Analysis of DoS attacks on Docker inter-component stdio copy

Tianyu ZHOU; Wenbo SHEN; Nanzi YANG; Jinku LI; Chenggang QIN; Wang YU

doi:10.11959/j.issn.2096-109x.2020074

您当前的位置：

首页 >

文章列表页 >

Analysis of DoS attacks on Docker inter-component stdio copy

Special Column:Network Application and Protection Technology | 更新时间：2024-06-03

- Analysis of DoS attacks on Docker inter-component stdio copy
- Chinese Journal of Network and Information Security Vol. 6, Issue 6, Pages: 45-56(2020)
- 作者机构：
  
  1. 浙江大学NGICS大平台，浙江杭州 310027
  2. 浙江大学网络空间安全学院，浙江杭州 310027
  3. 西安电子科技大学网络与信息安全学院，陕西西安710071
  4. 蚂蚁科技集团股份有限公司，浙江杭州 310000
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020074
  CLC： TP393
- Online First：2020-12，
  
  Published：15 December 2020
- 稿件说明：
移动端阅览
Tianyu ZHOU, Wenbo SHEN, Nanzi YANG, et al. Analysis of DoS attacks on Docker inter-component stdio copy[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 45-56.
DOI：

Tianyu ZHOU, Wenbo SHEN, Nanzi YANG, et al. Analysis of DoS attacks on Docker inter-component stdio copy[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 45-56. DOI： 10.11959/j.issn.2096-109x.2020074.

摘要

近年来，Docker 技术因其部署灵活、可扩展性强，获得了大规模应用。Docker 采用模块化设计，在降低开发和维护的复杂性的同时引入了针对组件间通信的拒绝服务（DoS）攻击。在Docker容器内频繁进行stdout输出会引起Docker组件消耗大量CPU，造成DoS攻击。经过分析，可发现容器实例中的stdout输出会触发Docker各个组件的goroutine，进行频繁输出复制。为系统化地找出可被DoS攻击的goroutine创建的路径，提出使用静态分析的方法来分析Docker各组件，设计并实现了Docker组件静态分析框架，最后在Docker上进行了测试，成功分析得到了34条此类路径，其中22条路径经验证，可成功被动态触发。

Abstract

In recent years

Docker has been widely deployed due to its flexibility and high scalability.However

its modular design leads to the DoS attacks on inter-component communication.A new DoS attack that outputs to stdout

causing high CPU usages among different Docker components.Analysis shows that the stdout output triggers the goroutines of Docker components.To find all goroutines setup paths

using the static analysis method to analyze the Docker components systematically was proposed.A static analysis framework was designed and implemented

and evaluated on Docker source code.The results show that static analysis framework finds 34 paths successfully

while 22 of them are confirmed by runtime verification.

关键词

Keywords

references

MERKELD . Docker:lightweight Linux containers for consistent development and deployment [J ] . Linux Journal , 2014 ( 239 ):2.

SEYFRIED S , . Resource management in Linux with control groups [C ] // Proceedings of the Linux-Kongress . 2010 .

GAO X , GU Z S , LI Z F , et al . Houdini′s escape:breaking the resource rein of Linux control groups [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . 2019 : 1073 - 1086 .

BUI T . Analysis of docker security [J ] . arXiv preprint arXiv:1501.02967 , 2015

GUPTA U . Comparison between security majors in virtual machine and Linux containers [J ] . arXiv preprint arXiv:1507.07816 , 2015

BACIS E , MUTTI S , CAPELLI S , et al . Docker policy modules:mandatory access control for docker containers [C ] // 2015 IEEE Conference on Communications and Network Security (CNS) . 2015 : 749 - 750 .

SMALLEY S , VANCE C,SALA-MON W . Implementing selinux as a linux security module [J ] . NAI Labs Report , 2001 , 1 ( 43 ):139.

COMBE T , MARTIN A , PIETRO R . To docker or not to docker:a security perspective [J ] . IEEE Cloud Computing , 2016 , 3 ( 5 ): 54 - 62 .

CHELLADHURAI J , CHELLIAH P R , KUMAR A . Securing Docker containers from denial of service (DoS) attacks [C ] // 2016 IEEE International Conference on Services Computing (SCC) . 2016 : 856 - 859 .

SHU R , GU X H , ENCK W L . A study of security vulnerabilities on docker hub [C ] // Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy . 2017 : 269 - 280 .

YASRAB R . Mitigating docker security issues [J ] . arXiv preprint arXiv:1804.05039 , 2018

JIAN Z Q , CHEN L . A defense method against docker escape attack [C ] // Proceedings of the 2017 International Conference on Cryptography,Security and Privacy . 2017 : 142 - 146 .

ROSENR , . Namespaces and cgroups,the basis of Linux containers [C ] // Proceedings of the NetDev . 2016 .

王鹃 , 胡威 , 张雨菡 , 等 . 基于Docker的可信容器 [J ] . 武汉大学学报(理学版) , 2017 , 63 ( 2 ): 102 - 108 .

WANG J , HU W , ZHANG Y H , et al . Trusted container based on Docker [J ] . Journal of Wuhan University (Natural Science Edition) , 2017 , 63 ( 2 ): 102 - 108 .

LIN X , LEI L G , WANG Y W , et al . A measurement study on linux container security:attacks and countermeasures [C ] // Proceedings of the 34th Annual Computer Security Applications Conference . 2018 : 418 - 429 .

PRABHAKARR , KUMARR . Concurrent programming with go [R ] . 2011 .

LOPES B C , AULERR . Getting started with LLVM core libraries [M ] . Packt Publishing Ltd , 2014 .

Views

691

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Automatic generation of AppArmor security policies based on large language models

Automated vulnerability discovery method for 5G core network protocol

Multi-feature fusion malware detection method based on attention and gating mechanisms

Classified risk assessment method of Android application based on multi-factor clustering selection

Android malware detection method based on deep neural network

Related Author

LIU Xing

CHEN Peng

WU Yue

QIAN Xin

LIU Shaojun

SHA Yitian

Zhilong ZHANG

Peixiang WU

Related Institution

State Grid Nanjing Power Supply Company

Nanjing Nanrui Information and Communication Technology Limited Company

College of Cryptogram Engineering,Information Engineering University

China Electronics Standardization Institute

Beijing Key Laboratory of Interconnection and Integration,School of Cyberspace Security,Beijing University of Post and Telecommunications

⁰