Recurrent Neural Networks based Online Behavioural Malware Detection Techniques for Cloud Infrastructure

: With the increased basis of applications and services on Cloud, the dependence on cloud technologies has expanded rapidly. This transition eases some of the hardware management troubles, but it also exposes broad security threats, especially in regard to malware. Malware is a major threat to cloud computing systems mainly in IaaS dominated environments. In this paper we explore the usage of Recurrent Neural Networks, RNNs in malware detection in cloud VMs. In particular, we examine two of the most popular RNN models; Long short term Memory, LSTM and Bidirectional RNNs, BIDI, that try to understand malware patterns by watching the activity of systems and the use of CPU, Memory and Disk. On the dataset of 40,680 samples 40,680 malware and benign samples, the models were trained on process level features from real malware in a free and open cloud environment. Both models achieved detection rates of over 99% in average key performance metrics. Moreover, wealso investigate the impact of different representations of input data on the performance of the models. The results of the study clearly support the viability of RNNs for online malware detection in cloud infrastructure, and allow for high accuracy and real time detection.