Retrospective detection of malware attacks by cloud computing

Abstract

As malware becomes pervasive and fast-evolving on the Internet, every computer linking to the outer world faces the risks of malware attacks. Therefore, it is important to not only detect malware as early as possible but also to determine which computer has been attacked. Among the various methods to find and trace the existence of malware, retrospective detection is promising one. Once a threat is identified, it allows one to determine exactly which host or users open similar files by searching historical information. In the past, the huge volume of historical information represents an insurmountable barrier to such traces. Fortunately, with the evolution of cloud computing technologies, this barrier can be broken. In this paper, we propose a new retrospective detection approach based on Portable Executable (PE) format file relationships. We implement our system in a Hadoop platform and use 18 real-world malware to do effective and efficient tests. Our results show that our system has a higher detection rate as well as a lower false positive rate than the famous Splunk tool. We also find that, although cloud computing is suitable for processing a small number of huge files, it has shortcomings in dealing with a large number of small files.

Cloud Computing Security: A Survey

“…Other widely used DDoS countermeasures are firewalls. However, due to firewall location (at the border of a network), it would not be able to detect distributed attacks once they are in the network [50].…”

A Cloud-Based Anti-Malware Solution

“…(2) Availability of toolkits that facilitate generation of new variants given a malware instance with the minimum programming experience [5], [11], (3) Attackers interest in exploiting the abundant strategies and tools created to protect programs and software developer's copyrights (e.g., Packing, and obfuscation) to evade the detection of their assaults. [6], (4) Funded organizations and forums to train novices and advanced attackers how to create attacks, exploit vulnerabilities in targeted victim's machine, and avoid detection mechanisms. Those and many other causes resulted in exponential increase in the number of newly created malware.…”

“…Signature can be the file name, the file size, the file digest or a combination of them. Sometimes it may be rule-based detection policy [6], [2]. The second solution is behaviour based systems.…”

“…The motivation behind this solution is the possibility to generate variants of the given exploit by modifying it. Such kinds of modifications include but not limited to obfuscation, changing file name, packing PE format files and applying some code optimization attitudes [6], [4]. During the second half of 2006, Microsoft found more than 45,000 new variants of backdoors, trojans, and bots [8].…”

“…The second one aims to extend the services of traditional anti-malware solutions by integrating them as cloud services. In this work we focus on the second group who are motivated by the opportunities that cloud can provide to the malware detector, such as solving the problems of constrained resources machines, minimizing the wasted network resources, providing in-time protection, minimizing the vulnerability window, and facilitating forensics & retrospective detection [10], [9], [6].…”