Service-Oriented Computing - 15th International Conference, ICSOC 2017, Malaga, Spain, November 13-16, 2017, Proceedings
Service-Oriented Computing - 15th International Conference, ICSOC 2017, Malaga, Spain, November 13-16, 2017, Proceedings
复制标题
面向服务的计算 - 第 15 届国际会议，ICSOC 2017，西班牙马拉加，2017 年 11 月 13-16 日，会议记录
DOI：
10.1007/978-3-319-69035-3_52
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Alruhaily N
中科院分区：
文献类型：
--
作者：
Alruhaily N
传统的反病毒(AV)解决方案以大量消耗资源而闻名，限制了它们在云上的有用性。相比之下，基于云的轻量级恶意软件监控方法消耗的资源比完全恶意软件扫描通常需要的资源更少，但它们往往容易产生错误警报；限制了它们的有效性。在本文中，通过提出一种由两个保护层(即轻量级和完全恶意软件扫描)组成的优先级方法来解决这种权衡问题，以对云虚拟机(VM)进行可扩展且有效的恶意软件检测。本白皮书的新颖贡献是一种受市场启发的机制，它利用轻量级扫描仪来确定反病毒扫描过程的优先顺序，确定应该彻底扫描哪个虚拟机以及何时扫描；然后它将触发对预定义百分比的最关键虚拟机的全面恶意软件扫描。进行的评估表明，该框架提供了一种经济高效的扫描方法，同时能够确认最关键的一组VM的感染状态，从而保持较低的误警率。
Traditional anti-virus (AV) solutions are known for their considerable consumption of resources, limiting their usefulness on the cloud. In contrast, cloud-based lightweight malware monitoring approaches consume fewer resources than a full malware scan would normally require, however, they are often prone to false alarms; limiting their effectiveness. In this paper, such a trade-off is addressed by proposing a prioritisation approach, consisting of two protection layers (i.e. lightweight and full malware scanning) to conduct a scalable and effective malware inspection of the cloud Virtual Machines (VMs). The novel contribution of this paper is a market-inspired mechanism that utilises lightweight scanners to prioritise the AV scanning process, by deciding which VM should be thoroughly scanned and when; it will trigger then a full malware scan on a pre-defined percentage of the most critical VMs. The conducted evaluation shows that the framework provides a cost-effective scanning method, while being able to confirm the infection status of the most critical set of VMs; thus maintaining a low rate of false alarms.