DAVS: Dockerfile Analysis for Container Image Vulnerability Scanning
- Authors
- Doan, Thien-Phuc; Jung, Souhwan
- Issue Date
- Feb-2022
- Publisher
- TECH SCIENCE PRESS
- Keywords
- Container security; vulnerability scanning; OCI image analysis
- Citation
- CMC-COMPUTERS MATERIALS & CONTINUA, v.72, no.1, pp.1699 - 1711
- Journal Title
- CMC-COMPUTERS MATERIALS & CONTINUA
- Volume
- 72
- Number
- 1
- Start Page
- 1699
- End Page
- 1711
- URI
- http://scholarworks.bwise.kr/ssu/handle/2018.sw.ssu/42137
- DOI
- 10.32604/cmc.2022.025096
- ISSN
- 1546-2218
- Abstract
- Container technology plays an essential role in many Information and Communications Technology (ICT) systems. However, containers face a diversity of threats caused by vulnerable packages within container images. Previous vulnerability scanning solutions for container images are inadequate. These solutions entirely depend on the information extracted from package managers. As a result, packages installed directly from the source code compilation, or packages downloaded from the repository, etc., are ignored. We introduce DAVS-A Dockerfile analysis-based vulnerability scanning framework for OCI-based container images to deal with the limitations of existing solutions. DAVS performs static analysis using file extraction based on Dockerfile information to obtain the list of Potentially Vulnerable Files (PVFs). The PVFs are then scanned to figure out the vulnerabilities in the target container image. The experimental shows the outperform of DAVS on detecting Common Vulnerabilities and Exposures (CVE) of 10 known vulnerable images compared to Clair- the most popular container image scanning project. Moreover, DAVS found that 68% of real-world container images are vulnerable from different image registries.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - College of Information Technology > ETC > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.