Layer Identification and Dependency Analysis for Management of Images

• US 20170068676A1
• Filed: 09/08/2015
• Published: 03/09/2017
• Est. Priority Date: 09/08/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Jayachandran, Praveen, Verma, Mudit, Mann, Vijay, Nadgowda, Shripad J.
• Granted Patent: US 10,169,347 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/116 Details of conversion of file system types or formats
• CPC Class Codes: G06F 16/125 characterised by the use of retention policies retention policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/51 Indexing; Data structures therefor; Storage structures

Abstract

Methods, systems, and computer program products for software identification, dependency analysis, and manipulation of file system layers of container images are provided herein. A computer-implemented method includes extracting multiple layer files from an input image; identifying software components in each of the extracted layer files; manipulating the input image based on said identifying and user-defined parameters, wherein said manipulating comprises (i) selecting a sub-set of the layer files for retention, (ii) removing a sub-set of the layer files, and (iii) modifying one or more of the layer files selected for retention and/or inserting one or more new layer files in place of one or more of the removed layer files; and outputting a modified version of the input image that includes the sub-set of the multiple layer files selected for retention and any new layer files inserted in place of removed layer files.

Claims

1. A computer-implemented method, comprising:

extracting multiple layer files from an input image, wherein said extracting is carried out by at least one computing device;

identifying one or more software components in each of the multiple extracted layer files, wherein said identifying is carried out by the at least one computing device;

manipulating the input image based on said identifying and one or more user-defined parameters, wherein said manipulating comprises (i) selecting a sub-set of one or more of the multiple layer files for retention, (ii) removing a sub-set of one or more of the multiple layer files, and (iii) modifying one or more of the layer files selected for retention and/or inserting one or more new layer files in place of one or more of the removed layer files, wherein said manipulating is carried out by the at least one computing device; and

outputting a modified version of the input image subsequent to said manipulating, wherein said modified version of the input image includes the sub-set of one or more of the multiple layer files selected for retention and any new layer files inserted in place of one or more of the removed layer files, wherein said outputting is carried out by the at least one computing device.

2. The method of claim 1, wherein said input image is selected from a containerization platform repository.

3. The method of claim 1, wherein (i) said extracting, (ii) said identifying, (iii) said manipulating, and (iv) said outputting are carried out offline.

4. The method of claim 1, comprising:

displaying the one or more software components identified in each of the multiple extracted layer files.

5. The method of claim 4, wherein said displaying comprises displaying the one or more software components identified in each of the multiple extracted layer files in chronological fashion.

6. The method of claim 4, wherein said manipulating comprises enabling a user to carry out said manipulating subsequent to said displaying.

7. The method of claim 1, wherein said identifying comprises:

a first technique comprising using multiple pre-defined tags and/or multiple pre-defined patterns for one or more known software components to identify one or more of the multiple pre-defined tags and/or one or more of the multiple pre-defined patterns in one or more of the multiple extracted layer files;

a second technique comprising;

processing each word in each of the multiple extracted layer file names;

constructing a word cloud that measures a frequency of occurrence of each unique word across the multiple extracted layer file names; and

identifying a pre-determined number of most frequently used words across the multiple extracted layer file names as software components;

a third technique comprising determining a difference in package manager log files between two successive layer files from the multiple extracted layer files, across all of the multiple extracted layer files; and

a fourth technique comprising analyzing each of multiple commands that were used to create each of the multiple extracted layer files.

8. The method of claim 7, comprising:

combining (i) a result of the first technique, (ii) a result of the second technique, (iii) a result of the third technique, and (iv) a result of the fourth technique to generate an output identifying the one or more software components in each of the multiple extracted layer files.

9. The method of claim 8, wherein said combining comprises applying a discrete weight to each of (i) the result of the first technique, (ii) the result of the second technique, (iii) the result of the third technique, and (iv) the result of the fourth technique.

10. The method of claim 1, wherein said identifying comprises generating a dependency graph between multiple software components across the multiple extracted layer files.

