Abnormal Behavior Detection of Virtualization Platform Based on Image and Machine Learning

doi:10.3969/j.issn.1671-1122.2020.09.019

Abstract

Abstract:

This paper proposes a method for dynamically detecting abnormal behavior of a virtualization platform based on machine learning. This method relies on the virtualization platform, extracted the system memory during normal program and malware running and dumps it into a file, extracted part of the information through SimHash to form a grayscale image and used local binary mode(LBP) to describe the texture features of the image. The features of image are used to train the constructed convolutional neural network, and the generated model determines whether the virtualization platform has abnormal behavior. Experiments show that the detection rate of virtualization platform can reach 97.5%, which can effectively detect cloud attack events.

Key words: cloud computing, virtualization, convolutional neural network, image feature, abnormal behavior detection

CLC Number:

TP309

WANG Xiangyi, ZHANG Jian. Abnormal Behavior Detection of Virtualization Platform Based on Image and Machine Learning[J]. Netinfo Security, 2020, 20(9): 92-96.

Figures/Tables 7

References 13

[1]	National Internet Emergency Center. China's Internet Network Security Situation in the First Half of 2019[EB/OL]. http://www.cac.gov.cn/2019-08/13/c_1124871484.htm, 2020-6-1.
	国家互联网应急中心. 2019年上半年我国互联网网络安全态势[EB/OL]. http://www.cac.gov.cn/2019-08/13/c_1124871484.htm, 2020-6-1.
[2]	BAEK H W, SRIVASTAVA A, DER MERWE J V, et al. CloudVMI: Virtual Machine Introspection as a Cloud Service[C]// IEEE. IEEE International Conference on Cloud Engineering, March 11-14, 2014, Washington, DC, USA. New Jersey: IEEE, 2014: 153-158.
[3]	GARFINKEL T, ROSENBLUM M. A Virtual Machine Introspection Based Architecture for Intrusion Detection[EB/OL]. https://suif.stanford.edu/papers/vmi-ndss03.pdf, 2020-6-1.
[4]	NANCE K, BISHOP M, HAY B. Virtual Machine Introspection: Observation or Interference[J]. IEEE Security & Privacy Magazine, 2008,6(5):32-37.
[5]	PFOH J, SCHNEIDER C, ECKERT C. A Formal Model for Virtual Machine Introspection[EB/OL]. http://www.cs.jhu.edu/~sdoshi/jhuisi650/papers/spimacs/SPIMACS_CD/vmsec/p1.pdf, 2020-6-1.
[6]	LI Baohui, XU Kefu, ZHANG Peng, et al. Research and Application Progress of Virtual Machine Introspection Technology[J]. Journal of Software, 2016,27(6):1384-1401.
	李保珲, 徐克付, 张鹏, 等. 虚拟机自省技术研究与应用进展[J]. 软件学报, 2016,27(6):1384-1401.
[7]	SCHULTZ M G, ESKIN E, ZADOK F, et al. Data Mining Methods for Detection of New Malicious Executables[EB/OL]. http://cseweb.ucsd.edu/~eeskin/papers/binaryeval-ieeesp01.pdf, 2020-6-1.
[8]	CONTI G, BRATUS S, SHUBINA A, et al. Automated Mapping of Large Binary Objects Using Primitive Fragment Type Classification[EB/OL]. https://dl.acm.org/doi/10.1016/j.diin.2010.05.002, 2020-6-1.
[9]	VASAN D, ALAZAB M, WASSAN S, et al. IMCFN: Image-based Malware Classification Using Fine-tuned Convolutional Neural Network Architecture[EB/OL]. https://www.sciencedirect.com/science/article/abs/pii/S1389128619304736, 2020-6-1.
[10]	NI Sang, QIAN Quan, ZHANG Rui. Malware Identification Using Visualization Images and Deep Learning[EB/OL]. https://www.sciencedirect.com/science/article/pii/S0167404818303481, 2020-6-1.
[11]	DAI Yusheng, LI Hui, QIAN Yekui, et al. A Malware Classification Method Based on Memory Dump Grayscale Image[J]. Digital Investigation, 2018,27(12):30-37. doi: 10.1016/j.diin.2018.09.006 URL
[12]	OJALA T, PIETIKINEN M, HARWOOD D. A Comparative Study of Texture Measures with Classification Based on Featured Distributions[J]. Pattern Recognition the Journal of the Pattern Recognition Society, 1996,29(1):51-59.
[13]	BAMS D, LEHNERT T, WOLFF C P. Loss Functions in Option Valuation: A Framework for Selection[J]. Management Science, 2009,55(5):853-862. doi: 10.1287/mnsc.1080.0976 URL

