基于容器集群的反病毒模型

Research on Anti-virus Model Based on Container Cluster

近年来,在容器技术流行的同时,基于容器的系统也面临更多安全挑战。传统虚拟机采用反病毒软件来最大限度减少恶意软件造成的损害。然而在容器环境,目前的反病毒技术面临着业务容器耦合度高、静态资源消耗浪费的问题。为解决这些问题,提出了基于容器集群的非侵入式反病毒模型。此模型采用恶意分析、策略分离机制,实现多容器共享恶意分析服务;模型中的容器采用边车挂载策略管理模块,将业务容器和策略管理解耦;此外该模型可以进行动态行为监测,发现恶意特征,实时通知容器集群。

In recent years, with the popularity of container technology, container-based systems also face more security challenges. Traditional virtual machines use anti-virus software to minimize damage caused by malware.However, in the container environment, the current anti-virus technology faces the problems of high coupling with business containers and waste of static resources. In order to solve these problems, a non-intrusive anti-virus model based on container cluster is proposed. This model adopts the mechanism of malicious analysis and policy separation to realize multi-container sharing malicious analysis service. The container adopts the sidecar to mount the policy management module to decouple the business container and policy management. The model can perform dynamic behavior monitoring, discover malicious features, and notify container clusters in real time.