基于RASP技术在容器环境的内存Webshell检测研究  

Research on Memory Webshell Detection in Docker Container Based on RASP Technology

作　　者：姚纪卫 王伟 杨芳 Yao Jiwei;Wang Wei;Yang Fang(Anxinsec(Beijing)Technology Co.,Ltd,Beijing 100085)

机构地区：[1]安芯网盾(北京)科技有限公司,北京100085

出　　处：《信息安全研究》2023年第10期947-953,共7页Journal of Information Security Research

摘　　要：容器成为支撑云计算应用运行的重要载体,容器安全变得越来越重要.频繁爆出的容器安全事件让容器安全防护的研究刻不容缓,与传统的网络安全防护重视边界防护不同的是,容器安全更重视运行时和整体的安全防护.从攻防的视角出发,提出了一种针对容器环境下比较高危的攻击手段内存Webshell攻击的检测研究方法.Containers have become a vital infrastructure supporting cloud computing application execution,making container security increasingly crucial.The frequent occurrence of container security incidents has propelled the urgent need for research in container security protection.Unlike traditional host security measures that emphasize boundary defense,container security places greater emphasis on runtime and overall security protection.From an offensive and defensive standpoint,this paper proposes a detection study targeting the high-risk attack method of memory Webshell attacks in container environments.

关 键 词：运行时程序自保护 内存保护 攻击链检测与响应 内存Webshell检测 容器安全 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]