DAVS: Dockerfile Analysis for Container Image Vulnerability Scanning
Source abstract
Abstract
Container technology plays an essential role in many Information and Communications Technology (ICT) systems. However, containers face a diversity of threats caused by vulnerable packages within container images. Previous vulnerability scanning solutions for container images are inadequate. These solutions entirely depend on the information extracted from package managers. As a result, packages installed directly from the source code compilation, or packages downloaded from the repository, etc., are ignored. We introduce DAVS–A Dockerfile analysis-based vulnerability scanning framework for OCI-based container images to deal with the limitations of existing solutions. DAVS performs static analysis using file extraction based on Dockerfile information to obtain the list of Potentially Vulnerable Files (PVFs). The PVFs are then scanned to figure out the vulnerabilities in the target container image. The experimental shows the outperform of DAVS on detecting Common Vulnerabilities and Exposures (CVE) of 10 known vulnerable images compared to Clair– the most popular container image scanning project. Moreover, DAVS found that 68% of real-world container images are vulnerable from different image registries.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Security and Verification in Computing · Cloud Data Security Solutions · Advanced Data Storage Technologies
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (30)
Show source-provided references
1. Virtualization vs containerization to support PaaS
2. Container security: Issues, challenges and the road ahead10.1109/ACCESS.2019.2911732 ↗
3. Houdini's escape: Breaking the resource rein of linux control groups
4. Aquasecurity. Trivy, 2021. [Online] Available: https://github.com/aquasecurity/trivy.
5. Quay.io, Inc. Clair, 2021. [Online] Available: https://github.com/quay/clair.
6. On security measures for containerized applications imaged with docker
7. Docker. Co. Content trust in Docker, 2021. [Online] Available: https://docs.docker.com/engine/security/trust/.
8. Static vulnerability analysis of docker images10.1088/1757-899X/1131/1/012018 ↗
9. Anchore, Inc. Container security solutions for devsecops, 2021. [Online] Available: https://anchore.com/.
10. Dagda, Inc. Dagda, 2021. [Online] Available: https://kubedex.com/resource/dagda/.
11. Adethyaa · Scanning docker images for vulnerabilities using Clair amazon ECS ECR and AWS CodePipeline · 2018
12. Docker container security in cloud computing
13. An analysis of security vulnerabilities in container images for scientific data analysis10.1093/gigascience/giab025 ↗
14. A study, analysis and deep dive on cloud PaaS security in terms of docker container security
15. On the relation between outdated docker containers, severity vulnerabilities, and bugs
16. An evaluation of container security vulnerability detection tools
17. Framework to secure docker containers
18. Henriksson · Degree Project in Master of Science in Engineering · 2017
19. Wist · Advances in Security, Networks and Internet of Things · 2021 · 30710.1007/978-3-030-71017-0_22 ↗
20. Understanding the security risks of Docker hub
21. Docker. Co. What is a container? 2021. [Online] Available: https://www.docker.com/resources/what-container.
22. Buildah Co. Buildah, 2021. [Online] Available: https://buildah.io.
23. Docker. Co. Docker reference, 2021. [Online] Available: https://docs.docker.com/engine/reference/builder/.
24. Intel. Co. intel/cve-bin-tool, 2021. [Online] Available: https://github.com/intel/cve-bin-tool.
25. Vulhub. Vulhub-docker-compose file for vulnerability environment, 2021. [Online] Available: https://vulhub.org/.
26. Docker. Co. Docker hub, 2021. [Online] Available: https://hub. Docker.com/.
27. Quay.io. Quayio container image registry, 2021. [Online] Available: https://quay.io/search.
28. Towards usable cloud storage auditing10.1109/TPDS.2020.2998462 ↗
29. Secure network coding from secure proof of retrievability10.1007/s11432-020-2997-0 ↗
30. Flexible identity-based remote data integrity checking for cloud storage with privacy preserving property