LUCID DATASET

Containerization has emerged as a revolutionary technology in the software development and deployment industry. Containers offer a portable and lightweight solution that allows for packaging applications and their dependencies systematically and efficiently. In addition, containers offer faster deployment and near-native performance with isolation and security drawbacks compared to Virtual Machines. To address the security issues, scanning tools that scan containers for preexisting vulnerabilities have been developed, but they suffer from false positives. Moreover, using different scanning tools to scan the same container provides different results, which leads to inconsistencies and confusion. Limited work has been done to address these issues. This paper provides a fully functional and extensible framework named LUCID that can reduce false positives and inconsistencies provided by multiple scanning tools. We use a database-centric approach and perform query-based analysis, to pinpoint the causes for inconsistencies. Our results show that our framework can reduce inconsistencies by 70%. The framework has been tested on both Intel64/AMD64 and ARM architecture. We also create a Dynamic Classification component that can successfully classify and predict the different severity levels with an accuracy of 84%. We believe this paper will raise awareness regarding security in container technologies and enable container scanning companies to improve their tool to provide better and more consistent results.

容器化（Containerization）现已成为软件开发与部署领域的革命性技术。容器可提供轻量便携的解决方案，能够系统化且高效地封装应用程序及其依赖项。相较于虚拟机（Virtual Machines），容器具备更快的部署速度与接近原生的运行性能，但同时存在隔离与安全层面的缺陷。为解决此类安全问题，业界已开发出用于扫描容器已知漏洞的工具，但这类工具普遍存在误报问题。此外，使用不同扫描工具对同一容器进行扫描会得到迥异结果，进而引发结果不一致与认知混淆的问题。目前针对此类问题的研究仍较为有限。本文提出了一款名为LUCID的全功能且可扩展框架，旨在降低多扫描工具带来的误报率与结果不一致性。本框架采用以数据库为中心的方法，通过基于查询的分析精准定位结果不一致的根源。实验结果表明，该框架可将结果不一致性降低70%。本框架已在Intel64/AMD64与ARM架构下完成测试。此外，我们还开发了动态分类组件，该组件能够以84%的准确率成功对不同严重等级的漏洞进行分类与预测。我们认为，本文能够提升业界对容器技术安全问题的关注度，并助力容器扫描工具厂商优化其产品，以输出更优质且一致的扫描结果。