Research on virus malware analysis based on cloud computing

Research on virus malware analysis based on cloud computing

Nanjing University of Aeronautics and Astronautics Menchu

This paper presents a dynamic behavior analysis scheme based on cloud computing, the scheme utilizes the characteristics of cloud computing distributed computing, and completes the analysis of multiple execution paths of virus malware in parallel on multiple virtual machine nodes in cloud computing, and the monitoring of system calls in virtual machines discovers malicious behavior triggered by virus malware under certain conditions. The PIF algorithm is used to formalize the process of suspicious file analysis and report return, and the improvement of the algorithm also improves the efficiency of the analysis, PIF algorithm is especially suitable for the implementation in the cloud computing environment. The experimental results show that the model can detect the trigger behavior of virus malware, and can find the conditions of triggering malicious behavior and the input data satisfying these conditions, while the performance of dynamic monitoring based on cloud computing is higher than that of common stand-alone system. At present, almost all static detection of malicious code is based on the signature database. This approach causes virus malware to use some simpler ways to evade detection, such as code obfuscation. In view of this situation, this paper deeply studies the application of Integrated neural network as pattern recognizer in the static detection of virus malware, and proposes a method of static behavior detection based on cloud computing. Compared with the traditional method of dynamic execution to obtain the system call sequence, this method obtains the system call sequence based on the N-grams feature extraction method, uses the feature extraction and the selection algorithm to obtain the suspicious file characteristic vector, as the input data of the training test. Based on a detailed theoretical analysis of a new CFO algorithm, a new distributed CFO algorithm is proposed, which is used to train and study the integrated neural network in the distributed computing environment of cloud computing. Finally, based on cloud computing environment, the integrated neural network is implemented to test and classify virus malware. The experimental results show that the proposed scheme has higher accuracy and less error rate compared with the traditional static detection method.

Research on virus malware analysis based on cloud computing