Watson, M, Shirazi, N-U-H, Marnerides, A, Mauthe, A and Hutchison, D (2015) Malware Detection in Cloud Computing Infrastructures. IEEE Transactions on Dependable and Secure Computing. ISSN 1545-5971

Preview

Text malware-detection-with-minor-changes.pdf - Accepted Version Download (5MB) | Preview

Abstract

Cloud services are prominent within the private, public and commercial domains. Many of these services are expected to be always on and have a critical nature; therefore, security and resilience are increasingly important aspects. In order to remain resilient, a cloud needs to possess the ability to react not only to known threats, but also to new challenges that target cloud infrastructures. In this paper we introduce and discuss an online cloud anomaly detection approach, comprising dedicated detection components of our cloud resilience architecture. More specifically, we exhibit the applicability of novelty detection under the one-class support Vector Machine (SVM) formulation at the hypervisor level, through the utilisation of features gathered at the system and network levels of a cloud node. We demonstrate that our scheme can reach a high detection accuracy of over 90% whilst detecting various types of malware and DoS attacks. Furthermore, we evaluate the merits of considering not only system-level data, but also network-level data depending on the attack type. Finally, the paper shows that our approach to detection using dedicated monitoring components per VM is particularly applicable to cloud scenarios and leads to a flexible detection system capable of detecting new malware strains with no prior knowledge of their functionality or their underlying instructions.

Index Terms—Security, resilience, invasive software, multi-agent systems, network-level security and protection.

Item Type:	Article
Additional Information:	(c) 2015 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other users, including reprinting/ republishing this material for advertising or promotional purposes, creating new collective works for resale or redistribution to servers or lists, or reuse of any copyrighted components of this work in other works.
Uncontrolled Keywords:	0803 Computer Software, 0804 Data Format, 0805 Distributed Computing
Subjects:	Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Divisions:	Computer Science & Mathematics
Publisher:	IEEE
Date Deposited:	08 Oct 2015 14:58
Last Modified:	04 Sep 2021 13:55
DOI or ID number:	10.1109/TDSC.2015.2457918
URI:	https://researchonline.ljmu.ac.uk/id/eprint/2139

View Item