11. The method of claim 10, wherein said generating the dependency graph is based on static analysis of the multiple extracted layer files.

12. The method of claim 10, wherein said generating the dependency graph is based on run-time analysis of process dependencies across the multiple extracted layer files.

13. The method of claim 10, wherein said generating the dependency graph is based on expert annotation of one or more dependencies across the multiple extracted layer files.

14. The method of claim 1, comprising:

analyzing each of the one or more software components identified in each of the multiple extracted layer files for one or more pre-determined vulnerabilities.

15. The method of claim 1, comprising:

analyzing each of the one or more software components identified in each of the multiple extracted layer files for the presence of malware.

16. A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a device to cause the device to:

extract multiple layer files from an input image;

identify one or more software components in each of the multiple extracted layer files;

manipulate the input image based on said identifying and one or more user-defined parameters, wherein said manipulating comprises (i) selecting a sub-set of one or more of the multiple layer files for retention, (ii) removing a sub-set of one or more of the multiple layer files, and (iii) modifying one or more of the layer files selected for retention and/or inserting one or more new layer files in place of one or more of the removed layer files; and

output a modified version of the input image subsequent to said manipulating, wherein said modified version of the input image includes the sub-set of one or more of the multiple layer files selected for retention and any new layer files inserted in place of one or more of the removed layer files.

17. A system comprising:

a memory; and

at least one processor coupled to the memory and configured for;

extracting multiple layer files from an input image;

identifying one or more software components in each of the multiple extracted layer files;

manipulating the input image based on said identifying and one or more user-defined parameters, wherein said manipulating comprises (i) selecting a sub-set of one or more of the multiple layer files for retention, (ii) removing a sub-set of one or more of the multiple layer files, and (iii) modifying one or more of the layer files selected for retention and/or inserting one or more new layer files in place of one or more of the removed layer files; and

outputting a modified version of the input image subsequent to said manipulating, wherein said modified version of the input image includes the sub-set of one or more of the multiple layer files selected for retention and any new layer files inserted in place of one or more of the removed layer files.

18. A computer-implemented method, comprising:

extracting multiple layer files from an input image, wherein said extracting is carried out by at least one computing device;

identifying one or more software components in each of the multiple extracted layer files, wherein said identifying is carried out by the at least one computing device;

determining a version identifier associated with each of the one or more software components identified in each of the multiple extracted layer files, wherein said determining is carried out by the at least one computing device;

manipulating the input image based on (i) said identifying, (ii) said determining, and (iii) one or more user-defined parameters, wherein said manipulating is carried out by the at least one computing device, and wherein said manipulating comprises;

selecting a sub-set of one or more of the multiple layer files for retention;

removing a sub-set of one or more of the multiple layer files; and

modifying one or more of the layer files selected for retention and/or inserting one or more new layer files in place of one or more of the removed layer files; and

outputting a modified version of the input image subsequent to said manipulating, wherein said modified version of the input image includes the sub-set of one or more of the multiple layer files selected for retention and any new layer files inserted in place of one or more of the removed layer files, wherein said outputting is carried out by the at least one computing device.

19. The method of claim 18, wherein said determining comprises:

a first technique comprising analyzing each of the multiple extracted layer files containing one or more of the identified software components to identify one or more patterns of numbers that match a pattern of numbers associated with the version identifier associated with one or more of the software components;

a second technique comprising analyzing each of the multiple extracted layer files containing one or more of the identified software components to identify a number within a pre-determined proximity to a name of one or more of the software components;

a third technique comprising determining a difference in package manager log files between two successive layer files from the multiple extracted layer files, across all of the multiple extracted layer files containing one or more of the identified software components; and

a fourth technique comprising analyzing each of multiple commands that were used to create each of the multiple extracted layer files containing one or more of the identified software components.

20. The method of claim 19, comprising:

applying a discrete weight to each of (i) a result of the first technique, (ii) a result of the second technique, (iii) a result of the third technique, and (iv) a result of the fourth technique.