VMShield: memory introspection-based malware detection to secure cloud-based services against stealthy attacks

Preeti Mishra, Palak Aggarwal, Ankit Vidyarthi, Pawan Singh, Baseem Khan, Hassan Haes Alhelou, Pierluigi Siano

Research output: Contribution to journalArticleResearchpeer-review

34 Citations (Scopus)

Abstract

With the rapid evolution of the industrial Internet, cloud service has emerged as a next-generation industrial standard that has the potential to revolutionize and transform the enterprise industry. In recent years, numerous enterprises have acknowledged the benefits of cloud-based service models. However, the security issues are a major concern, such as stealthy malware attacks against virtual domains. In this article, we propose an introspection based security approach, called VMShield for securing virtual domains in a cloud based service platform, which is designed to detect malware in cloud infrastructure. VMShield performs virtual memory introspection from the hypervisor (trusted-domain) to collect the run-time behavior of processes, making it impossible for the malware to evade the security tool. The use of introspection makes the proposed approach a better choice over traditional static and dynamic state-of-the-art techniques which fail to detect stealthy attacks. The VMShield extracts the system call features using Bag of n-gram approach and selects important features using the meta-heuristic algorithm, binary particle swarm optimization. Random Forest (RF) classifier is used to classify the monitored programs into benign and malign processes, making it capable of detecting the variants of malware thus, an advantage over the typical signature-matching approach. The University of New Mexico (UNM) Dataset and Bare cloud Dataset (University of California) has been used for the demonstration and validation of VMShield. The results prove that VMShield achieves a higher attack detection rate and reduced storage compared to previously proposed techniques.

Original languageEnglish
Pages (from-to)6754-6764
Number of pages11
JournalIEEE Transactions on Industrial Informatics
Volume17
Issue number10
DOIs
Publication statusPublished - Oct 2021
Externally publishedYes

Keywords

  • Binary particle swarm optimization
  • cloud security
  • dynamic analysis
  • intrusion detection
  • machine learning
  • malware detection
  • meta-heuristics
  • VM introspection

Cite this