A4 Refereed article in a conference publication
EyeCloud: A BotCloud Detection System
Authors: Memarian Mohammad Reza, Conti Mauro, Leppänen Ville
Editors: Raimo Kantola et al
Conference name: IEEE International Conference on Trust, Security and Privacy in Computing and Communications
Publication year: 2015
Book title : Proceedings: The 9th IEEE International Conference on Big Data Science and Engineering
Volume: 1
First page : 1067
Last page: 1072
Number of pages: 6
ISBN: 978-1-4673-7952-6
DOI: https://doi.org/10.1109/Trustcom.2015.484
Leveraging cloud services, companies and organizations can significantly improve their efficiency, as well as building novel business opportunities. A significant research effort has been put in protecting cloud tenants against external attacks. However, attacks that are originated from elastic, on-demand and legitimate cloud resources should still be considered seriously. The cloud-based botnet or botcloud is one of the prevalent cases of cloud resources misuses. Unfortunately, some of the cloud’s essential characteristics enable criminals to form reliable and low cost botclouds in a short time. In this paper, we present EyeCloud, a system that helps to detect distributed infected Virtual Machines (VMs) acting as elements of botclouds. Based on a set of botnet related system level symptoms, EyeCloud groups VMs. Grouping VMs helps to separate infected VMs from others and narrows down the target group under inspection. EyeCloud takes advantages of Virtual Machine Introspection (VMI) and data mining techniques.