# Online Malware Detection in Cloud Auto-scaling Systems Using Shallow Convolutional Neural Networks

Abstract : This paper introduces a novel online malware detection approach in cloud by leveraging one of its unique characteristics—auto-scaling. Auto-scaling in cloud allows for maintaining an optimal number of running VMs based on load, by dynamically adding or terminating VMs. Our detection system is online because it detects malicious behavior while the system is running. Malware detection is performed by utilizing process-level performance metrics to model a Convolutional Neural Network (CNN). We initially employ a 2d CNN approach which trains on individual samples of each of the VMs in an auto-scaling scenario. That is, there is no correlation between samples from different VMs during the training phase. We enhance the detection accuracy by considering the correlations between multiple VMs through a sample pairing approach. Experiments are performed by injecting malware inside one of the VMs in an auto-scaling scenario. We show that our standard 2d CNN approach reaches an accuracy of ${\simeq }90\%$. However, our sample pairing approach significantly improves the accuracy to ${\simeq }97\%$.
Keywords :
Document type :
Conference papers
Domain :

Cited literature [23 references]

https://hal.inria.fr/hal-02384587
Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Thursday, November 28, 2019 - 2:25:20 PM
Last modification on : Thursday, November 28, 2019 - 2:29:13 PM
Long-term archiving on: : Saturday, February 29, 2020 - 4:01:37 PM

### File

480962_1_En_20_Chapter.pdf
Files produced by the author(s)

### Citation

Mahmoud Abdelsalam, Ram Krishnan, Ravi Sandhu. Online Malware Detection in Cloud Auto-scaling Systems Using Shallow Convolutional Neural Networks. 33th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jul 2019, Charleston, SC, United States. pp.381-397, ⟨10.1007/978-3-030-22479-0_20⟩. ⟨hal-02384587⟩

Record views