Polymorphic Worms Collection in Cloud Computing
This addresses the challenge of defending against sophisticated worms in cloud environments, but it is incremental as it builds on existing honeypot and forensics methods.
The paper tackled the problem of collecting polymorphic worm payloads in cloud computing by proposing a high-interactive honeypot to inspect VM memory and disk images, and experiments showed it overcomes detection challenges.
In the past few years, computer worms are seen as one of significant challenges of cloud computing. Worms are rapidly changing and getting more sophisticated to evade detection. One major issue to defend against computer worms is collecting worms' payloads to generate their signature and study their behavior. To collect worms' payloads, we identified challenges for detecting and collecting worms' payloads and proposed high-interactive honeypot to collect payloads of zero-day polymorphic worms in homogeneous and heterogeneous cloud computing platforms. Virtual machine (VM) memory and VM disk image are inspected from outside using open-source forensics tools and VMWare Virtual Disk Development Kit. Our experiments show that the proposed approach overcomes the identified challenges.