analyzer

Documentation

Index

• Variables
• type Analyzer
• type FileAnalyzer
  • func (fa *FileAnalyzer) Result() []*event.TraceEvent
  • func (fa *FileAnalyzer) Scan(container api.Container)
• type ProcAnalyzer
  • func (pa *ProcAnalyzer) Result() []*event.TraceEvent
  • func (pa *ProcAnalyzer) Scan(container api.Container)

Variables

var Group = make([]Analyzer, 0)

Types

type Analyzer

type Analyzer interface {
	Scan(container api.Container)
	Result() []*event.TraceEvent
}

type FileAnalyzer

type FileAnalyzer struct {
	// contains filtered or unexported fields
}

func (*FileAnalyzer) Result

func (fa *FileAnalyzer) Result() []*event.TraceEvent

func (*FileAnalyzer) Scan

func (fa *FileAnalyzer) Scan(container api.Container)

type ProcAnalyzer

type ProcAnalyzer struct {
	// contains filtered or unexported fields
}

ProcAnalyzer 检测容器内异常的进程

1. 隐藏进程(mount -o bind方式) -
2. 反弹shell的进程 -
3. 带有挖矿、黑客工具、可疑进程名的进程
4. 包含 Ptrace 的进程

func (*ProcAnalyzer) Result

func (pa *ProcAnalyzer) Result() []*event.TraceEvent

func (*ProcAnalyzer) Scan

func (pa *ProcAnalyzer) Scan(container api.Container)