries further comprises:
identifying one or more shared objects and one or more static objects utilized by the given application; and
utilizing the pattern database to determine dependent libraries for each of the shared objects and static objects.

9. The method of claim 7 , further comprising at least one of adding and modifying one or more dependency graphs and one or more dependency trees in the pattern database for at least one of the identified libraries.

10. The method of claim 1 , further comprising:
obtaining one or more security parameters; and
setting the designated risk threshold based on the security parameters.

11. The method of claim 10 , wherein the security parameters comprise one of more of:
an application type associated with the given application;
a criticality associated with the given application;
a risk tolerance; and
a code complexity associated with the given application.

12. The method of claim 1 , wherein simulating the one or more actions comprises determining potential risks associated with running the given application utilizing the given container without one or more of the plurality of libraries not included in the identified subset of libraries.

13. The method of claim 1 , further comprising providing one or more visualizations of a risk associated with running the given application using the given container via a risk assessment interface.

14. The method of claim 1 , wherein performing the risk analysis comprises assessing a business impact associated with the given application.

15. The method of claim 1 , wherein:
accepting the given container comprises deploying the given container; and
rejecting the given container comprises deploying the default container for the given application that includes the libraries not in the subset.

16. The method of claim 15 , wherein deploying the given container comprises deploying the given container as a software-as-a-service in one or more cloud computing environments.

17. The method of claim 1 , wherein the given container does not comprise respective ones of the plurality of libraries not in the subset.

18. A computer program product comprising a computer readable storage medium for storing computer readable program code which, when executed, causes a computer:
to analyze a given application to determine one or more packages utilized by the given application, the one or more packages comprising a plurality of libraries;
to identify a subset of the plurality of libraries utilized by the given application;
to determine one or more dependent libraries for each of the identified libraries in the subset;
to generate a given container for the given application, the given container comprising the identified libraries in the subset and the dependent libraries for each of the identified libraries;
to perform risk analysis for the given container, the risk analysis comprising comparing a risk value calculated for the given container to a designated risk threshold;
to simulate one or more actions in the given container responsive to the risk value calculated for the given container exceeding the designated risk threshold; and
to determine whether to accept or reject the given container responsive to the risk analysis and simulated actions;
wherein the given container comprises a reduced set of libraries relative to a default container for the given application that comprises all of the plurality of libraries in the one or more packages utilized by the given application, such that the given container at least one of: has a smaller memory footprint relative to the default container; has a faster boot time relative to the default container; and utilizes less processing power relative to the default container; and
wherein the given container provides enhanced security relative to the default container by at least one of: including less code subject to exploitation; and reducing a number of open network ports.

19. The computer program product of claim 18 , wherein simulating the one or more actions comprises determining potential risks associated with running the given application utilizing the given container without one or more of the plurality of libraries not included in the identified subset of libraries.

20. An apparatus comprising:
a memory; and
a processor coupled to the memory and configured:
to analyze a given application to determine one or more packages utilized by the given application, the one or more packages comprising a plurality of libraries;
to identify a subset of the plurality of libraries utilized by the given application;
to determine one or more dependent libraries for each of the identified libra

Assignees

• IBM

Inventors

• Hwang Jinho
• Pickover Clifford A
• Vukovic Maja

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title