Date of Publication :29th March 2018

Abstract: In this Paper Virtualized infrastructure in cloud computing has become an attractive target for cyber attackers to launch advanced attacks. This paper proposes a novel big data-based security analytics approach to detecting advanced attacks on virtualized infrastructures. Network logs, as well as user application logs collected periodically from the guest virtual machines (VMs), are stored in the Hadoop Distributed File System (HDFS). Then, extraction of attack features is performed through graphbased event correlation and Map Reduce parser based identification of potential attack paths. Next, determination of attack presence is performed through two-step machine learning, namely, logistic regression is applied to calculate attack's conditional probabilities with respect to the attributes, and belief propagation is applied to calculate the belief in the existence of an attack based on them. Experiments are conducted to evaluate the proposed approach using well-known malware as well as in comparison with existing security techniques for virtualized infrastructure

Reference :