Method, device, and storage medium for detecting intrusion of container environment

Abstract

A method, a device and a storage medium for detecting intrusion of a container environment. The method includes: performing event recognition on a real-time system event by calling an event recognition model corresponding to the target container, where the event recognition model is constructed based on a historical normal system event of the target container; in response to determining that the real-time system event is an abnormal system event, calling a predetermined intrusion detection rule to perform intrusion detection on the real-time system event, to determine whether the real-time system event is an intrusion event. Thus, a real-time system event that belongs to a normal system event may be filtered out, and a complete intrusion detection may be performed on the abnormal system event, thereby reducing the amount of data for intrusion detection, reducing resource occupation, and improving the performance and efficiency of the intrusion detection.