Cloud computing technology is a concept of providing dramatically scalable and virtualized resources, bandwidth, software and hardware on demand to users. Users can request cloud services via a web browser or web service. Cloud computing consists of valuable resources, such as, networks, servers, applications, storage and services with a shared network. By using cloud computing, users can save cost of hardware deployment, software licenses and system maintenance. Many security risks such as worm can interrupt cloud computing services; damage the spiteful service, application or virtual in the cloud structure. Nowadays the worm attacks are becoming more sophisticated and intelligent, makes it is harder to be detected than before. Based on the implications posed by this worm, this is the urge where this research comes in. This paper aims to build a new model to detect worm attacks in cloud computing environment based on worm signature extraction and features behavioral using dynamic analysis. Furthermore this paper presents a proof of concept on how the worm works and discusses the future challenges and the ongoing research to detect worm attacks in cloud computing efficiently.

The focus of our study is on one set of malware family known as Brontok worms. These worms have long been a huge burden to most Windows-based user platforms. A prototype of the antivirus was able to scan files and accurately detect any traces of the Brontok malware signatures in the scanned files. In this study, we developed a detection model by extracting the signatures of the Brontok worms and used an n-gram technique to break down the signatures. This process makes the task to remove redundancies between the signatures of the different types of Brontok malware easier. Hence, it was used in this study to accurately differentiate between the signatures of both malicious and normal files. During the experiment, we have successfully detected the presence of Brontok worms while correctly identifying the benign ones. The techniques employed in the experiment provided some insight on creating a good signature-based detector, which could be used to create a more credible solution that eliminates any threats of old malware that may resurface in the future.

No abstract

No abstract