2015 International Conference on Computing, Networking and Communications (ICNC) (2015)
Garden Grove, CA, USA
Feb. 16, 2015 to Feb. 19, 2015
Angelos K. Marnerides , School of Computing & Mathematical Sciences, Liverpool John Moores University, Liverpool, UK
Petros Spachos , Department of Electrical & Computer Engineering, University of Toronto, Toronto, ON, Canada
Periklis Chatzimisios , Department of Informatics, Alexander TEI of Thessaloniki, Thessaloniki, Greece
Andreas U. Mauthe , InfoLab21, School of Computing & Communications, Lancaster University, Lancaster, UK
Cloud networks underpin most of todays' socio-economical Information Communication Technology (ICT) environments due to their intrinsic capabilities such as elasticity and service transparency. Undoubtedly, this increased dependence of numerous always-on services with the cloud is also subject to a number of security threats. An emerging critical aspect is related with the adequate identification and detection of malware. In the majority of cases, malware is the first building block for larger security threats such as distributed denial of service attacks (e.g. DDoS); thus its immediate detection is of crucial importance. In this paper we introduce a malware detection technique based on Ensemble Empirical Mode Decomposition (E-EMD) which is performed on the hypervisor level and jointly considers system and network information from every Virtual Machine (VM). Under two pragmatic cloud-specific scenarios instrumented in our controlled experimental testbed we show that our proposed technique can reach detection accuracy rates over 90% for a range of malware samples. In parallel we demonstrate the superiority of the introduced approach after comparison with a covariance-based anomaly detection technique that has been broadly used in previous studies. Consequently, we argue that our presented scheme provides a promising foundation towards the efficient detection of malware in modern virtualized cloud environments.
Malware, Virtual machine monitors, Accuracy, Measurement, Information security, Empirical mode decomposition
A. K. Marnerides, P. Spachos, P. Chatzimisios and A. U. Mauthe, "Malware detection in the cloud under Ensemble Empirical Mode Decomposition," 2015 International Conference on Computing, Networking and Communications (ICNC), Garden Grove, CA, USA, 2015, pp. 82-88.