论文标题
分析基于CNN的行为恶意软件检测技术
Analyzing CNN Based Behavioural Malware Detection Techniques on Cloud IaaS
论文作者
论文摘要
云基础架构作为服务（IAAS）很容易受到恶意软件的影响，因为它暴露于外部对手，这使其成为恶意角色的有利可图的攻击载体。感染恶意软件的数据中心可能会导致数据丢失和/或重大破坏为其用户服务。本文分析和比较了各种卷积神经网络（CNN），以在线检测云IaaS中的恶意软件。检测是根据行为数据使用过程级别性能指标（包括CPU使用，内存使用，磁盘使用情况等）进行的检测。我们已经使用了最先进的Densenets和Resnets的状态，以有效检测在线云系统中的恶意软件。 CNN旨在从从真实的云环境上运行的实时恶意软件收集的数据中提取功能。实验是在OpenStack（云IAAS软件）测试床上进行的，旨在复制典型的3层Web体系结构。对于本研究中使用的不同CNN模型，对不同指标进行了比较分析。
Cloud Infrastructure as a Service (IaaS) is vulnerable to malware due to its exposure to external adversaries, making it a lucrative attack vector for malicious actors. A datacenter infected with malware can cause data loss and/or major disruptions to service for its users. This paper analyzes and compares various Convolutional Neural Networks (CNNs) for online detection of malware in cloud IaaS. The detection is performed based on behavioural data using process level performance metrics including cpu usage, memory usage, disk usage etc. We have used the state of the art DenseNets and ResNets in effectively detecting malware in online cloud system. CNN are designed to extract features from data gathered from a live malware running on a real cloud environment. Experiments are performed on OpenStack (a cloud IaaS software) testbed designed to replicate a typical 3-tier web architecture. Comparative analysis is performed for different metrics for different CNN models used in this research.
