.png){kind=icon}
返回
MinCloud: Trusted and transferable MinHash-based framework for unknown malware detection for Linux cloud environments
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jisa.2024.103907.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Linux clouds have become an attractive target for cyber-attacks. However, existing detection solutions for Linux clouds have variety of limitations. Some of the solutions are untrusted, incapable of detecting unknown malware, or rely on a human expert to define the features. Other solutions are trusted but require a large amount of computational resources or have a limited ability to detect rootkits, fileless malware, or malware on a different server. In this study, we propose MinCloud, a trusted and transferable MinHash-based framework for unknown malware detection in Linux virtual servers that overcomes the limitations of existing solutions. In the first stage, we acquired volatile memory dumps from virtual servers by querying the hypervisor in a trusted manner and then analyzed them using the MinHash method. Finally, the MinHash characteristics are harnessed by applying machine learning classifiers to achieve precise malware detection. MinCloud was evaluated on widely used Linux virtual servers, various benign and malicious applications, and 23,000 volatile memory dumps, each representing different behaviors of the examined servers and the executed applications over time. MinCloud's evaluation shows it can (1) detect unknown malware, (2) classify unknown malware according to its malware category, (3) detect fileless attacks and rootkit malware, and (4) provide accurately transfer detection between different Linux servers. MinCloud outperformed state-of-the-art trusted detection methods and commonly used antiviruses.
Keyword:
Cloud
Linux
Machine learning
Malware
MinHash
Virtualization
Volatile memory forensics
期刊
IF:
3.7
论文数:
2.0K
被引数:
4.9K
机构
引用论文
分享收藏In Situ Synthesis of Carbon Nanotubes/Graphene Nanoplatelets Hybrid Materials with Excellent Mechanical Performance.png)
Nano
NanoIF0
PREAI
分享收藏The crystal and molecular structure of UO2(NO3)2[Ph2P(O)CH2C(O)Ph]2 and its role in the solvent extraction of the uranyl ionPolyhedron
PolyhedronIF0
PREAI
分享收藏
查看更多内容