.png){kind=icon}
返回
Multimodal-based abnormal behavior detection method in virtualization environment
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.103908.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
With the increasing prevalence of cloud computing, various industries worldwide are relying on it to provide a wide range of services. However, anomalies in cloud environment can pose security risks such as data leakage and privacy concern. Virtualization technology is at the core of cloud computing, and abnormal behavior exhibited by virtual machines (VMs) running in cloud environment is one of the primary causes of platform disruption. Traditional methods for detecting VM anomalies in cloud platform currently face multiple challenges, including privacy protection and semantic gap. To address these issues, this paper introduces a multimodal-based abnormal behavior detection method in virtualization environment. This method initially obtains virtual hardware features of the VM at virtualization level, then acquires real hardware features and system call features at physical machine level, and finally captures memory snapshot of the VM at runtime to obtain memory features. Next, the method combines hardware features and system call features obtained from various levels as one modality input. Then, it uses a differential algorithm to identify memory modified area and visualizes them as an image, which serves as the other modality input. Finally, this paper feeds the two inputs into a multimodal model. This approach allows for the extraction of more comprehensive VM behavior information from multiple modalities, resulting in improved detection accuracy. Our experimental results demonstrate that this method can effectively detect abnormal behavior in VMs, achieving an accuracy as high as 99.24%.
Keyword:
Abnormal behavior detection
Virtualization environment
Hardware features
System call
Memory snapshot
Multimodal model
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
Caw’s Walking State Recognition Based on Accelerometers and Gyroscopes Installed on Ear-Tags and Collar-Tags基于安装在耳标和项圈上的加速度计和陀螺仪的Caw步行状态识别
PREAI
分享收藏The Emerging Role of Suppressors of Cytokine Signaling (SOCS) in the Development and Progression of Leukemia.png)
Cancers
OAAI
CancersIF0
OAAI分享收藏Efficient Hardware Malware Detectors That are Resilient to Adversarial Evasion高效的硬件恶意软件检测器，可抵御对抗性规避
PREAI
分享收藏
Using the fun toolkit and other survey methods to gather opinions in child computer interaction
PREAI
分享收藏
查看更多内容