Analyzing CNN Based Behavioural Malware Detection Techniques on Cloud IaaS

McDole, Andrew; Abdelsalam, Mahmoud; Gupta, Maanak; Mittal, Sudip

doi:10.1007/978-3-030-59635-4_5

Cited by 36 publications

(25 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In future research, there are requirements to conduct interviews of health practitioners to understand the security and privacy concerns while developing the smart hospital, and need to apply similar approach involving community residents, infrastructure developers and stakeholders to develop other components of the smart connected ecosystem. Privacy preserving deep learning [117] , [118] approaches such as collaborative deep learning or federated learning also need to be explored to train and deploy local models at the edge devices. A Blockchain-based secure DL [119] that combines DL and Blockchain to support secure collaborative DL in IoT.…”

Section: Open Challenges and Future Directionsmentioning

confidence: 99%

Future Smart Connected Communities to Fight COVID-19 Outbreak

et al. 2021

Self Cite

View full text Add to dashboard Cite

Internet of Things (IoT) has grown rapidly in the last decade and continue to develop in terms of dimension and complexity, offering wide range of devices to support diverse set of applications. With ubiquitous Internet, connected sensors and actuators, networking and communication technology along with artificial intelligence (AI), smart cyber-physical systems (CPS) provide services rendering assistance and convenience to humans in their daily lives. However, the recent outbreak of COVID-19 (also known as coronavirus) pandemic has exposed and highlighted the limitations of contemporary technological deployments especially to contain the wide spread of this disease. IoT and smart connected technologies together with data-driven applications can play a crucial role not only in the prevention, mitigation or continuous remote monitoring of patients, but also enable prompt enforcement of guidelines, rules and administrative orders to contain such future outbreaks. In this paper, we envision an IoT and data supported connected ecosystem designed for intelligent monitoring, pro-active prevention and control, and mitigation of COVID-19 and similar epidemics. We propose a gamut of synergistic applications and technology systems for various smart infrastructures including E-Health, smart home, supply chain management, transportation, and city, which will work in convergence to develop ‘pandemic-proof’ future smart communities. We also present a generalized cloud-enabled IoT implementation framework along with scientific solutions, which can be adapted and extended to deploy smart connected ecosystem scenarios using widely used Amazon Web Services (AWS) cloud infrastructures. In addition, we also implement an E-Health RPM use case scenario to demonstrate the need and practicality for smart connected communities. Finally, we highlight challenges and research directions which need thoughtful consideration and across the board cooperation among stakeholders to build resilient communities against future pandemics.

show abstract

Section: Open Challenges and Future Directionsmentioning

confidence: 99%

Future Smart Connected Communities to Fight COVID-19 Outbreak

et al. 2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…Beside the works that used traditional ML algorithms, others [13], [9], [32], [33] focused on using deep learning algorithms for online malware detection. The authors in [13] extended their work in [30] and introduced a detection method which uses a CNN model with the goal of identifying low profile malware.…”

Section: B Online Malware Detectionmentioning

confidence: 99%

“…One limitation of this work is that the authors used a shallow CNN model and didn't provide an analysis on using various CNN models. In this regards, McDole et al [32] provided a baseline analysis of using stateof-the-art CNN models including multiple ResNet [34] and DenseNet [35] models. We extend this work by providing an analysis on employing RNN.…”

Section: B Online Malware Detectionmentioning

confidence: 99%

Recurrent Neural Networks Based Online Behavioural Malware Detection Techniques for Cloud Infrastructure

et al. 2021

Self Cite

View full text Add to dashboard Cite

Several organizations are utilizing cloud technologies and resources to run a range of applications. These services help businesses save on hardware management, scalability and maintainability concerns of underlying infrastructure. Key cloud service providers (CSPs) like Amazon, Microsoft and Google offer Infrastructure as a Service (IaaS) to meet the growing demand of such enterprises. This increased utilization of cloud platforms has made it an attractive target to the attackers, thereby, making the security of cloud services a top priority for CSPs. In this respect, malware has been recognized as one of the most dangerous and destructive threats to cloud infrastructure (IaaS). In this paper, we study the effectiveness of Recurrent Neural Networks (RNNs) based deep learning techniques for detecting malware in cloud Virtual Machines (VMs). We focus on two major RNN architectures: Long Short Term Memory RNNs (LSTMs) and Bidirectional RNNs (BIDIs). These models learn the behavior of malware over time based on run-time fine-grained processes system features such as CPU, memory, and disk utilization. We evaluate our approach on a dataset of 40,680 malicious and benign samples. The process level features were collected using real malware running in an open online cloud environment with no restrictions, which is important to emulate practical cloud provider settings and also capture the true behaviour of stealth and sophisticated malware. Both our LSTM and BIDI models achieve high detection rates over 99% for different evaluation metrics. In addition, an analysis study is conducted to understand the significance of input data representations. Our results suggest that in particular cases, input ordering does have some affect on the performance of the trained RNN models.

show abstract

“…• Network features [6], [22]: such approaches rely on using network features to detect malicious traffic patterns; • System calls [3], [7], [29], [38]: approaches relying on system calls to detect particular sequences of system calls that generally used by malware; • Memory features [25], [39]: approaches using features like malicious memory access patterns to detect malware; • Hardware performance counters [5], [8]: approaches with performance counters (e.g., cache hit/miss) that detect malware; • Performance metrics [2], [18], [36], [37]: approaches using system metrics like CPU or memory utilization to model normal and malicious application behavior. We use performance metrics data and focus on features that can easily be obtained by a light-weight, on-host agent.…”

Section: A Malware Behavior Datamentioning

confidence: 99%

Knowledge Enrichment by Fusing Representations for Malware Threat Intelligence and Behavior

Piplai

Mittal

Abdelsalam

et al. 2020

2020 IEEE International Conference on Intelligence and Security Informatics (ISI)

Self Cite

View full text Add to dashboard Cite

Security engineers and researchers use their disparate knowledge and discretion to identify malware present in a system. Sometimes, they may also use previously extracted knowledge and available Cyber Threat Intelligence (CTI) about known attacks to establish a pattern. To aid in this process, they need knowledge about malware behavior mapped to the available CTI. Such mappings enrich our representations and also helps verify the information. In this paper, we describe how we retrieve malware samples and execute them in a local system. The tracked malware behavior is represented in our Cybersecurity Knowledge Graph (CKG), so that a security professional can reason with behavioral information present in the graph and draw parallels with that information. We also merge the behavioral information with knowledge extracted from the text in CTI sources like technical reports and blogs about the same malware to improve the reasoning capabilities of our CKG significantly.

show abstract

Analyzing CNN Based Behavioural Malware Detection Techniques on Cloud IaaS

Cited by 36 publications

References 26 publications

Future Smart Connected Communities to Fight COVID-19 Outbreak

Future Smart Connected Communities to Fight COVID-19 Outbreak

Recurrent Neural Networks Based Online Behavioural Malware Detection Techniques for Cloud Infrastructure

Knowledge Enrichment by Fusing Representations for Malware Threat Intelligence and Behavior

Contact Info

Product

Resources

About