Runtime detection of vulnerabilities in an application layer of software containers

Patent metadata

Field	Value
Publication number	US-10915628-B2
Application number	US-201615278700-A
Country	US
Kind code	B2
Filing date	Sep 28, 2016
Priority date	Oct 1, 2015
Publication date	Feb 9, 2021
Grant date	Feb 9, 2021

Abstract

A system and method for detecting vulnerabilities in software containers at runtime are provided. The method includes monitoring events triggered as a result of changes to an application layer of a software container; based on the monitored events, determining if at least one file has been changed; upon determination that at least one file has been changed, scanning the at least one file to detect at least one type of vulnerability; and upon determination of at least one type of known vulnerability, generating a detection event.

First claim

What is claimed is:

1. A method for detecting vulnerabilities in software containers at runtime, comprising:
monitoring events triggered as a result of changes to an application layer of a software container at the runtime, wherein the software container includes an image layer containing the application layer, wherein changes are made only to the application layer;
based on the monitored events, determining if at least one file has been changed, wherein determining if the at least one file has been changed further comprises determining when a change to a mounted volume map to a directory structure within the software container has been made;
upon determination that at least one file has been changed, scanning the at least one file to detect at least one type of vulnerability; and
upon determination of at least one type of known vulnerability, generating a detection event.

2. The method of claim 1 , further comprising:
receiving intelligence information from a plurality of sources, wherein the intelligence information includes at least definitions of known vulnerabilities.

3. The method of claim 2 , wherein scanning the at least one file to detect at least one type of vulnerability further comprises:
scanning the at least one file to identify at least one definition of the at least one type of known vulnerability defined in the intelligence information.

4. The method of claim 2 , wherein each of the plurality of sources is any one of: a common vulnerabilities and exposures database, a reputation service, and a security system.

5. The method of claim 1 , wherein the at least one type of known vulnerability includes any one of: previously known and newly discovered malware.

6. The method of claim 1 , wherein the monitored events include at least any of: filesystem events and mounted volume events.

7. The method of claim 1 , wherein the detection event includes at least one of: an identifier of the software container, a name of the at least one file, and the type of the detected vulnerability.

8. The method of claim 1 , further comprising: performing at least one mitigation action upon generation of the detection event.

9. The method of claim 8 , wherein the detection event includes at least one of: halting the software container, quarantining the software container, and quarantining the at least one file.

10. A non-transitory computer readable medium having stored thereon instructions for causing a processing system to execute a process for detecting vulnerabilities in software containers at runtime, the process comprising:
monitoring events triggered as a result of changes to an application layer of a software container at the runtime, wherein the software container includes an image layer containing the application layer, wherein changes are made only to the application layer;
based on the monitored events, determining if at least one file has been changed, wherein determining if the at least one file has been changed further comprises determining when a change to a mounted volume map to a directory structure within the software container has been made;
upon determination that at least one file has been changed, scanning the at least one file to detect at least one type of vulnerability; and
upon determination of at least one type of known vulnerability, generating a detection event.

11. A host device for detecting vulnerabilities in software containers at runtime, comprising:
a processing system; and
a memory, the memory containing instructions that, when executed by the processing system, configure the host device to:
monitor events triggered as a result of changes to an application layer of a software container at the runtime, wherein the software container includes an image layer containing the application layer, wherein changes are made only to the application layer;
based on the monitored events, determine if at least one file has been changed, wherein determining if the at least one file has been changed further comprises determining when a change to a mounted volume map to a directory structure within the software container has been made;
upon determination that at least one file has been changed, scan the at least one file to detect at least one type of vulnerability; and
upon determination of at least one type of known vulnerability, generate a detection event.

12. The host device of claim 11 , wherein the host device is further configured to:
receive intelligence information from a plurality of sources, wherein the intelligence information includes at least definitions of known vulnerabilities.

13. The host device of claim 12 , wherein the host device is further configured to:
scan the at least one file to identify at least one definition of the at least one type of known vulnerability defined in the intelligence information.

14. The host device of claim 12 , wherein each the plurality of sources is any one of: a common vulnerabilities and exposures database, a reputation service, and a security system.

15. The host device of claim 11 , wherein the at least one type of known vulnerability includes any one of: previously known and newly discovered malware.

16. The host device of claim 11 , wherein the monitored events include at least any of: filesystem events and mounted volume events.

17. The host device of claim 11 , wherein the detection event includes at least one of: an identifier of the software container, a name of the at least one file, and the type of the detected vulnerability.

18. The host device of claim 11 , wherein the host device is further configured to:
perform at least one mitigation action upon generation of the detection event.

19. The host device of claim 18 , wherein the detection event includes at least one of: halting the software container, quarantining the software container, and quarantining the at least one file.

Assignees

• Twistlock Ltd

Inventors

• Stopel Dima
• Bernstein Ben

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/564

  by virus signature recognition · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title