NDLI: A Framework for Detecting Malware in Cloud by Identifying Symptoms

Content Provider	IEEE Xplore Digital Library
Author	Harrison, K. Bordbar, B. Ali, S.T.T. Dalton, C.I. Norman, A.
Copyright Year	2012
Abstract	Security is seen as one of the major challenges of the Cloud computing. Recent malware are not only becoming more sophisticated, but have also demonstrated a trend to make use of components, which can easily be distributed through the Internet to develop newer and better malware. As a result, the key problem facing Cloud security is to cope with identifying diverse sets of malware. This paper presents a method of detecting malware by identifying the symptoms of malicious behaviour as opposed to looking for the malware itself. This can be compared to the use of symptoms in human pathology, in which study of symptoms direct physicians to diagnosis of a disease or possible causes of illnesses. The main advantage of shifting the attention to the symptoms is that a wide range of malicious behaviour can result in the same set of symptoms. We propose the creation of Forensic Virtual Machines (FVM), which are mini Virtual Machines (VM) that can monitor other VMs to discover the symptoms. In this paper, we shall present a framework to support the FVMs so that they collaborate with each other in identifying symptoms by exchanging messages via secure channels. The FVMs report to a Command & Control module that collects and correlates the information so that suitable remedial actions can take place in real-time. The Command & Control can be compared to the physician who infers possibility of an illness from the occurring symptoms. In addition, as FVMs make use of the computational resources of the system we will present an algorithm for sharing of the FVMs so that they can be guided to search for the symptoms in the VMs with higher priority.
Starting Page	164
Ending Page	172
File Size	397051
Page Count	9
File Format	PDF
ISBN	9781467324441
ISSN	15417719
DOI	10.1109/EDOC.2012.27
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2012-09-10
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Malware Virtual machining Algorithm design and analysis Monitoring Software Linux virtualisation Cloud security
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Malware Virtualization-Resistant Behavior Detection

A Novel Architecture for Self-Propagating Malicious Software within Cloud Infrastructures

A framework for detecting malware in cloud by identifying symptoms.

Dynamic malware detection and recording using virtual machine introspection

A Security Management Architecture for the Protection of Kernel Virtual Machines

Detecting anomalies in IaaS environments through virtual machine host system call analysis

Design and prototyping of framework for automated continuous malware collection and analysis

Understanding threats in a cloud infrastructure with no hypervisor

Efficient Discovery of Malicious Symptoms in Clouds via Monitoring Virtual Machines

A Framework for Detecting Malware in Cloud by Identifying Symptoms

Similar Documents

Malware Virtualization-Resistant Behavior Detection

A Novel Architecture for Self-Propagating Malicious Software within Cloud Infrastructures

A framework for detecting malware in cloud by identifying symptoms.

Dynamic malware detection and recording using virtual machine introspection

A Security Management Architecture for the Protection of Kernel Virtual Machines

Detecting anomalies in IaaS environments through virtual machine host system call analysis

Design and prototyping of framework for automated continuous malware collection and analysis

Understanding threats in a cloud infrastructure with no hypervisor

Efficient Discovery of Malicious Symptoms in Clouds via Monitoring Virtual Machines

A Framework for Detecting Malware in Cloud by Identifying Symptoms