Multimodal-based abnormal behavior detection method in virtualization environment

doi:10.1016/j.cose.2024.103908

Return

Multimodal-based abnormal behavior detection method in virtualization environment

2024-08-01

PRE

DOI：10.1016/j.cose.2024.103908

Original

Original request for help

Save

Abstract

En 中文

With the increasing prevalence of cloud computing, various industries worldwide are relying on it to provide a wide range of services. However, anomalies in cloud environment can pose security risks such as data leakage and privacy concern. Virtualization technology is at the core of cloud computing, and abnormal behavior exhibited by virtual machines (VMs) running in cloud environment is one of the primary causes of platform disruption. Traditional methods for detecting VM anomalies in cloud platform currently face multiple challenges, including privacy protection and semantic gap. To address these issues, this paper introduces a multimodal-based abnormal behavior detection method in virtualization environment. This method initially obtains virtual hardware features of the VM at virtualization level, then acquires real hardware features and system call features at physical machine level, and finally captures memory snapshot of the VM at runtime to obtain memory features. Next, the method combines hardware features and system call features obtained from various levels as one modality input. Then, it uses a differential algorithm to identify memory modified area and visualizes them as an image, which serves as the other modality input. Finally, this paper feeds the two inputs into a multimodal model. This approach allows for the extraction of more comprehensive VM behavior information from multiple modalities, resulting in improved detection accuracy. Our experimental results demonstrate that this method can effectively detect abnormal behavior in VMs, achieving an accuracy as high as 99.24%.

Keywords:

Abnormal behavior detection

Virtualization environment

Hardware features

System call

Memory snapshot

Multimodal model