Static detection of vulnerabilities in base images of software containers

Patent metadata

Field	Value
Publication number	US-10719612-B2
Application number	US-201816222180-A
Country	US
Kind code	B2
Filing date	Dec 17, 2018
Priority date	Oct 15, 2015
Publication date	Jul 21, 2020
Grant date	Jul 21, 2020

Abstract

A system and method for detecting vulnerabilities in be images of software containers are disclosed. The method includes receiving an event indicating that at least one base image should be scanned for vulnerabilities, each base image including at least one image layer, wherein the event designates at least one source of the at least one base image, wherein the least one base image includes resources utilized to execute at least a software container; extracting contents of each image layer of each base image; scanning the extracting contents to detect at least one vulnerability; and generating a detection event, when the at least one vulnerability is detected.

First claim

What is claimed is:

1. A method for detecting vulnerabilities in base images of software containers, comprising:
receiving an event indicating a plurality of base images to be scanned for vulnerabilities, each of the plurality of base images including at least one image layer, wherein the event designates at least one source of the plurality of base images, wherein the plurality of base images includes resources utilized to execute at least a software container;
determining whether each of the plurality of base images was previously scanned, wherein determining whether each of the plurality of base images was previously scanned further comprises comparing unitary signatures generated for the plurality of base images to unitary signatures generated for at least one previously scanned base image, wherein each of the at least one previously scanned base image was previously determined to be safe;
generating a safe event for each of the plurality of base images that was previously scanned;
extracting contents of each image layer of each of the plurality of base images that was not previously scanned;
scanning the extracted contents;
generating a detection event, when the at least one vulnerability is detected during the scan; and
generating a unitary signature for each image layer of each of the plurality of base images when no vulnerability is detected during the scan.

2. The method of claim 1 , further comprising:
exporting the at least one base image from the at least one source to a host device.

3. The method of claim 1 , wherein extracting the contents of the each image layer of a base image further comprises:
reformatting the at least one base image into a data structure, wherein the data structure is a file having a standard format.

4. The method of claim 1 , wherein the at least one vulnerability includes at least any one of: malware, and a vulnerable software library installed in the at least one base image.

5. The method of claim 1 , wherein scanning to identify at least malware further comprises:
receiving intelligence information, wherein the intelligence information includes at least definitions of malwares; and
scanning the extracted contents to identify at least one definition of the at least one type of malware defined in the intelligence information.

6. The method of claim 5 , wherein scanning to identify a vulnerable software library installed in the at least one base image further comprises:
determining an identifier of each software library installed in the at least one base image; and
comparing each determined identifier against a list of vulnerable software libraries.

7. The method of claim 5 , wherein scanning to identify a vulnerable software package installed in the at least one base image further comprises:
determining an identifier of each software package installed in the at least one base image; and
comparing each determined identifier against a list of vulnerable software packages.

8. The method of claim 1 , wherein the generating the detection event further comprises:
halting a process of updating the source with the least one base image.

9. The method of claim 1 , wherein extracting the contents of each image layer of a base image further comprises:
extracting a plurality of structured layers of each of the at least one base image; and
creating a container filesystem for each of the at least one base image based on the extracted plurality of structured layers of the base image.

10. The method of claim 1 , wherein the plurality of base images that should be scanned for vulnerabilities is a plurality of first base images, further comprising:
scanning a plurality of second base images for vulnerabilities; and
generating a safe event for each of the plurality of second base images that does not contain vulnerabilities, wherein the each of the at least one previously scanned base image is one of the plurality of second base images for which a safe event is generated.

11. A system for detecting vulnerabilities in software containers at runtime, comprising:
a processing system; and
a memory, the memory containing instructions that, when executed by the processing system, configure the system to:
receive an event indicating that a plurality of base images should be scanned for vulnerabilities, each of the plurality of base images including at least one image layer, wherein the event designates at least one source of the plurality of base images, wherein the least one base image includes resources utilized to execute at least a software container;
determine whether each of the plurality of base images was previously scanned, wherein determining whether each of the plurality of base images was previously scanned further comprises comparing unitary signatures generated for the plurality of base images to unitary signatures generated for at least one previously scanned base image, wherein each of the at least one previously scanned base image was previously determined to be safe;
extract contents of each image layer of the each of the plurality of base images that was not previously scanned;
scan the extracted contents;
generate a detection event, when at least one vulnerability is detected is detected during the scan; and
generate a unitary signature for each image layer of each of the plurality of base images when no vulnerability is detected during the scan.

12. The system of claim 11 , wherein the system is further configured to:
export the at least one base image from the at least one source to a host device.

13. The system of claim 11 , wherein the system is further configured to:
reformat the at least one base image into a data structure, wherein the data structure is a file having a standard format.

14. The system of claim 11 , wherein the at least one vulnerability includes at least any one of: malware, and a vulnerable software library installed in the at least one base image.

15. The system of claim 11 , wherein the system is further configured to:
receive intelligence information, wherein the intelligence information includes at least definitions of malwares; and
scan the extracted contents to identify at least one definition of the at least one type of malware defined in the intelligence information.

16. The system of claim 15 , wherein the system is further configured to:
determine an identifier of each software library installed in the at least one base image; and
compare each determined identifier against a list of vulnerable software libraries.

17. The system of claim 16 , wherein the system is further configured to:
determine an identifier of each software package installed in the at least one base image; and
compare each determined identifier against a list of vulnerable software packages.

18. The system of claim 11 , wherein the system is further configured to:
halt a process of updating the source with the least one base image.

19. A non-transitory computer readable medium having stored thereon instructions for causing a processing system to execute a process for detecting vulnerabilities in software containers at runtime, the process comprising:
receiving an event indicating that a plurality of base images should be scanned for vulnerabilities, each of the plurality of base images including at least one image layer, wherein the event designates at least one source of the plurality of base images, wherein the plurality of base images includes resources utilized to execute at least a software container;
determining whether each of the plu

Assignees

• Twistlock Ltd

Inventors

• Stopel Dima
• Bernstein Ben

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F2221/033

  Test or assess software · CPC title