Malware detection in the cloud under Ensemble Empirical Mode Decomposition

Marnerides, Angelos K.; Spachos, Petros; Chatzimisios, Periklis; Mauthe, Andreas

doi:10.1109/iccnc.2015.7069320

Cited by 21 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is due to the fact that, in the majority of cases, malware is the first point of initiation for large-scale Distributed Denial of Service (DDoS) attacks, phishing and email spamming [3], [8], mainly through the deployment of botware.…”

Section: Malware and Detection Methodsmentioning

confidence: 99%

“…In [3], [8], [9] the specific security threats and challenges introduced into clouds through the use of core virtualisation technologies are discussed. Despite the end-user benefits gained by virtualisation it also comes with a range of threats that include: exploits to security holes on virtual machines (e.g.…”

Section: Virtualisation and Cloud Technologiesmentioning

confidence: 99%

“…An ingress/egress CRM is also able to analyse the traffic from multiple nodes, allowing the presence of a botnet to be detected, communicated to each internal CRM, and thwarted by the SREs on each node. However, the research presented in this paper is concerned with the online detection component within the System Analysis Engine (SAE) and Network Analysis Engine (NAE), hence further details about the overall resilience architecture can be found in [4], [3], [8].…”

Section: Cloud Resilience Architecturementioning

confidence: 99%

“…The data collection and analysis tools installed on each compute node in the described testbed include libVMI 8 and Volatility 9 for real-time Virtual Machine Introspection (VMI), tcpdump 10 and CAIDA's CoralReef 11 for packet capturing and network flow summarisation. Overall, the data acquisition, feature extraction and anomaly detection performed by both the SAE and NAE components of our resilience architecture are achieved through custom software that operates on VMs in real-time at the hypervisor level of the cloud node.…”

Section: Data Collection and Feature Extractionmentioning

confidence: 99%

See 3 more Smart Citations

Malware Detection in Cloud Computing Infrastructures

Watson

Shirazi

Marnerides

et al. 2016

IEEE Trans. Dependable and Secure Comput.

Self Cite

142

View full text Add to dashboard Cite

Abstract-Cloud services are prominent within the private, public and commercial domains. Many of these services are expected to be always on and have a critical nature; therefore, security and resilience are increasingly important aspects. In order to remain resilient, a cloud needs to possess the ability to react not only to known threats, but also to new challenges that target cloud infrastructures. In this paper we introduce and discuss an online cloud anomaly detection approach, comprising dedicated detection components of our cloud resilience architecture. More specifically, we exhibit the applicability of novelty detection under the one-class support Vector Machine (SVM) formulation at the hypervisor level, through the utilisation of features gathered at the system and network levels of a cloud node. We demonstrate that our scheme can reach a high detection accuracy of over 90% whilst detecting various types of malware and DoS attacks. Furthermore, we evaluate the merits of considering not only system-level data, but also network-level data depending on the attack type. Finally, the paper shows that our approach to detection using dedicated monitoring components per VM is particularly applicable to cloud scenarios and leads to a flexible detection system capable of detecting new malware strains with no prior knowledge of their functionality or their underlying instructions.Index Terms-Security, resilience, invasive software, multi-agent systems, network-level security and protection.

show abstract

Section: Malware and Detection Methodsmentioning

confidence: 99%

Section: Virtualisation and Cloud Technologiesmentioning

confidence: 99%

Section: Cloud Resilience Architecturementioning

confidence: 99%

Section: Data Collection and Feature Extractionmentioning

confidence: 99%

See 2 more Smart Citations

Malware Detection in Cloud Computing Infrastructures

Watson

Shirazi

Marnerides

et al. 2016

IEEE Trans. Dependable and Secure Comput.

Self Cite

142

View full text Add to dashboard Cite

show abstract

“…Therefore, security and resilience are playing important roles. A number of studies have addressed aspects of cloud security [16] [17] [18] at different levels such as network, hypervisor, guest VM and Operating System (OS).…”

Section: Malware's In Virtualized Environmentmentioning

confidence: 99%

Dynamic Malware Analysis and Detection in Virtual Environment

Sujyothi¹,

Acharya²

2017

IJMECS

View full text Add to dashboard Cite

Abstract-The amount and the complexity of malicious activity increasing and evolving day by day. Typical static code analysis is futile when challenged by diverse variants. The prolog of new malware samples every day is not uncommon and the malware designed by the attackers have the ability to change as they propagate. Thus, automated dynamic malware analysis becomes a widely preferred technique for the identification of unknown malware.In this paper, an automated malware detection system is presented based on dynamic malware analysis approach. The behavior of malware is observed in the controlled environment of the popular malware analysis system. It uses the clustering and classification of embedded malware behavior reports to identify the presence of malicious behavior. Based on the experimentation and evaluation it is evident that the proposed system is able to achieve better F-measures, FPR, FNR, TPR and TNR values resulting in accurate classification leading to more efficient detection of unknown malware compared to the traditional hierarchical classification approach.

show abstract

Dynamic malware attack dataset leveraging virtual machine monitor audit data for the detection of intrusions in cloud

Melvin

Kathrine

Ilango

et al. 2021

Trans Emerging Tel Tech

View full text Add to dashboard Cite

In this new era of cloud computing, Intrusion Detection System (IDS) is very essential for the continual monitoring of computing resources for signs of compromise since the number of attack vectors and malware are in increase. Only few IDS datasets are publicly available and those available are outdated, lack cloud‐specific attacks. This article presents a novel dataset based on Virtual Machine Introspected data for the implementation of IDS in cloud. The dataset was generated from the behavioral characteristics of malware and benign sample execution traces on virtual machines using Virtual Machine Introspection (VMI) technique. A vector space model based on system call approach is applied to analyze the behavioral characteristics for the generation of proposed dataset. The purpose of this study is to compare the proposed dataset with existing datasets and evaluate the effectiveness of these datasets by applying Machine Learning (ML) algorithms with 10‐fold cross‐validation. The ML algorithms used in the experiments are C4.5, Random Forest, JRip, NaiveBayes, K‐Nearest Neighbors (KNN), and Support Vector Machine (SVM). The effectiveness of detecting intrusions using proposed dataset is promising compared with other datasets in‐terms of intrusion detection accuracy, recall value, precision, and F1‐score metrics. For example, the intrusion detection accuracy in proposed dataset is 0.11% improved than UNM dataset, 6.28% higher than ADFA dataset, and 1.88% higher than LID dataset with C4.5 algorithm. Therefore, the proposed dataset is best suitable for implementing IDS for cloud.

show abstract

Malware detection in the cloud under Ensemble Empirical Mode Decomposition

Cited by 21 publications

References 12 publications

Malware Detection in Cloud Computing Infrastructures

Malware Detection in Cloud Computing Infrastructures

Dynamic Malware Analysis and Detection in Virtual Environment

Dynamic malware attack dataset leveraging virtual machine monitor audit data for the detection of intrusions in cloud

Contact Info

Product

Resources

About