Dynamically adapted traffic inspection and filtering in containerized environments

Patent metadata

Field	Value
Publication number	US-10567411-B2
Application number	US-201815991528-A
Country	US
Kind code	B2
Filing date	May 29, 2018
Priority date	Oct 1, 2015
Publication date	Feb 18, 2020
Grant date	Feb 18, 2020

Abstract

A system and method for dynamically adapting traffic inspection and filtering in containerized environments. The method includes monitoring the containerized environment to identify deployment of a software container in the containerized environment; inspecting traffic redirected from the software container, wherein the inspecting includes detecting malicious activity of the software container; and filtering the traffic based on at least one filtering rule when the malicious activity is detected, wherein the at least one filtering rule is defined in a filtering profile for the software container, wherein the filtering profile is determined for the software container when a new container image of the software container is detected in the containerized environment.

First claim

What is claimed is:

1. A method for dynamic inspection and filtering in a containerized environment, comprising:
monitoring the containerized environment to identify deployment of a software container in the containerized environment;
inspecting traffic redirected from the software container, wherein the inspecting includes detecting malicious activity of the software container; and
filtering the traffic based on at least one filtering rule when the malicious activity is detected, wherein the at least one filtering rule is defined in a filtering profile for the software container, wherein the filtering profile is determined for the software container when a new container image of the software container is detected in the containerized environment.

2. The method of claim 1 , further comprising:
analyzing contents of the new container image to determine a type of application to be executed by the software container; and
determining, based on the type of application, the filtering profile for the software container.

3. The method of claim 2 , further comprising:
extracting the contents of the new container image, wherein extracting the contents of the new container image includes extracting contents of each layer of the new container image.

4. The method of claim 2 , further comprising:
creating, based on the analysis of the contents of the new container image, a runtime model for the new container image, wherein the runtime model defines expected runtime behavior for the software container executing the new container image, wherein the malicious activity is detected based further on the runtime model.

5. The method of claim 2 , further comprising:
generating, based on the analysis of the contents of the new container image, a routing rule when the deployment of the software container is identified, wherein the routing rule is for redirecting the traffic when the traffic is directed to the software container.

6. The method of claim 2 , further comprising:
determining, based on the analysis of the contents of the new container image, an application type of the new container image, wherein the malicious activity is detected based further on at least one predetermined attack signature associated with the application type.

7. The method of claim 1 , wherein the traffic is encrypted traffic, wherein inspecting the traffic further comprises:
interfacing with the software container to retrieve at least one key from the software container; and
decrypting the traffic using the retrieved at least one key.

8. The method of claim 1 , wherein the malicious activity is detected when an abnormality in execution of the software container is detected, wherein the abnormality is detected as a deviation from learned behavior of the software container.

9. The method of claim 8 , wherein the learned behavior includes at least one of: hypertext transfer protocol (HTTP) verbs, application programming interface (API) routes, and query parameters.

10. The method of claim 8 , wherein the learned behavior includes a pattern of requests and corresponding responses.

11. The method of claim 8 , wherein the learned behavior includes user interactions with the software container.

12. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for dynamic inspection and filtering in a containerized environment, the process comprising:
monitoring the containerized environment to identify deployment of a software container in the containerized environment;
inspecting traffic redirected from the software container, wherein the inspecting includes detecting malicious activity of the software container; and
filtering the traffic based on at least one filtering rule when the malicious activity is detected, wherein the at least one filtering rule is defined in a filtering profile for the software container, wherein the filtering profile is determined for the software container when a new container image of the software container is detected in the containerized environment.

13. A system for dynamic inspection and filtering, wherein the system hosts a containerized environment, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
monitor the containerized environment to identify deployment of a software container in the containerized environment;
inspect traffic redirected from the software container to the system, wherein the inspecting includes detecting malicious activity of the software container; and
filter the traffic based on at least one filtering rule when the malicious activity is detected, wherein the at least one filtering rule is defined in a filtering profile for the software container, wherein the filtering profile is determined for the software container when a new container image of the software container is detected in the containerized environment.

14. The system of claim 13 , wherein the system is further configured to:
analyze contents of the new container image to determine a type of application to be executed by the software container; and
determine, based on the type of application, the filtering profile for the software container.

15. The system of claim 14 , wherein the system is further configured to:
extract the contents of the new container image, wherein extracting the contents of the new container image includes extracting contents of each layer of the new container image.

16. The system of claim 14 , wherein the system is further configured to:
create, based on the analysis of the contents of the new container image, a runtime model for the new container image, wherein the runtime model defines expected runtime behavior for the software container executing the new container image, wherein the malicious activity is detected based further on the runtime model.

17. The system of claim 14 , wherein the system is further configured to:
generate, based on the analysis of the contents of the new container image, a routing rule when the deployment of the software container is identified, wherein the routing rule is for redirecting the traffic when the traffic is directed to the software container.

18. The system of claim 14 , wherein the system is further configured to:
determine, based on the analysis of the contents of the new container image, an application type of the new container image, wherein the malicious activity is detected based further on at least one predetermined attack signature associated with the application type.

19. The system of claim 13 , wherein the traffic is encrypted traffic, wherein the system is further configured to:
interface with the software container to retrieve at least one key from the software container; and
decrypt the traffic using the retrieved at least one key.

20. The system of claim 13 , wherein the malicious activity is detected when at least one abnormality in execution of the software container is detected.

21. The system of claim 20 , wherein the learned behavior includes at least one of: hypertext transfer protocol (HTTP) verbs, application programming interface (API) routes, and query parameters.

22. The system of claim 20 , wherein the learned behavior includes a pattern of requests and corresponding responses.

23. The system of claim 20 , wherein the learned behavior includes user interactions with the software

Assignees

• Twistlock Ltd

Inventors

• Bernstein Ben
• Morello John
• Stopel Dima
• Levin Liron
• Yanay Eran

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2221/033

  Test or assess software · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title