Detection of Malware Attacks on Virtual Machines for a Self-Heal Approach in Cloud Computing using VM Snapshots

Abstract

Abstract-Cloud Computing strives to be dynamic as a service oriented architecture (SoA). The services in the SoA are rendered in terms of private, public and in many other commercial domain aspects. These services should be secured and thus are very vital to the cloud infrastructure. In order, to secure and maintain resilience in the cloud, it not only has to have the ability to identify the known threats but also to new challenges that target the infrastructure of a cloud. In this paper, we introduce and discuss a detection method of malwares from the VM memory snapshot analysis and the corresponding VM snapshots are classified into attacked and non-attacked VM snapshots. As snapshots are always taken to be a backup in the backup servers, this approach could reduce the overhead of the backup server with a self-healing capability of the VMs in the local cloud infrastructure itself without any compromised VM in the backup server. A machine learning approach is projected here to classify the attacked and non attacked snapshots. The features of the snapshots are gathered from the API calls of VM instances. Our proposed scheme has a high detection accuracy of about 93% while having the capability to classify and detect different types of malwares with respect to the VM snapshots. Finally the paper exhibits an algorithm using snapshots to detect and thus to selfheal. The self-healing approach with machine learning algorithms can determine new threats with some prior knowledge of its functionality.

Optimized deep learning‐based attack detection framework for secure virtualized infrastructures in cloud

“…The proposed DBN + HEMA based attack detection model in cloud was implemented in Python and the results were observed. In addition, the betterment of the proposed DBN + HEMA based attack detection was compared over other conventional models like RNN, 47 SVM, 34 KNN 48 and Naive Bayes 34 with respect to the performance metrics like “accuracy, sensitivity, specificity, precision, FPR, F‐measure Recall, and MCC.” Here, the performance analysis was carried out by varying the split ratio that ranges from 60 to 90.…”

“…In 2018, Joseph et al 34 have presented malware attacks in cloud storage utilizing VM snapshots on virtual machines for a self‐healing strategy. Since snapshots were often provided as a backup in certain backup servers, such a method would minimize the backup server overhead using the VMs' self‐healing functionality in the local cloud network themselves without compromising any VM in the backup server.…”

“…However, it has to focus on enforcing the on‐the‐fly mechanism to retrain the logistic regression classifiers. SVM algorithm was used in Reference 34 that offer more efficient, high detection accuracy, and it also had better performance. However, it has to focus more on the SVM algorithm that generates with 0 false negatives.…”

“…In Equation ( 33), A EHO n,j,z is the newly updated clan and A EHO j,z denotes the previous location of elephant z in clan j, λ 0, 1 ½ is the scaling factor, and it specifies the effect of a matriarch on j on A EHO j,z : A EHO best,j represents matriarch j with the fittest elephant individuals of clan j, r 0, 1 ½ : In each clan, the fittest elephant are not calculated using Equation (33), that is, A EHO j,z ¼ A EHO best,j : Rather, for the fittest elephant, the update process is performed as per Equation (34).…”

Cutting Edge Trends in Deception Based Intrusion Detection Systems—A Survey

“…Also, this novel approach needs further investigations in other to conclusively ascertain its advantages. Furthermore, [54] proposed an attack detection method, leveraging on Virtual Machine (VM) memory snapshot analysis. Here, an algorithm using snapshots is used to model an IDS which effectively detects malware and also has the capability to self-heal after an attack.…”