将容器镜像转为图像，用CNN检测恶意软件，效果优于病毒库引擎。
Malware Detection in Docker Containers: An Image is Worth a Thousand Logs
- 把容器tar包转成RGB图像，用CNN分块流式分析文件系统。
- 在3364张图像上检测出更多恶意容器，F1和召回率均超VirusTotal引擎。
- 适合容器安全、AI驱动的恶意检测研究者使用。
恶意软件检测面临混淆和多态等技术挑战，传统方法效果受限。随着容器广泛应用，恶意软件注入成为新威胁，一旦容器被攻陷，可能成为进一步攻击的入口。本文提出一种通过机器学习分析容器文件系统来识别受损容器的方法。将完整容器转换为大型RGB图像（基于tarball表示），采用卷积神经网络以流式分块方式处理。为支持实验，我们发布首个同类数据集COSOCO——包含3364张良性与受损容器的RGB图像，可在https://huggingface.co/datasets/k3ylabs/cosoco-image-dataset获取。实验表明，该方法检测出更多恶意软件，且在F1和召回率上优于所有单个及集成的VirusTotal引擎，验证了其有效性并树立了新标准。
原文摘要 · Abstract (English)
Malware detection is increasingly challenged by evolving techniques like obfuscation and polymorphism, limiting the effectiveness of traditional methods. Meanwhile, the widespread adoption of software containers has introduced new security challenges, including the growing threat of malicious software injection, where a container, once compromised, can serve as entry point for further cyberattacks. In this work, we address these security issues by introducing a method to identify compromised containers through machine learning analysis of their file systems. We cast the entire software containers into large RGB images via their tarball representations, and propose to use established Convolutional Neural Network architectures on a streaming, patch-based manner. To support our experiments, we release the COSOCO dataset--the first of its kind--containing 3364 large-scale RGB images of benign and compromised software containers at https://huggingface.co/datasets/k3ylabs/cosoco-image-dataset. Our method detects more malware and achieves higher F1 and Recall scores than all individual and ensembles of VirusTotal engines, demonstrating its effectiveness and setting a new standard for identifying malware-compromised software containers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。