Polymorphic Worms Collection in Cloud Computing

In the past few years, computer worms are seen as one of significant challenges of cloud computing. Worms are rapidly changing and getting more sophisticated to evade detection. One major issue to defend against computer worms is collecting worms’ payloads to generate their signature and study their behavior. To collect worms’ payloads, we identified challenges for detecting and collecting worms’ payloads and proposed high-interactive honeypot to collect payloads of zero-day polymorphic worms in homogeneous and heterogeneous cloud computing platforms. Virtual machine (VM) memory and VM disk image are inspected from outside using open-source forensics tools and VMWare Virtual Disk Development Kit. Our experiments show that the proposed approach overcomes the identified challenges. Keywords— Computer Worms, Virtual Machine Monitoring (VMM), Cloud Computing, Virtual Machine Introspection (VMI), Polymorphic Worms