A Framework for Detecting Malware in Cloud by Identifying Symptoms

Abstract

Abstract-Security is seen as one of the major challenges of the Cloud computing. Recent malware are not only becoming more sophisticated, but has also demonstrated a trend to make use of components, which can easily be distributed through the Internet to develop newer and better malware. As a result, the key problem facing Cloud security is to cope with identifying diverse set of malwares. This paper presents a method of detecting malware by identifying the symptoms of malicious behaviour as opposed to looking for the malware itself. This can be compared to the use of symptoms in human pathology, in which study of symptoms direct physicians to diagnosis of a disease or possible causes of illnesses. The main advantage of shifting the attention to the symptoms is that a wide range of malicious behaviour can result in the same set of symptoms. We propose the creation of Forensic Virtual Machines (FVM), which are mini Virtual Machines (VM) that can monitor other VMs to discover the symptoms. In this paper, we shall present a framework to support the FVMs so that they collaborate with each other in identifying symptoms by exchanging messages via secure channels. The FVMs report to a Command & Control module that collects and correlates the information so that suitable remedial actions can take place in real-time. The Command & Control can be compared to the physician who infers possibility of an illness from the occurring symptoms. In addition, as FVMs make use of the computational resources of the system we will present an algorithm for sharing of the FVMs so that they can be guided to search for the symptoms in the VMs with higher priority.

Impact of AAB-DDoS Attacks in a Real-Time Cloud Environment and the Mitigation Strategies

“…For that, the analysis based on the type of attack is necessary i.e, for each type of attack we have to follow a particular set of steps to mitigate the probability of execution in the client machine. [23][24] [25][26] a. SYN ood attack SYN ood attacks can be prevented only by certain rewall ltering policies. Most of the SYN attacks ltering is an easy process since they will have the TCP header parameters which is common.…”

An efficient algorithm for monitoring virtual machines in clouds

“…FVMs are typically autonomous simplified VMs with limited computability and communication. This concept was more formally defined in the context of Cloud security in [16,17], where a mobility algorithm was defined for the general purpose of searching for symptoms and discovering their dangerous configurations. The mobility algorithm has become an important tool for cloud monitoring providing light way security, though it is difficult to analyze due to its complexity including security aspects.…”

Secure virtualised environment

“…Researchers are providing new techniques to counter the malware attacks [1], [2], [3], [4]; the more sophisticated malicious code is getting by using polymorphism (different encryptions of the same binary), metamorphism (different code for the same functionality), rootkit technology (enable administrator-level access) etc.…”