Seer

Abstract

Virus Scanning-as-a-Service (VSaaS) has emerged as a popular security solution for virtual cloud environments. However, existing approaches fail to scan guest memory, which can contain an emerging class of Memory-only Malware. While several host-based memory scanners are available, they are computationally less practical for cloud environments. This paper proposes SEER as an architecture for enabling Memory VSaaS for virtualized environments. SEER leverages cloud resources and technologies to consolidate and aggregate virus scanning activities to efficiently detect malware residing in memory. Specifically, SEER combines fast memory snapshotting and computation deduplication to provide practical and efficient off-host memory virus scanning. We evaluate SEER and demonstrate up to an 87% reduction in data size that must be scanned and up to 72% savings in overall scan time, compared to naively applying file-based scanning approaches. Furthermore, SEER provides a 50% reduction in scan time when using a warm cache. In doing so, SEER provides a practical solution for cloud vendors to transparently and periodically scan virtual machine memory for malware.

On Improving Antivirus Scanning Engines: Memory On-Access Scanner

“…Gionta et al (2014) provides an efficient cloud service for virtual machines' memories. Szor and Ferrie (2009) analyze memory dumps looking for malware.…”

“…For example, the AV seems to choose not to scan Only-InMemory Data. This is the kind of data that will never be written to a secondary storage such as Hard Drives (HD) Al-Saleh and Shebaro, 2016;Gionta et al, 2014). Interestingly, according to a study (Gupta et al, 2010), popular AVs do not scan data received through network into memory.…”