Techniques for assessing container images for vulnerabilities
AssigneeOracle International Corporation
InventorOlgierd Stanislaw Pieczul
Life of this patent
Estimating the term…
Abstract
Techniques are described for assessing container images for vulnerabilities without actually scanning the container images. A vulnerability assessment system (VAS) is described that is configured to perform vulnerabilities assessment for container images. The VAS is configured to perform the vulnerability assessment without scanning the container images. In certain embodiments, the VAS calculates a vulnerability score for the container image where the vulnerability score is indicative of a probability that the container image contains a vulnerability.
Claims20
A method performed by one or more processors by executing a set of computer-readable instructions, the method comprising:
- determining, based upon metadata associated with a container image to be processed for vulnerabilities, the container image including a hierarchy of a plurality of layers;
- calculating a vulnerability score for each layer in the plurality of layers based upon scan results generated from scanning a plurality of container images for vulnerabilities at a given time;
- computing a vulnerability score for the container image based upon the vulnerability scores calculated for the plurality of layers by accessing the vulnerability scores calculated for each of the plurality of layers included in the container image, and based on a weight assigned to a position of the layer in the hierarchy of the plurality of layers;
- generating a vulnerability report for the container image, the vulnerability report including the vulnerability score for the container image;
- and
- determining whether to scan the container image based on the vulnerability report.
A system, comprising:
- one or more processors;
- and
- a non-transitory computer-readable storage medium comprising computer-executable instructions that, when executed by the processor, cause the system to perform processing comprising:
- determining, based upon metadata associated with a container image to be processed for vulnerabilities, the container image including a hierarchy of a plurality of layers;
- calculating a vulnerability score for each layer in the plurality of layers based upon scan results generated from scanning a plurality of container images for vulnerabilities at a given time;
- computing a vulnerability score for the container image based upon the vulnerability scores calculated for the plurality of layers by accessing the vulnerability scores calculated for each of the plurality of layers included in the container image, and based on a weight assigned to a position of the layer in the hierarchy of the plurality of layers;
- generating a vulnerability report for the container image, the vulnerability report including the vulnerability score for the container image;
- and
- determining whether to scan the container image based on the vulnerability report.
A non-transitory computer-readable storage medium comprising computer-executable instructions that when executed by a processor, cause the processor to perform processing comprising:
- determining, based upon metadata associated with a container image to be processed for vulnerabilities, the container image including a hierarchy of a plurality of layers;
- calculating a vulnerability score for each layer in the plurality of layers based upon scan results generated from scanning a plurality of container images for vulnerabilities at a given time;
- computing a vulnerability score for the container image based upon the vulnerability scores calculated for the plurality of layers by accessing the vulnerability scores calculated for each of the plurality of layers included in the container image, and based on a weight assigned to a position of the layer in the hierarchy of the plurality of layers;
- generating a vulnerability report for the container image, the vulnerability report including the vulnerability score for the container image;
- and
- determining whether to scan the container image based on the vulnerability report.
Dependencies are inferred from the claim text.