Detection of malware and kernel-level rootkits in cloud computing environments

Thu Yein Win; Huaglory Tianfield; Quentin Mair

doi:10.1109/CSCloud.2015.54

Detection of malware and kernel-level rootkits in cloud computing environments

Thu Yein Win, Huaglory Tianfield, Quentin Mair

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

12 Citations (Scopus)

Abstract

Cyberattacks targeted at virtualization infrastructure underlying cloud computing services has become increasingly sophisticated. This paper presents a novel malware and rookit detection system which protects the guests against different attacks. It combines system call monitoring and system call hashing on the guest kernel together with Support Vector Machines (SVM)-based external monitoring on the host. We demonstrate the effectiveness of our solution by evaluating it against well-known user-level malware as well as kernel-level rootkit attacks.

Original language	English
Title of host publication	2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing
Publisher	IEEE
Pages	295-300
Number of pages	6
ISBN (Electronic)	9781467392990
ISBN (Print)	978146739297
DOIs	https://doi.org/10.1109/CSCloud.2015.54
Publication status	Published - 4 Jan 2016

Keywords

virtualization security
cloud security
malware detection
rootkit detection
support vector machine
virtual machine introspection

Documents and Links

10.1109/CSCloud.2015.54

Cite this

@inproceedings{b873a8af540f424589aefa62c996c76a,

title = "Detection of malware and kernel-level rootkits in cloud computing environments",

abstract = "Cyberattacks targeted at virtualization infrastructure underlying cloud computing services has become increasingly sophisticated. This paper presents a novel malware and rookit detection system which protects the guests against different attacks. It combines system call monitoring and system call hashing on the guest kernel together with Support Vector Machines (SVM)-based external monitoring on the host. We demonstrate the effectiveness of our solution by evaluating it against well-known user-level malware as well as kernel-level rootkit attacks.",

keywords = "virtualization security, cloud security, malware detection, rootkit detection, support vector machine, virtual machine introspection",

author = "Win, {Thu Yein} and Huaglory Tianfield and Quentin Mair",

year = "2016",

month = jan,

day = "4",

doi = "10.1109/CSCloud.2015.54",

language = "English",

isbn = "978146739297",

pages = "295--300",

booktitle = "2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing",

publisher = "IEEE",

address = "United States",

}

TY - GEN

T1 - Detection of malware and kernel-level rootkits in cloud computing environments

AU - Win, Thu Yein

AU - Tianfield, Huaglory

AU - Mair, Quentin

PY - 2016/1/4

Y1 - 2016/1/4

N2 - Cyberattacks targeted at virtualization infrastructure underlying cloud computing services has become increasingly sophisticated. This paper presents a novel malware and rookit detection system which protects the guests against different attacks. It combines system call monitoring and system call hashing on the guest kernel together with Support Vector Machines (SVM)-based external monitoring on the host. We demonstrate the effectiveness of our solution by evaluating it against well-known user-level malware as well as kernel-level rootkit attacks.

AB - Cyberattacks targeted at virtualization infrastructure underlying cloud computing services has become increasingly sophisticated. This paper presents a novel malware and rookit detection system which protects the guests against different attacks. It combines system call monitoring and system call hashing on the guest kernel together with Support Vector Machines (SVM)-based external monitoring on the host. We demonstrate the effectiveness of our solution by evaluating it against well-known user-level malware as well as kernel-level rootkit attacks.

KW - virtualization security

KW - cloud security

KW - malware detection

KW - rootkit detection

KW - support vector machine

KW - virtual machine introspection

U2 - 10.1109/CSCloud.2015.54

DO - 10.1109/CSCloud.2015.54

M3 - Conference contribution

SN - 978146739297

SP - 295

EP - 300

BT - 2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing

PB - IEEE

ER -

Detection of malware and kernel-level rootkits in cloud computing environments

Abstract

Keywords

Documents and Links

Fingerprint

Cite this