论文标题
对容器图像中的安全漏洞进行分析，以进行科学数据分析
An Analysis of Security Vulnerabilities in Container Images for Scientific Data Analysis
论文作者
论文摘要
软件容器极大地促进了科学数据分析在各个平台中的部署和可重复性。但是，容器图像通常包含过时或不必要的软件包，这增加了图像中的安全漏洞数量，扩大了容器主机中的攻击表面，并为计算整个基础结构的计算基础结构带来了实质性的安全风险。本文介绍了用于科学数据分析的容器图像的脆弱性分析。我们比较了四个漏洞扫描仪获得的结果，重点是神经科学数据分析的用例，并量化了图像更新和缩小对漏洞数量的影响。我们发现用于神经科学数据分析的容器图像包含数百个漏洞，软件更新消除了大约三分之二的漏洞，并且删除未使用的软件包也有效。我们最终提出了有关如何构建漏洞减少的容器图像的建议。
Software containers greatly facilitate the deployment and reproducibility of scientific data analyses in various platforms. However, container images often contain outdated or unnecessary software packages, which increases the number of security vulnerabilities in the images, widens the attack surface in the container host, and creates substantial security risks for computing infrastructures at large. This paper presents a vulnerability analysis of container images for scientific data analysis. We compare results obtained with four vulnerability scanners, focusing on the use case of neuroscience data analysis, and quantifying the effect of image update and minification on the number of vulnerabilities. We find that container images used for neuroscience data analysis contain hundreds of vulnerabilities, that software updates remove about two thirds of these vulnerabilities, and that removing unused packages is also effective. We conclude with recommendations on how to build container images with a reduced amount of vulnerabilities.
