DocSecKG: A Systematic Approach for Building Knowledge Graph to Understand the Relationship Between Docker Image and Vulnerability

Docker’s rise in CI/CD and software development has introduced notable security vulnerabilities through the complex software packages within Docker images. The swift emergence of new vulnerabilities complicates the security maintenance of these images, further challenged by the vast array of images hosted on Docker Hub. This situation underscores a critical gap in existing security analysis tools, which lack a holistic approach to monitoring and evaluating Docker images’ security status comprehensively. To address this gap, we proposed DocSecKG, an innovative method for developing security knowledge graphs. These graphs effectively illuminate the connections among Docker images, software packages, and vulnerabilities, thereby facilitating a more profound understanding of the Docker ecosystem’s security dynamics. DocSecKG automates the process of tracking, downloading, examining, and updating Docker Hub images, thereby significantly improving the efficiency of security assessments. By applying DocSecKG to Docker Hub’s library images, we uncover pivotal security insights, providing a foundation for actionable intelligence for developers, maintainers, and users. Ultimately, our findings offer a pathway to fortify the Docker ecosystem’s security mechanisms, serving as a valuable resource for subsequent research endeavors.