关键词: 容器安全, Dockerfile, 安全误配置检测, 深度学习, 双流模型

Abstract: Dockerfile misconfigurations frequently lead to container security vulnerabilities.Current detection methods rely on structural analysis and semantic understanding of the text,while pay little attention to metrics such as command frequency,image layer counts,code complexity,etc.To solve this problem,a dual-stream deep learning detection approach is proposed,which integrates feature metrics with semantic comprehension.Firstly,it identifies and annotates Dockerfile samples containing security misconfigurations using static detection tools such as Hadolint and KICS.Then,by constructing abstract syntax trees,it parses and extracts code metric features and refines crucial security features using the random forest algorithm.Lastly,it extracts textual information and security feature metrics and then inputs them into a dual-stream model for detection.Bi-LSTM network is utilized to trace the forward and backward dependencies within instruction sequences,which is helpful for uncovering deep semantic associations.Transformer model is employed to create high-dimensional metric representations,which can model mappings from me-tric to security misconfiguration.CNN sublayers with ReLU activation functions are used to fuse information from both streams.Experimental results indicate that the proposed method achieves 96%,98% and 97% in precision,recall,and F1-score respectively.The proposed approach can detect security misconfiguration more accurately compared to existing approaches.

Key words: Container security,Dockerfile,Security misconfiguration detection,Deep learning,Dual-stream model