A Framework for Detecting Malware in Cloud by Identifying Symptoms
A Framework for Detecting Malware in Cloud by Identifying Symptoms
复制标题
通过识别症状来检测云中恶意软件的框架
DOI：
--
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
Andrew P. Norman
中科院分区：
文献类型：
--
作者：
K. Harrison;B. Bordbar;Syed T. T. Ali;Chris I. Dalton;Andrew P. Norman
安全性被视为云计算面临的主要挑战之一。最近的恶意软件不仅变得更加复杂，而且已经显示出利用组件的趋势，这些组件可以很容易地通过互联网分发来开发更新和更好的恶意软件。因此，云安全面临的关键问题是如何识别不同的恶意软件集。本文提出了一种通过识别恶意行为的症状来检测恶意软件的方法，而不是寻找恶意软件本身。这可以与人类病理学中对症状的使用进行比较，在人类病理学中，对症状的研究指导医生诊断一种疾病或可能的疾病原因。将注意力转移到症状上的主要好处是，范围广泛的恶意行为可能会导致相同的一组症状。我们建议创建取证虚拟机(FVM)，它是可以监控其他VM以发现症状的微型虚拟机(VM)。在本文中，我们将提出一个框架来支持FVM，以便它们通过安全通道交换消息来相互协作识别症状。FVM向命令和控制模块报告，该模块收集并关联信息，以便可以实时采取适当的补救措施。指挥与控制可以比作医生从出现的症状推断疾病的可能性。此外，由于FVM利用了系统的计算资源，我们将提出一种共享FVM的算法，以便引导它们搜索具有更高优先级的VM中的症状。
Security is seen as one of the major challenges of the Cloud computing. Recent malware are not only becoming more sophisticated, but have also demonstrated a trend to make use of components, which can easily be distributed through the Internet to develop newer and better malware. As a result, the key problem facing Cloud security is to cope with identifying diverse sets of malware. This paper presents a method of detecting malware by identifying the symptoms of malicious behaviour as opposed to looking for the malware itself. This can be compared to the use of symptoms in human pathology, in which study of symptoms direct physicians to diagnosis of a disease or possible causes of illnesses. The main advantage of shifting the attention to the symptoms is that a wide range of malicious behaviour can result in the same set of symptoms. We propose the creation of Forensic Virtual Machines (FVM), which are mini Virtual Machines (VM) that can monitor other VMs to discover the symptoms. In this paper, we shall present a framework to support the FVMs so that they collaborate with each other in identifying symptoms by exchanging messages via secure channels. The FVMs report to a Command & Control module that collects and correlates the information so that suitable remedial actions can take place in real-time. The Command & Control can be compared to the physician who infers possibility of an illness from the occurring symptoms. In addition, as FVMs make use of the computational resources of the system we will present an algorithm for sharing of the FVMs so that they can be guided to search for the symptoms in the VMs with higher priority.