种类	数量
木马	15
后门软件	30
广告软件	38
蠕虫	17

方法	accuracy	precision	recall
Inception V3+SimHash +LBP+大数据集	80%	73.07%	95%
InceptionV3+SimHash	97.5%	95.24%	100%
InceptionV3+SimHash +HOG	90%	100%	80%
InceptionV3+SimHash +LBP	90%	86.36%	95%

[1]	LIU Jing, ZHANG Xueqian, LIU Quanming. Research on Captcha Recognition of Lightweight Convolutional Neural Network with Gabor [J]. Netinfo Security, 2020, 20(7): 77-84.
[2]	BIAN Manlin, WANG Liming. Analysis and Research on Vulnerability of Docker Container Isolation in Cloud Environment [J]. Netinfo Security, 2020, 20(7): 85-95.
[3]	ZHANG Leihua, HUANG Jin, ZHANG Tao, WANG Shengyu. Portrait Intelligent Analysis Application and Algorithm Optimization in Video Investigation [J]. Netinfo Security, 2020, 20(5): 88-93.
[4]	LIU Yuan, QIAO Wei. Research and Optimization of Container Network Based on Kubernetes Cluster System in Cloud Environment [J]. Netinfo Security, 2020, 20(3): 36-44.
[5]	BAI Jiameng, KOU Yingshuai, LIU Zeyi, ZHA Daren. Docker-based RBAC Task Management System [J]. Netinfo Security, 2020, 20(1): 75-82.
[6]	Liangqin REN, Wei WANG, Qiongxiao WANG, Linli LU. A New Cloud Cryptographic Computing Platform Architecture and Implementation [J]. Netinfo Security, 2019, 19(9): 91-95.
[7]	Yi YU, Liangshuang LV, Xiaojian LI, Tianbo WANG. Dynamic Network Topology Description Language for Mobile Cloud Computing Scenario [J]. Netinfo Security, 2019, 19(9): 120-124.
[8]	Zixuan WANG, Liangshuang LV, Xiaojian LI, Tianbo WANG. A Shared Storage-based Virtual Machine Application Distribution Strategy for OpenStack [J]. Netinfo Security, 2019, 19(9): 125-129.
[9]	Yanpeng CUI, Luming FENG, Zheng YAN, Huaqing LIN. Research on Software Security Model of Cloud Computing Based on Program Slicing Technology [J]. Netinfo Security, 2019, 19(7): 31-41.
[10]	Xinrui GE, Wei CUI, Rong HAO, Jia YU. Verifiable Keywords Ranked Search Scheme over Encrypted Cloud Data [J]. Netinfo Security, 2019, 19(7): 82-89.
[11]	Chunqi TIAN, Jing LI, Wei WANG, Liqing ZHANG. A Method for Improving the Performance of Spark on Container Cluster Based on Machine Learning [J]. Netinfo Security, 2019, 19(4): 11-19.
[12]	Pu ZHAO, Wei CUI, Rong HAO, Jia YU. A Secure Outsourcing Computation Scheme for El-Gamal Signature Generation [J]. Netinfo Security, 2019, 19(3): 81-86.
[13]	Zhenfeng ZHANG, Zhiwen ZHANG, Ruichao WANG. Model of Cloud Computing Security and Compliance Capability for Classified Protection of Cybersecurity 2.0 [J]. Netinfo Security, 2019, 19(11): 1-7.
[14]	Xinyang FENG, Jianjing SHEN. A Yarn and NMF Based Big Data Clustering Algorithm [J]. Netinfo Security, 2018, 18(8): 43-49.
[15]	Yuan TAO, Tao HUANG, Mohan ZHANG, Shuilin LI. Research and Development Trend Analysis of Key Technologies for Cyberspace Security Situation Awareness [J]. Netinfo Security, 2018, 18(8): 79-85.