Method, device, and storage medium for detecting intrusion of container environment

An electronic device, comprising:

• at least one processor;
• and
• a memory;
• the memory storing computer-executable instructions;
• the at least one processor executing the computer-executable instructions stored in the memory, to execute acts comprising:
• for a real-time system event of a target container, performing, by calling an event recognition model corresponding to the target container, event recognition on the real-time system event, wherein the event recognition model is constructed based on a historical normal system event of the target container, and is configured to recognize whether the real-time system event in the target container belongs to a normal system event;
• and
• in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, and determining whether the real-time system event is an intrusion event
• wherein calling the event recognition model corresponding to the target container to perform the event recognition on the real-time system event comprises:
• performing feature extraction on the real-time system event to obtain target feature information;
• and
• calling the event recognition model corresponding to the target container to determine whether a parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container;
• and
• performing the event recognition on the real-time system event based on a determination result,
• wherein the event recognition model comprises a first event recognition model and a second event recognition model, and
• wherein calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing the event recognition on the real-time system event based on the determination result comprises:
• inputting the target feature information and the parameter length of the real-time system event into the first event recognition model, and determining whether the parameter length of the real-time system event does not meet a parameter length of the normal system event;
• and
• inputting the target feature information into the second event recognition model;
• and
• determining whether the target feature information deviates from feature information of the normal system event.

A non-transitory computer readable storage medium having computer-executable instructions stored thereon, when executing the computer-executable instructions, a processor implements acts comprising:

• for a real-time system event of a target container, performing, by calling an event recognition model corresponding to the target container, event recognition on the real-time system event, wherein the event recognition model is constructed based on a historical normal system event of the target container, and is configured to recognize whether the real-time system event in the target container belongs to a normal system event;
• and
• in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, and determining whether the real-time system event is an intrusion event;
• wherein calling the event recognition model corresponding to the target container to perform the event recognition on the real-time system event comprises:
• performing feature extraction on the real-time system event to obtain target feature information;
• and
• calling the event recognition model corresponding to the target container to determine whether a parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing the event recognition on the real-time system event based on a determination result,
• wherein the event recognition model comprises a first event recognition model and a second event recognition model, and
• wherein calling the event recognition model corresponding to the target container to determine whether the parameter length of the real-time system event and the target feature information deviate from the normal system event of the target container, and performing the event recognition on the real-time system event based on the determination result comprises:
• inputting the target feature information and the parameter length of the real-time system event into the first event recognition model, and determining whether the parameter length of the real-time system event does not meet a parameter length of the normal system event;
• and
• inputting the target feature information into the second event recognition model;
• and
• determining whether the target feature information deviates from feature information of the normal system event.