Retrospective detection of malware attacks by cloud computing

Shun Te Liu, Yi Ming Chen

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

17 Scopus citations

Abstract

As malware becomes pervasive and fast-evolving on the Internet, every computer linking to the outer world faces the risks of malware attacks. Therefore, it is important to not only detect malware as early as possible but also to determine which computer has been attacked. Among the various methods to find and trace the existence of malware, retrospective detection is promising one. Once a threat is identified, it allows one to determine exactly which host or users open similar files by searching historical information. In the past, the huge volume of historical information represents an insurmountable barrier to such traces. Fortunately, with the evolution of cloud computing technologies, this barrier can be broken. In this paper, we propose a new retrospective detection approach based on Portable Executable (PE) format file relationships. We implement our system in a Hadoop platform and use 18 real-world malware to do effective and efficient tests. Our results show that our system has a higher detection rate as well as a lower false positive rate than the famous Splunk tool. We also find that, although cloud computing is suitable for processing a small number of huge files, it has shortcomings in dealing with a large number of small files.

Original languageEnglish
Title of host publicationProceedings - 2010 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery, CyberC 2010
Pages510-517
Number of pages8
DOIs
StatePublished - 2010
Event2nd International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery, CyberC 2010 - Huangshan, China
Duration: 10 Oct 201012 Oct 2010

Publication series

NameProceedings - 2010 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery, CyberC 2010

Conference

Conference2nd International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery, CyberC 2010
Country/TerritoryChina
CityHuangshan
Period10/10/1012/10/10

Keywords

  • Cloud computing
  • Hadoop
  • Malware
  • Retrospective detection

Fingerprint

Dive into the research topics of 'Retrospective detection of malware attacks by cloud computing'. Together they form a unique fingerprint.

Cite this